WORM_DORKBOT.ACM

This worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes then deletes itself afterward.

It drops copies of itself in all removable drives. It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

It connects to Internet Relay Chat (IRC) servers.

Arrival Details

This worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This worm executes then deletes itself afterward.

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• djQPssJO4SAQzkgw
• acddww

It injects threads into the following normal process(es):

• Explorer.exe

Propagation

This worm drops copies of itself in all removable drives.

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

The said .INF file contains the following strings:

[autorun]
shellexecute={Random File Name}.exe
action=Open folder to view files
useautoplay=1
icon=shell32.dll,7
shell\explore\command={Random File Name}.exe
shell\open\command={Random File Name}.exe

Backdoor Routine

This worm opens the following port(s) where it listens for remote commands:

• TCP 3800

It connects to any of the following Internet Relay Chat (IRC) servers:

• {BLOCKED}5.{BLOCKED}8.5.139

It joins any of the following IRC channel(s):

• #ng

Other Details

This worm connects to the following URL(s) to get the affected system's IP address:

• http://api.{BLOCKED}nia.com/

NOTES:
Once this worm successfully connects to the IRC server, the remote malicious user may perform any of the following actions on the affected system:

• Download files from the specific URLs
  During analysis, it is instructed to download files from the following URLS:
  • http://{BLOCKED}6.{BLOCKED}5.246.64/gfx2.exe
  • http://{BLOCKED}6.{BLOCKED}5.246.64/dqz.exe
  • http://{BLOCKED}6.{BLOCKED}5.246.64/69z.exe
• Propagate via the following instant messaging (IM) applications:
  • Windows Live Messenger
  • MSN
  • Pidgin Chat
  • XChat
  • mIRC
• Obtain the following System Information
  • IP Address and Location
  • Operating System (OS) Type
  • OS Version and build
  • User's privilege level
• Protect itself from being tampered or deleted by hooking certain APIs.
• Modify the following files to make its removal more difficult:
  • cipconfig.exe
  • verclsid.exe
  • regedit.exe
  • rundll32.exe
  • cmd.exe
  • regsvr32.exe
• Steal FTP login credentials
• Log to FTP sites and infect HTML files by inserting iframes.
• Hook certain APIs of Internet Explorer and Firefox to intercept internet browsing communications.
• Block access to the security web sites that contains any of the following strings:
  • webroot.
  • fortinet.
  • virusbuster.nprotect.
  • gdatasoftware.
  • virus.
  • precisesecurity.
  • lavasoft.
  • heck.tc
  • emsisoft.
  • onlinemalwarescanner.
  • onecare.live.
  • f-secure.
  • bullguard.
  • clamav.
  • pandasecurity.
  • sophos.
  • malwarebytes.
  • sunbeltsoftware.
  • norton.
  • norman.
  • mcafee.
  • symantec
  • comodo.
  • avast.
  • avira.
  • bitdefender.
  • eset.
  • kaspersky.
  • trendmicro.
  • iseclab.
  • virscan.
  • garyshood.
  • viruschief.
  • jotti.
  • threatexpert.
  • novirusthanks.
  • virustotal.
• Perform DDoS (Distributed Denial of Service) attacks using the following flooding methods:
  • Slowloris flood
  • UDP flood
  • SYM flood
• Attempts to steal login credentials from web sites that contains any of the following strings:
  • *officebanking.cl/*login.asp*
  • *secure.logmein.*/*logincheck*
  • *megaupload.*/*login
  • *fileserve.*/login*
  • *twitter.com/sessions
  • *:2086/login*
  • *:2083/login*
  • *.alertpay.*/*login.aspx
  • *.moneybookers.*/*login.pl
  • *runescape*/*weblogin*
  • *dyndns*/account*
  • *no-ip*/login*
  • *steampowered*/login*
  • *hackforums.*/member.php
  • *facebook.*/login.php*
  • *login.yahoo.*/*login*
  • *login.live.*/*post.srf*
  • *TextfieldPassword=*
  • *gmx.*/*FormLogin*
  • *fastmail.*/mail/*
  • *bigstring.*/*index.php*
  • *screenname.aol.*/login.psp*
  • *aol.*/*login.psp*
  • *service=youtube*
  • *google.*/*ServiceLoginAuth*
  • *paypal.*/webscr?cmd=_login-submit*
• Hijacks messages sent from any of the following IM applications:
  • nwlcomm.exe
  • msmsgs.exe
  • msnmsgr.exe
  • pidgin.exe
  • xchat.exe