WORM_BEAUGRI.B

This Trojan arrives via removable drives.

It drops copies of itself in all drives. These dropped copies use the names of the folders located on the said drives for their file names.

It connects to certain websites to send and receive information.

Arrival Details

This Trojan arrives via removable drives.

Installation

This Trojan drops the following copies of itself into the affected system:

• %User Temp%\cmss.exe
• %User Profile%\Start Menu\cmss.exe

(Note: %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.)

It drops the following non-malicious file:

• %User Temp%\RECYCLER_w\AllIndex.ini_d
• %User Temp%\RECYCLER_w\AllIndex.ini

(Note: %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It creates the following folders:

• %User Temp%\RECYCLER_w

(Note: %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Autostart Technique

This Trojan drops the following file(s) in the Windows User Startup folder to enable its automatic execution at every system startup:

• %User Startup%\seruvice.lnk

(Note: %User Startup% is the current user's Startup folder, which is usually C:\Windows\Profiles\{user name}\Start Menu\Programs\Startup on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu\Programs\Startup on Windows NT, and C:\Documents and Settings\{User name}\Start Menu\Programs\Startup.)

Propagation

This Trojan drops copies of itself in all drives. These dropped copies use the names of the folders located on the said drives for their file names.

Download Routine

This Trojan accesses the following websites to download files:

• http://www.{BLOCKED}bler.com/newsinfo/uld/nettraveler.asp

Other Details

This Trojan connects to the following website to send and receive information:

• http://www.{BLOCKED}bler.com/newsinfo/uld/nettraveler.asp?hostid={hostid}&hostname={hostname}&hostip={ip}&filename=-AllIndex.ini_d&filestart=0&filetext=begin::{encrypted data}

NOTES:

This worm searches for files in fixed and removable drives and saves it to the file AllIndex.ini. It then encrypts the file and saves it as AllIndex.ini_d and sends it to a remote server.

It may receive instructions from a remote user and is capable of the following:

• Download and execute files
• Send email
• Send updates to remote server
• Send files
• Uninstall

It may send email using the following Simple Mail Transfer Protocol (SMTP) server:

• smtp.live.com
• smtp.yahoo.com