WORM_MOFIN.E

This worm arrives by connecting affected removable drives to a system. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It retrieves specific information from the affected system.

Arrival Details

This worm arrives by connecting affected removable drives to a system.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This worm drops the following copies of itself into the affected system and executes them:

• %Windows%\system\svchost..exe (For Windows XP and prior)
• %User Profile%\Documents\suchost..exe (For Windows Vista and later)

(Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.. %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.)

Autostart Technique

This worm drops the following file(s) in the Windows User Startup folder to enable its automatic execution at every system startup:

• %User Startup%\svchost..exe

(Note: %User Startup% is the current user's Startup folder, which is usually C:\Windows\Profiles\{user name}\Start Menu\Programs\Startup on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu\Programs\Startup on Windows NT, and C:\Documents and Settings\{User name}\Start Menu\Programs\Startup.)

Propagation

This worm drops the following copy(ies) of itself in all removable drives:

• movies.exe

Dropping Routine

This worm drops the following files:

• %User Startup%\svchost..exe

(Note: %User Startup% is the current user's Startup folder, which is usually C:\Windows\Profiles\{user name}\Start Menu\Programs\Startup on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu\Programs\Startup on Windows NT, and C:\Documents and Settings\{User name}\Start Menu\Programs\Startup.)

Information Theft

This worm retrieves the following information from the affected system:

• *.doc
• *.xlsx
• *.xls
• *.docx
• *.pdf

Stolen Information

The stolen information is saved in the following file:

• %System Root%\Users\Public\Documents\wsystem.vx (For Windows Vista and later)
• %Windows%\system\wsystem.vx (For Windows XP and prior)

(Note: %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.. %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.)

It sends the data it gathers to the following email addresses via SMTP:

• {BLOCKED}iler511@{BLOCKED}il.com
• {BLOCKED}re2011@{BLOCKED}l.com

Drop Points

This worm uses its own SMTP engine to send the stolen data using the following domain server:

• smtp.gmail.com

NOTES:

The email it sends contains the following information:

Subject = {Username}
Attachment = wsystem.vx
Body = mac address : {mac_address};-- file path : {file path of wsystem.vx}
Email Password = 19121990xman