WORM_CHIVIPER.KT

This worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It deletes itself after execution.

Arrival Details

This worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Other System Modifications

This worm deletes the following files:

• %Windows%\B23D1000

(Note: %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.)

It modifies the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\Session Manager
ExcludeFromKnownDlls = "usp10.dll"

(Note: The default value data of the said registry entry is {random values}.)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
Hidden = "2"

(Note: The default value data of the said registry entry is 2.)

Dropping Routine

This worm drops the following files:

• %User Temp%\0005346.tmp
• %Windows%\usp10.dll

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.. %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.)

Other Details

This worm connects to the following possibly malicious URL:

• http://xtxt119.{BLOCKED}f.com/ico/m1012.txt
• http://tj1012.{BLOCKED}y.com/tj1109/post.asp?{random characters}

It deletes itself after execution.

This report is generated via an automated analysis system.