WORM_LBUCK.A

This worm arrives via removable drives. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This worm arrives via removable drives.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This worm drops the following copies of itself into the affected system:

• %System Root%\lsasss.exe

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
lsasss = "%System Root%\lsasss.exe"

Propagation

This worm drops the following copy(ies) of itself in all removable drives:

• Money.exe
• Pictures.exe
• Documents.exe
• Music.exe
• Films.exe
• Mp3.exe

Other Details

This worm connects to the following possibly malicious URL:

• http://{BLOCKED}c5cc.{BLOCKED}kbucks.com
• http://{BLOCKED}9e.{BLOCKED}kbucks.com
• http://{BLOCKED}7f.{BLOCKED}kbucks.com
• http://{BLOCKED}9d.{BLOCKED}kbucks.com
• http://{BLOCKED}99.{BLOCKED}kbucks.com
• http://{BLOCKED}97.{BLOCKED}kbucks.com
• http://{BLOCKED}f4.{BLOCKED}kbucks.com
• http://{BLOCKED}80.{BLOCKED}kbucks.com
• http://{BLOCKED}b3.{BLOCKED}kbucks.com