WORM_UTOTI.KDS

This worm may be dropped by other malware. It may be unknowingly downloaded by a user while visiting malicious websites. However, as of this writing, the said sites are inaccessible.

It drops copies of itself into all the removable drives connected to an affected system. It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

It opens a random port to allow a remote user to connect to the affected system. Once a successful connection is established, the remote user executes commands on the affected system. It connects to a website to send and receive information.

It gathers certain information on the affected computer. It steals system information.

On succeeding connections, it connects to a specific URL to check for new IP addresses.

Arrival Details

This worm may be dropped by other malware.

It may be unknowingly downloaded by a user while visiting malicious websites.

However, as of this writing, the said sites are inaccessible.

Installation

This worm drops the following copies of itself into the affected system:

• %System%\csrcs.exe

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
Explorer\Run
csrcs = "%System%\csrcs.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\RunServices
csrcs = "%System%\csrcs.exe"

It modifies the following registry entry(ies) to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
Shell = Explorer.exe csrcs.exe

(Note: The default value data of the said registry entry is Explorer.exe.)

It drops the following files:

• %System Root%\khx - non malicious
• %System%\autorun.i - copy of autorun.inf dropped in removable drives
• %System%\autorun.in - copy of autorun.inf dropped in removable drives

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.. %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

Other System Modifications

This worm also creates the following registry entry(ies) as part of its installation routine:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
DRM\amty
ilop = 1

It modifies the following registry entries to hide files with Hidden attributes:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
Hidden = 2

(Note: The default value data of the said registry entry is 1.)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
ShowSuperHidden = 0

(Note: The default value data of the said registry entry is 1.)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
SuperHidden = 0

(Note: The default value data of the said registry entry is 1.)

Propagation

This worm drops copies of itself into all the removable drives connected to an affected system.

It drops copies of itself in the following shared folders:

• FrostWire
• eMule
• Kazaa
• LimeWire
• Shareaza
• DC++
• Ares
• Adobe Photoshop CS4 Extended
• Nero 9 Reloaded 9.4.26.0
• Microsoft Office Enterprise 2007
• Microsoft Windows 7 Ultimate Retail(Final) x86 and x64
• WinRAR v3.90 Final
• WinRAR v4.0 Final
• WinRAR v5.0 Final
• LimeWire PRO v5.4.6.1 Final
• WinZip PRO v14.1
• WinZip PRO v15.1
• WinZip PRO v16.1
• Metro 2033 Proper
• Battlefield Bad Company 2
• Just Cause 2
• Assassins Creed 2
• Mass_Effect_2
• The Sims 3 Final
• BioShock_2
• TuneUp.Utilities.2010.v9.0.3100.22-TE
• Sony Vegas Pro 9.0c Build 896 [32.64 bit]
• Command & Conquer 4 Tiberian Twilight Retail
• Counter-Strike 1.6 v.38
• Batman.Arkham.Asylum
• Pro.Evolution.Soccer.2010
• Call of Duty 4 Modern Warfare
• Call of duty 5 World At War
• Fallout.3.Game.of.the.Year.Edition
• Diablo 2 + Diablo 2: Lord Of Destruction
• Grand Theft Auto Vice City
• Warhammer 40000 Dawn Of War II Chaos Rising
• Adobe Flash CS4 Professional
• Pinnacle Studio 14 HD Ultimate
• Autodesk AutoCAD 2010
• Partition Magic 8
• ConvertXtoDVD v4.x
• Mathworks.Matlab.R2010a
• Alcohol 120 v2.x
• Adobe Illustrator CS4
• DAEMON Tools Pro Advanced 4.x
• Rosetta.Stone.V.3.3.5.Plus
• Aliens Vs Predator Proper
• Dragon Age Origins
• Need.For.Speed.Shift

It uses the following file names for the copies it drops into shared networks:

• Crack
• Activator
• Keygen
• Validator
• Razor1911
• RELOADED
• KeyMaker

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

The said .INF file contains the following strings:

;{garbage}
[AutoRun]
;{garbage}
Shell\open\default=1
;{garbage}
OPEN={malware name}.exe
;{garbage}
Shell\open\command={malware name}.exe
;{garbage}

Backdoor Routine

This worm opens a random port to allow a remote user to connect to the affected system. Once a successful connection is established, the remote user executes commands on the affected system.

It connects to the following websites to send and receive information:

• {BLOCKED}se.{BLOCKED}six.com
• www.{BLOCKED}ad.com
• {BLOCKED}y.{BLOCKED}me.cx
• www.{BLOCKED}ad.com.cn

Information Theft

This worm gathers the following information on the affected computer:

• User name
• Computer name
• OS Version
• OS Service Pack
• Home Drive
• Drive Serial
• OS Language
• System Directory

It steals system information.

Other Details

Based on analysis of the codes, it has the following capabilities:

• It drops copies to shared folders used by P2P applications.
• The dropped copies in shared folders are compressed using .ZIP and .RAR compression.
• It connects to websites to get the IP and geographical location of the infected system.

On succeeding connections, it connects to the following URL to check for new IP addresses:

• www.{BLOCKED}myip.com/automation/n09230945.asp
• http://{BLOCKED}c.daiguo.com/?self