Worm.Win32.DORKBOT.TIGAAAW

This Worm arrives via removable drives. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It terminates itself if it detects it is being run in a virtual environment.

Arrival Details

This Worm arrives via removable drives.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Worm drops the following files:

• {Removable Drive}:\_\autorun.inf -> contains the following strings "[AUtoRuN]",LF,"ShEllExECUte=__\DriveMgr.exe",LF,"UseAUtoPlAY=1"
• {Removable Drive}:\__\.lnk -> points to the dropped copy
• %Application Data%\winsvcs.txt

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It creates the following folders:

• {Removable Drive}:\_

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• {random characters}

Other System Modifications

This Worm deletes the following files:

• {malware name}:Zone.Identifier

It modifies the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
FirewallDisableNotify = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
AutoUpdateDisableNotify = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
UpdatesDisableNotify = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
AntiVirusDisableNotify = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
FirewallOverride = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
UpdatesOverride = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
AntiVirusOverride = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\SystemRestore
DisableSR = 1

Propagation

This Worm drops the following copy(ies) of itself in all removable drives:

• {Removable Drive}:\_\DriveMgr.exe

Other Details

This Worm connects to the following possibly malicious URL:

• hxxp://{BLOCKED}.27.132/
• hxxp://urusurofhsor{BLOCKED}.su/
• hxxp://aeifaeifhutu{BLOCKED}.su/
• hxxp://rzhsudhugugf{BLOCKED}.su/
• hxxp://bfagzzezgaeg{BLOCKED}.su/
• hxxp://eaeuafhuaegf{BLOCKED}.su/
• hxxp://aeufuaehfiueh{BLOCKED}.su/
• hxxp://daedagheaueh{BLOCKED}.su/
• hxxp://aeoughaohegu{BLOCKED}.su/
• hxxp://eguaheoghouu{BLOCKED}.su/
• hxxp://huaeokaefoae{BLOCKED}.su/
• hxxp://afaeigaifgsg{BLOCKED}.su/
• hxxp://afaigaeigieuf{BLOCKED}.su/
• hxxp://geauhouefheu{BLOCKED}.su/
• hxxp://gaoheeuofhef{BLOCKED}.su/
• hxxp://gaouehaehfoae{BLOCKED}.su/
• hxxp://gaohrhurhuhru{BLOCKED}.su/
• hxxp://gaghpaheiafh{BLOCKED}.su/
• hxxp://gaoehuoaoefh{BLOCKED}.su/
• hxxp://aegohaohuoru{BLOCKED}.su/
• hxxp://befaheaiudeu{BLOCKED}.su/
• hxxp://urusurofhsorh{BLOCKED}.io/
• hxxp://aeifaeifhutu{BLOCKED}.io/
• hxxp://rzhsudhugugf{BLOCKED}.io/
• hxxp://bfagzzezgaeg{BLOCKED}.io/
• hxxp://eaeuafhuaegf{BLOCKED}.io/
• hxxp://aeufuaehfiue{BLOCKED}.io/
• hxxp://daedagheaueh{BLOCKED].io/
• hxxp://aeoughaohegu{BLOCKED}.io/
• hxxp://eguaheoghouug{BLOCKED}.io/
• hxxp://huaeokaefoae{BLOCKED}.io/
• hxxp://afaeigaifgsg{BLOCKED}.io/
• hxxp://afaigaeigieu{BLOCKED}.io/
• hxxp://geauhouefheu{BLOCKED}.io/
• hxxp://gaoheeuofhef{BLOCKED}.io/
• hxxp://gaouehaehfoa{BLOCKED}.io/
• hxxp://gaohrhurhuhr{BLOCKED}.io/
• hxxp://gaghpaheiafh{BLOCKED}.io/
• hxxp://gaoehuoaoefh{BLOCKED}.io/
• hxxp://aegohaohuoru{BLOCKED}.io/
• hxxp://befaheaiudeu{BLOCKED}.io/
• hxxp://urusurofhsor{BLOCKED}.cc/
• hxxp://aeifaeifhutu{BLOCKED}.cc/
• hxxp://rzhsudhugugf{BLOCKED}.cc/
• hxxp://bfagzzezgaeg{BLOCKED}.cc/
• hxxp://eaeuafhuaegf{BLOCKED}.cc/
• hxxp://aeufuaehfiue{BLOCKED}.cc/
• hxxp://daedagheaueh{BLOCKED}.cc/
• hxxp://aeoughaohegua{BLOCKED}.cc/
• hxxp://eguaheoghouu{BLOCKED}.cc/
• hxxp://huaeokaefoae{BLOCKED}.cc/
• hxxp://afaeigaifgsg{BLOCKED}.cc/
• hxxp://afaigaeigieu{BLOCKED}.cc/
• hxxp://geauhouefheu{BLOCKED}.cc/
• hxxp://gaoheeuofhef{BLOCKED}.cc/
• hxxp://gaouehaehfoa{BLOCKED}.cc/
• hxxp://gaohrhurhuhr{BLOCKED}.cc/
• hxxp://gaghpaheiafh{BLOCKED}.cc/
• hxxp://gaoehuoaoefh{BLOCKED}.cc/
• hxxp://aegohaohuoru{BLOCKED}.cc/
• hxxp://befaheaiudeu{BLOCKED}.cc/
• hxxp://urusurofhsor{BLOCKED}.co/
• hxxp://aeifaeifhutu{BLOCKED}.co/
• hxxp://rzhsudhugugf{BLOCKED}.co/
• hxxp://bfagzzezgaeg{BLOCKED}.co/
• hxxp://eaeuafhuaegf{BLOCKED}.co/
• hxxp://aeufuaehfiue{BLOCKED}.co/
• hxxp://daedagheaueh{BLOCKED}.co/
• hxxp://aeoughaohegu{BLOCKED}.co/
• hxxp://eguaheoghouu{BLOCKED}.co/
• hxxp://huaeokaefoae{BLOCKED}.co/
• hxxp://afaeigaifgsg{BLOCKED}.co/
• hxxp://afaigaeigieu{BLOCKED}.co/
• hxxp://geauhouefheu{BLOCKED}.co/
• hxxp://gaoheeuofhef{BLOCKED}.co/
• hxxp://gaouehaehfoa{BLOCKED}.co/
• hxxp://gaohrhurhuhr{BLOCKED}.co/
• hxxp://gaghpaheiafh{BLOCKED}.co/
• hxxp://gaoehuoaoefh{BLOCKED}.co/
• hxxp://aegohaohuoru{BLOCKED}.co/
• hxxp://befaheaiudeu{BLOCKED}.co/
• hxxp://{BLOCKED}.top/
• hxxp://aeifaeifhutu{BLOCKED}.top/
• hxxp://rzhsudhugugf{BLOCKED}.top/
• hxxp://bfagzzezgaeg{BLOCKED}.top/
• hxxp://eaeuafhuaegf{BLOCKED}.top/
• hxxp://aeufuaehfiue{BLOCKED}.top/
• hxxp://daedagheaueh{BLOCKED}.top/
• hxxp://aeoughaohegu{BLOCKED}.top/
• hxxp://eguaheoghouu{BLOCKED}.top/
• hxxp://huaeokaefoae{BLOCKED}.top/
• hxxp://afaeigaifgsg{BLOCKED}.top/
• hxxp://afaigaeigieu{BLOCKED}.top/
• hxxp://geauhouefheu{BLOCKED}.top/
• hxxp://gaoheeuofhef{BLOCKED}.top/
• hxxp://gaouehaehfoa{BLOCKED}.top/
• hxxp://gaohrhurhuhr{BLOCKED}.top/
• hxxp://gaghpaheiafh{BLOCKED}.top/
• hxxp://gaoehuoaoefh{BLOCKED}.top/
• hxxp://aegohaohuoru{BLOCKED}.top/
• hxxp://befaheaiudeu{BLOCKED}.top/
• hxxp://{BLOCKED}61.73/
• {URL in this list}/t.php?new=1
• {URL in this list}/t.php?on=1
• {URL in this list}/{increasing number from 1-8}

It terminates itself if it detects it is being run in a virtual environment.

It does the following:

• It terminates itself if any of the following is found running:
  • DLL
    • sbiedll.dll
    • sbiedllx.dll
    • wpespy.dll
    • dir_watch.dll
    • api_log.dll
    • dir_watch.dll
    • pstorec.dll
  • Process
    • vboxservice.exe
    • vboxtray.exe
    • vmtoolsd.exe
    • vmwaretray.exe
    • vmwareuser
    • vmsrvc.exe
    • vmusrvc.exe
    • prl_tools.exe
    • xenservice.exe
• It moves the files with the following extensions to the created directory:
  • .lnk
  • .vbs
  • .bat
  • .js
  • .scr
  • .com
  • .jse
  • .cmd
  • .pif
  • .jar
  • .dll
  • .vbe
• If it successfully connected to {URL}/{increasing number from 1-8} it would download and execute the following files:
  • %User Temp%\{random characters}.exe

It does not proceed to its malicious routine if it detects that it is being debugged.