WORM_OTORUN.TES

This worm arrives by connecting affected removable drives to a system. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

It connects to certain URLs. It may do this to remotely inform a malicious user of its installation. It may also do this to download possibly malicious files onto the computer, which puts the computer at a greater risk of infection by other threats. As of this writing, the said sites are inaccessible.

Arrival Details

This worm arrives by connecting affected removable drives to a system.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This worm drops the following copies of itself into the affected system:

• %Windows%\tesy.exe

(Note: %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• SiGou
• SiGou-GouGou
• nothing,kuaigeiwoxiaoshi!
• kuaigeiwoxiaoshi!

It injects itself into the following processes as part of its memory residency routine:

• svchost.exe

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
lisyt = "%Windows%\tesy.exe"

Other System Modifications

This worm adds the following registry keys:

HKEY_CURRENT_USER\Software\{random}

It adds the following registry entries:

HKEY_CURRENT_USER\Software\{random}
lisyt = "%Windows%\tesy.exe"

Propagation

This worm drops the following copy of itself in all physical and removable drives:

• tesy.exe

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

The said .INF file contains the following strings:

[AutoRun]
Open=tesy.exe
Shell\Open={garbage}
Shell\Open\Command=tesy.exe
Shell\Open\Default=1
Shell\Explore={garbage}
Shell\Explore\Command=tesy.exe

Download Routine

This worm connects to the following malicious URLs:

• http://vvv.{BLOCKED}e.com/count/list.txt

As of this writing, the said sites are inaccessible.