WORM_KOLAB.JER

This worm arrives via removable drives. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It adds key(s)/entry(ies) to allow itself to run on safe mode. This action adds difficulty in the removal of this malware from the affected computer.

It drops copies of itself in all removable drives. It exploits software vulnerabilities to propagate to other computers across a network.

It executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.

It exports functions used by other malware.

Arrival Details

This worm arrives via removable drives.

It may arrive via network shares.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Autostart Technique

This worm registers itself as a system service to ensure its automatic execution at every system startup by adding the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\srv{random characters}
Type = "20"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\srv{random characters}
Start = "2"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\srv{random characters}
ErrorControl = "1"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\srv{random characters}
ImagePath = "%System Root%\system32\svchost.exe -k netsvcs"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\srv{random characters}
DisplayName = "srv{random characters}"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\srv{random characters}
ObjectName = "LocalSystem"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\srv{random characters}\parameters
servicedll = "\?\globalroot\Device\HarddiskVolume1\%User Temp%\srv{numbers}.tmp"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\srv{random characters}\Security
Security = "{hex values}"

It adds the following key(s)/entry(ies) to allow itself to run on safe mode:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Minimal\
srv{Random Characters}

Propagation

This worm drops copies of itself in all removable drives.

The said .INF file contains the following strings:

;{garbage characters}
[AutoRun]
AcTIOn=opeN
;{garbage characters}
IcON=%Windows%\SYstEm32\ShelL32.DLl,4
;{garbage characters}
UsEaUtoPlAy=1
;{garbage characters}
oPEN=RUNDLl32.EXe sETup{numbers}.foN,{parameters}
;{garbage characters}
SHElL\eXPLore\ComManD=ruNDLL32.EXe setup{numbers}.fON,{parameters}
;{garbage characters}
SHelL\Open\cOmmaNd=rundLL32.EXE sETUP{numbers}.fON,{parameters}
;{garbage characters}

(Note: %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.)

It exploits the following software vulnerabilities to propagate to other computers across a network:

• Vulnerability in Server Service Could Allow Remote Code Execution (958644)

Backdoor Routine

This worm connects to the following URL(s) to send and receive commands from a remote malicious user:

• http://195.14.112.138/service/listener.php?affid={random}
• http://195.14.112.136/

Download Routine

This worm connects to the following URL(s) to download its component file(s):

• http://195.14.112.139/service/scripts/files/aff_{random}.dll

It saves the files it downloads using the following names:

• %User Temp%\srv{Random Characters}.tmp

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)

It then executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.

Other Details

This worm exports functions used by other malware.

NOTES:
It also creates the following .LNK component files in shared folders. When users double-click these files, its dropped copy is automatically executed:

• autorun.inf
• myporno.avi.lnk
• pornmovs.lnk
• setup{number}.lnk

• setup{numbers}.fon