WORM_IRCBOT.MA

This worm arrives via removable drives. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

It listens on ports. It joins an Internet Relay Chat (IRC) channel.

Arrival Details

This worm arrives via removable drives.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This worm drops the following copies of itself into the affected system:

• %System Root%\RESTORE\{random SID}\DriveFix.exe

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

It drops the following files:

• %System Root%\RESTORE\{random SID}\Desktop.ini - non-malicious file

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

It creates the following folders:

• %System Root%\RESTORE\{random SID}

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

It is injected into the following processes running in memory:

• Explorer.exe

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Active Setup\Installed Components\{28ABC5C0-4FCB-11CF-AAX5-21CX1C987192}
StubPath = "%System Root%\RESTORE\{random SID}\DriveFix.exe"

Other System Modifications

This worm adds the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Active Setup\Installed Components\{28ABC5C0-4FCB-11CF-AAX5-21CX1C987192}

Propagation

This worm drops the following copy(ies) of itself in all removable drives:

• {drive letter}:\RESTORE\{random SID}\DriveFix.exe

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

The said .INF file contains the following strings:

[AutoRun]
open=RESTORE\{random SID}\DriveFix.exe
icon=%System Root%\system32\SHELL32.dll,4
action=Open folder to view files
shell\open=Open
shell\open\command=RESTORE\{random SID}\DriveFix.exe
shell\open\default=1

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

Backdoor Routine

This worm listens on the following port(s):

• TCP 18631

It connects to any of the following IRC server(s):

• {BLOCKED}.{BLOCKED}.174.3

It joins any of the following Internet Relay Chat (IRC) channels:

• #l4mer# l4m0s

Other Details

This worm does the following:

• It drops the file {drive letter}:\RESTORE\{random SID}\Desktop.ini in all removable drives.

NOTES:

Once connected to the Internet Relay Chat (IRC), it uses the following credentials:

• NICK [laMer]jxmbzjrdp
  USER 0nefsrselc "" "uih" :nefsrselc
• NICK [laMer]lzzuauhsm
  USER 0mscvlzfrp "" "dik" :mscvlzfrp

It sends PING requests to the following remote host:

• {BLOCKED}p.aic.pa

However, as of this writing, the said remote host is inaccessible.