Worm.JS.DLOADR.AA

This Worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.

Arrival Details

This Worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Worm drops the following files:

• %User Temp%\{Random Numbers}.cro -> Encrypted executable
• %User Temp%\{Random Numbers}.exe -> Decrypted executable

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following processes:

• cmd /U /Q /C cd /D : && dir /b/s/x *.doc *.xls *.pdf *.rtf *.txt *.pub *.odt *.ods *.odp *.odm *.odc *.odb >> %TEMP%\ascii.txt
• cmd /U /Q /C copy /Y "{Malware File Directory}\{Malware File Name}" "{Name of the File it will replace}.jse && del /Q/F {Name of the File it will replace}"
• certutil.exe -decode %User Temp%\{Random Number}.cro %User Temp%\{Random Number}.exe
• %User Temp%\{Random Number}.exe

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It displays the following fake error messages:

Autostart Technique

This Worm drops the following file(s) in the Windows User Startup folder to enable its automatic execution at every system startup:

• %User Startup%\shell.jse

(Note: %User Startup% is the current user's Startup folder, which is usually C:\Windows\Profiles\{user name}\Start Menu\Programs\Startup on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu\Programs\Startup on Windows NT, C:\Documents and Settings\{User name}\Start Menu\Programs\Startup on Windows 2003(32-bit), XP and 2000(32-bit), or C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit), 10(64-bit).)

Download Routine

This Worm connects to the following website(s) to download and execute a malicious file:

• https://{BLOCKED}.{BLOCKED}.82.15/hollyhole/c644.php

It saves the files it downloads using the following names:

• %User Temp%\{Random Numbers}.exe
• %User Temp%\{Random Numbers}.cro

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It then executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.

Information Theft

This Worm gathers the following data:

• Operating System
• List of Running Processes

Other Details

This Worm does the following:

• If it fails to download a file from its C&C Server, it locates for files with the following extensions in shared and removable drives, deletes the file and replaces the deleted file with a copy of itself:
  • .doc
  • .xls
  • .pdf
  • .rtf
  • .txt
  • .pub
  • .odt
  • .ods
  • .odp
  • .odm
  • .odc
  • .odb
• It terminates itself if it satisfies any of the following conditions.
  • Any of the following processes are found in the affected system’s memory:
    • anti - virus.EXE
    • lordPE.exe
    • B.exe
    • iexplore.exe
    • Proxifier.exe
    • ctfmon.exe
    • AgentSimulator.exe
    • VzService.exe
    • VBoxTray.exe
    • gemu - ga.exe
    • BennyDB.exe
    • windanr.exe
  • Any of the following debugging tools are found in the system:
    • Procmon
    • Wireshark
    • ProcessHacker
    • vmtoolsd
    • VBoxService
    • ImmunityDebugger
    • BehaviorDumper
    • PROCMON
    • procexp
    • tcpdump
    • FrzState2k
    • DFLocker64
    • vmware
    • LOGSystem.Agent.Service.exe
  • Any of the following strings are existing in the environment that it is executed:
    • VmRemoteGuest
    • SystemIT | admin
    • WIN7 - TRAPS
    • Emily
    • milozs
    • Johnson
    • HAPUBWS
    • Peter Wilson
    • Hong Lee