WORM_REFROSO.WI

This worm arrives via removable drives. It may be dropped by other malware. It may be unknowingly downloaded by a user while visiting malicious websites.

It drops copies of itself in all removable drives. It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

It opens a random port to allow a remote user to connect to the affected system. Once a successful connection is established, the remote user executes commands on the affected system. It runs certain commands that it receives remotely from a malicious user. Doing this puts the affected computer and information found on the computer at greater risk. It connects to a website to send and receive information.

Arrival Details

This worm arrives via removable drives.

It may be dropped by other malware.

It may be unknowingly downloaded by a user while visiting malicious websites.

Installation

This worm drops the following files:

• %User Temp%\haier.dll - non malicious
• %Current%\haier.dll - non malicious

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)

It drops the following copies of itself into the affected system:

• %Use Temp%\config.exe

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Microsoft = %User Temp%\config.exe

Propagation

This worm drops copies of itself in all removable drives.

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

The said .INF file contains the following strings:

autorun]
open={malware name}
UseAuTOPLAY=1
action=Open folder view files
icon=%SystemRoot%\system32\SHELL32.dll,4
shell\Explore\Command={malware name}

Backdoor Routine

This worm opens a random port to allow a remote user to connect to the affected system. Once a successful connection is established, the remote user executes commands on the affected system.

It executes the following command(s) from a remote malicious user:

• Download and execute updated copy of itself
• Download and execute other malicious file
• Enumerate and kill processes
• Launch DDos attack
• Uninstall itself
• Steal Mozilla user profile information

It connects to the following websites to send and receive information:

• {BLOCKED}mexicano.sinipfija.com