WORM_IPPEDO.B

This worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system.

Arrival Details

This worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This worm drops the following copies of itself into the affected system:

• %System Root%\Google\googleupdate.a3x

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

It creates the following folders:

• %System Root%\Skypee
• %System Root%\Google

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

It terminates itself if it finds the following processes in the affected system's memory:

• combination of the following processes:
  • avp.exe, zonealarm.exe and avguard.exe
  • tcpview.exe, procmon.exe and nod32kui.exe
  • kavmm.exe, procmon.exe and fsbwsys.exe
  • vmacthlp.exe, avp.exe and kavsvc.exe
• VBoxService.exe
• VBoxTray.exe
• guninraik.exe
• SbieSvc.exe
• VMwareTray.exe
• VMwareUser.exe
• VMwareService.exe
• VMwareUser.exe
• FortiTracer.exe
• vmacthlp.exe
• vmtoolsd.exe
• BehaviorDumper.exe
• FakeHTTPServer.exe
• FakeServer.exe
• FakeHTTPServer.exe
• FakeHTTPServer.exe
• FakeHTTPServer.exe
• FakeHTTPServer.exe

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Run
Windows Update = "%System Root%\Google\Windowsupdate.lnk"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Windows Update = "%System Root%\Google\Windowsupdate.lnk"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
AdopeUpdate = "%System Root%\Google\GoogleUpdate.lnk"

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Run
JavaUpdate = "%System Root%\Google\GoogleUpdate.lnk"

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Run
NewJavaInstall = "%System Root%\Google\AutoIt3.exe /AutoIt3ExecuteScript %System Root%\Google\googleupdate.a3x"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
AdopeFlash = "%System Root%\Google\AutoIt3.exe /AutoIt3ExecuteScript %System Root%\Google\googleupdate.a3x"

It drops the following file(s) in the Windows Common Startup folder to enable its automatic execution at every system startup:

• GoogleUpdate.lnk
• Windows Update.lnk

Other System Modifications

This worm deletes the following files:

• googleupdate.vbs

It modifies the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
ShowSuperHidden = "0"

(Note: The default value data of the said registry entry is {user-defined}.)

Propagation

This worm drops the following copy of itself in all physical and removable drives:

• {drive}:\Skypee\googleupdate.a3x

Backdoor Routine

This worm executes the following commands from a remote malicious user:

• Restart malware
• Insert script to HTML
• Update copy
• Display message box
• Access a URL specified by remote user
• Execute command through cmd.exe
• Download arbitrary files
• Shutdown
• Restart
• Logoff
• Standby

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• {BLOCKED}ou.{BLOCKED}o.org:86

Information Theft

This worm gathers the following data:

• Malware ID
• Computer name
• User name
• Country
• OS Version
• OS Architecture (32bit/64bit)
• Active window title
• Installed AV application

Other Details

This worm accesses the following URL(s) to get the affected system's location:

• http://www.geoplugin.net/json.gp

NOTES:

If the OS version is Windows7 or Windows XP, it will retrieve system information using the following command:

• %comspec% /c SystemInfo

It terminates itself if system information contains the following strings:

• Bochs
• innotek
• VMware

It will terminate itself if malware file name meets the following conditions:

• contains "artifact" string
• contains "sample" string
• does not contain ""
• filename length is greater than 35

It will terminate itself if the following folders are present:

• C:\CWSandbox
• C:\python26
• C:\cuckoo
• C:\virus

It will enumerate process modules. It terminates itself if the following files are found:

• snxhk.dll
• tracer.dll
• SbieDll.dll
• api_log.dll
• dir_watch.dll
• dbghelp.dll
• monitornet.dll
• cuckoo
• SandCastle
• sandbox
• tracer.dll

It creates the following shortcut (.LNK) files in removable drives that points to its copy:

• Downloads
• Hot
• Movies
• My Games
• My Pictuers
• My Videos
• Skypee\Skypee.lnk

It also creates shortcut (.LNK) files using folder names as filenames in folders in all drives.

The dropped shorcut files are detected as LNK_IPPEDO.B.

It copies all files found in the current malware path to the created Skypee folder.