Worm.VBS.ARROBON.A

This Worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Worm drops the following files:

• {Removable Drive}\click para ver tus archivos (no borrar).lnk

It drops the following copies of itself into the affected system:

• %User Startup%\system.vbe

(Note: %User Startup% is the current user's Startup folder, which is usually C:\Windows\Profiles\{user name}\Start Menu\Programs\Startup on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu\Programs\Startup on Windows NT, C:\Documents and Settings\{User name}\Start Menu\Programs\Startup on Windows 2003(32-bit), XP and 2000(32-bit), or C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit), 10(64-bit).)

It adds the following processes:

• explorer.exe /e, {Removable Drive Letter}\f{Random Characters}
• %User Startup%\system.vbe restart

(Note: %User Startup% is the current user's Startup folder, which is usually C:\Windows\Profiles\{user name}\Start Menu\Programs\Startup on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu\Programs\Startup on Windows NT, C:\Documents and Settings\{User name}\Start Menu\Programs\Startup on Windows 2003(32-bit), XP and 2000(32-bit), or C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit), 10(64-bit).)

It modifies folder attributes to make folders hidden.

Autostart Technique

This Worm drops the following file(s) in the Startup Items folder to enable its automatic execution at every system startup:

• %User Startup%\system.vbe

(Note: %User Startup% is the current user's Startup folder, which is usually C:\Windows\Profiles\{user name}\Start Menu\Programs\Startup on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu\Programs\Startup on Windows NT, C:\Documents and Settings\{User name}\Start Menu\Programs\Startup on Windows 2003(32-bit), XP and 2000(32-bit), or C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit), 10(64-bit).)

Other System Modifications

This Worm deletes the following folders:

• Deletes all folders in the removable drive aside from the created folder of the malware

Propagation

This Worm creates the following folders in all removable drives:

• {Rermovable Drive Letter}\f{Random Characters}
• {Rermovable Drive Letter}\f{Random Characters}\temp

It drops the following copy(ies) of itself in all removable drives:

• {Removable Drive}\f{Random characters}\temp\system.vbe

Download Routine

This Worm connects to the following website(s) to download and execute a malicious file:

• https://{BLOCKED}71

Information Theft

This Worm gathers the following data:

• Disk Drive information and Logical Drive Volumes present in the system

Other Details

This Worm does the following:

• Accepts the following arguments:
  • format {Malware Filename}.vbs {Argument 1} {Argument 2}
  • No argument → will execute the following:
  • chrome.exe -url https://{BLOCKED}71 --headless --remote-debugging-port=9222 --user-data-dir="%User Temp%\session" --disable-web-security --reduce-security-for-testing --allow-running-insecure-content
  • {Argument 1}
  • click → Will execute "explorer.exe /e, {Argument 2}" then drops a copy to %User Startup%\system.vbe
  • restart → Will proceed to the propagation routine
  • {Argument 2} → {Removable Drive}\f{Random Characters}
• Will not drop a copy of itself in the removable drives given by the following conditions:
  • Presence of click para ver tus archivos (no borrar).lnk in the removable drive
  • If the used space in the removable drive is greater than the Free Space
• Move and Copies all files and folder found in the removable drive to the following folders:
  • {Removable Drive}\f{random characters}