DUNIHI

The DUNIHI malware family is commonly obfuscated VBS malware which is capable of propagating via removable drive infection. DUNIHI may arrive as an attachment to spam. It may also arrive via removable drives or as a file dropped by other malware or downloaded unknowingly upon visiting malicious sites. Besides its propagation routine, it can also connect to its command-and-control (C&C ) servers to send and receive commands from malicious users, thus compromising the affected system. DUNIHI gets its name from its creator known as Houdini.

Installation

This worm drops the following files:

• {drive letter}:\{folder\file name}.lnk

It drops the following copies of itself into the affected system:

• %User Temp%\{malware file name}.vbs
• %Application Data%\{malware file name}.vbs
• %User Startup%\{malware file name}.vbs
• {drive letter}:\{malware file name}.vbs

(Note: %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %User Startup% is the current user's Startup folder, which is usually C:\Windows\Profiles\{user name}\Start Menu\Programs\Startup on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu\Programs\Startup on Windows NT, and C:\Documents and Settings\{User name}\Start Menu\Programs\Startup.)

Other System Modifications

This worm adds the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\{malware file name}

It also creates the following registry entry(ies) as part of its installation routine:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{malware file name} = "wscript.exe //B "%User Temp%\{malware file name}.vbs""

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
{malware file name} = "wscript.exe //B "%User Temp%\{malware file name}.vbs""

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{malware file name} = "wscript.exe //B "%Application Data%\{malware file name}.vbs""

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
{malware file name} = "wscript.exe //B " %Application Data%\malware file name}.vbs""

HKEY_LOCAL_MACHINE\SOFTWARE\{malware file name}
(Default) = "{true or false (if executed from removable drive)} - {date of first execution}"

Other Details

This worm connects to the following possibly malicious URL:

• {BLOCKED}.{BLOCKED}.186.27:288/is-ready
• klonkino.{BLOCKED}p.org:1806/is-ready
• rawadnajjar.{BLOCKED}p.biz:12345/is-ready
• herohero.{BLOCKED}p.org:96/is-ready
• s-mz.{BLOCKED}s.net:30516/is-ready