WORM_GOLROTED.SM1

This worm arrives via removable drives. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

It connects to certain websites to send and receive information.

Arrival Details

This worm arrives via removable drives.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This worm drops the following copies of itself into the affected system and executes them:

• %Application Data%\Windows Update.exe

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It drops the following files:

• %Application Data%\pid.txt
• %Application Data%\pidloc.txt
• %User Temp%\SysInfo.txt
• %User Temp%\screens\screenshot1.jpeg

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It drops the following copies of itself into the affected system:

• %Application Data%\WindowsUpdate.exe

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Propagation

This worm drops the following copy(ies) of itself in all removable drives:

• {Removable Drive Letter}:\Sys.exe

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

The said .INF file contains the following strings:

[autorun]
open=Sys.exe
action=Run win32

Information Theft

This worm gathers the following data:

• malware process id
• malware path
• original malware path
• hostname
• Screenshots
• Keyboard Logs
• Clipboard Logs
• System Time
• Internal Language
• Operating System
• Internal IP
• External IP
• AntiVirus Installed
• Firewall Installed
• Current Active Window

Other Details

This worm connects to the following URL(s) to get the affected system's IP address:

• whatismyipaddress.com

It connects to the following website to send and receive information:

• HTTP://{BLOCKED}.{BLOCKED}.212.64/WebPanel/log.php?

NOTES:

It accesses the following SMTP servers in preparation to send its stolen information

• smtp.mail.ru

It steals passwords from the following applications

• Browsers
• Messaging Applications
• Internet Download Manager
• Jdownloader
• Minecraft

It steals passwords from the following messaging applications

• Microsoft Outlook
• Mozilla Thunderbird
• IncrediMail
• Eudora
• Yahoo! Mail
• Google Talk
• Gmail Notifier
• MSN Messenger
• Windows Live Mail
• Miranda IM

It steals passwords from the following browsers:

• Firefox
• Internet Explorer
• Chrome
• Chrome S x S
• Opera
• Apple Safari
• SeaMonkey

It disables the following processes:

• taskmgr.exe
• Taskmgr.exe
• regedit.exe
• msconfig.exe
• cmd.exe