WORM_PALEVO.CKY

This worm arrives by connecting affected removable drives to a system. It may be dropped by other malware. It may be unknowingly downloaded by a user while visiting malicious websites.

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

It executes commands from a remote malicious user, effectively compromising the affected system.

It steals system information.

Arrival Details

This worm arrives by connecting affected removable drives to a system.

It may be dropped by other malware.

It may be unknowingly downloaded by a user while visiting malicious websites.

Installation

This worm drops the following non-malicious files:

• %System Root%\RECYCLER\S-1-5-21-8041228422-6811293282-944773298-9385\Desktop.ini

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

It drops the following copies of itself into the affected system:

• %System Root%\RECYCLER\S-1-5-21-8041228422-6811293282-944773298-9385\wmfcgr.exe

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

It creates the following folders:

• %System Root%\RECYCLER
• %System Root%\RECYCLER\S-1-5-21-8041228422-6811293282-944773298-9385

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

It is injected into the following processes running in memory:

• EXPLORER.EXE

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
Taskman = %System Root%\RECYCLER\S-1-5-21-8041228422-6811293282-944773298-9385\wmfcgr.exe

Propagation

This worm creates the following folders in all removable drives:

• RECYCLING

It drops the following copy(ies) of itself in all removable drives:

• RECYCLING\autorun.exe

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

The said .INF file contains the following strings:

[autorun]
open=RECYCLING\autorun.exe
icon=%SystemRoot%\system32\SHELL32.dll,4
action=Open folder to view files
shell\open=Open
shell\open\command=RECYCLING\autorun.exe
shell\open\default=1

Backdoor Routine

This worm executes the following commands from a remote malicious user:

• Perform DDoS attacks
• Download and execute other files from the server
• Spread via MSN messenger
• Spread via P2P applications
• Perform port scanning

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• {BLOCKED}lowingbabes.net
• {BLOCKED}mera.com
• {BLOCKED}nibaaaq.com

Information Theft

This worm steals system information.

Other Details

This worm does the following:

• It also steals the following information:
  
  • Mozilla Firefox account information
  • Protected Storage credentials
• It drops copies of itself in folders used by the following P2P applications:
  
  • Ares Galaxy
  • BearShare
  • DC++
  • eMule
  • eMule Plus
• It connects to the servers using random UDP ports.