Virus:Worm/Palevo.AK
Date discovered:22/07/2010
Type:Worm
In the wild:Yes
Reported Infections:Low to medium
Distribution Potential:Medium
Damage Potential:Low to medium
Static file:Yes
File size:98.304 Bytes
MD5 checksum:7afed9b7558b8898274710be66c7ad9b
VDF version:7.10.04.43
IVDF version:7.10.09.161 - Thursday, July 22, 2010

 General Methods of propagation:
   • Autorun feature
   • Messenger
   • Peer to Peer


Aliases:
   •  Kaspersky: P2P-Worm.Win32.Palevo.bkyl
   •  F-Secure: Trojan.Generic.KDV.100371
   •  Bitdefender: Trojan.Generic.KDV.100371
   •  GData: Trojan.Generic.KDV.100371
   •  DrWeb: Trojan.Inject.18945


Platforms / OS:
   • Windows 2000
   • Windows XP
   • Windows 2003


Side effects:
   • Downloads malicious files
   • Drops malicious files
   • Registry modification
   • Steals information

 Files It copies itself to the following locations:
   • %drive%\RECYCLER\autorun.exe
   • %recycle bin%\%CLSID%\csisf.exe



It overwrites the following files.
– %recycle bin%\R-1-5-21-1482476501-1644491937-682003330-1013\vcleaner.exe
– %recycle bin%\R-1-5-21-1482476501-1644491937-682003330-1013\Desktop.ini



The following files are created:

– %recycle bin%\%CLSID%\Desktop.ini
– %drive%\RECYCLER\R-1-5-21-1482476501-1644491937-682003330-1013\Desktop.ini
– %drive%\autorun.inf This is a non malicious text file with the following content:
   • %code that runs malware%

– %WINDIR%\ghdrive32.exe Further investigation pointed out that this file is malware, too. Detected as: TR/Dldr.FirNix.AD

– %recycle bin%\%CLSID%\lsq.exe Further investigation pointed out that this file is malware, too. Detected as: Worm/Hamweq.DD.11

– %recycle bin%\%CLSID%\jwjqa.exe Further investigation pointed out that this file is malware, too. Detected as: Worm/Hamweq.DD.16

– %recycle bin%\%CLSID%\ju7bd.exe Further investigation pointed out that this file is malware, too. Detected as: Worm/Hamweq.DD.8

– %TEMPDIR%\285.exe Further investigation pointed out that this file is malware, too. Detected as: Worm/Hamweq.DD.10

– %TEMPDIR%\041.exe Further investigation pointed out that this file is malware, too. Detected as: TR/BadHubby.F

– %TEMPDIR%\052.exe Further investigation pointed out that this file is malware, too. Detected as: Worm/Hamweq.DD.11

– %TEMPDIR%\770.exe Further investigation pointed out that this file is malware, too. Detected as: Worm/Hamweq.DD.7

– %TEMPDIR%\906.exe Further investigation pointed out that this file is malware, too. Detected as: Worm/Hamweq.DD.8

– %TEMPDIR%\611.exe Further investigation pointed out that this file is malware, too. Detected as: Worm/Hamweq.DD.13

– %recycle bin%\%CLSID%\jwkd.exe Further investigation pointed out that this file is malware, too. Detected as: Worm/Hamweq.DD.12

– %recycle bin%\%CLSID%\jikd.exe Further investigation pointed out that this file is malware, too. Detected as: Worm/Hamweq.DD.15

– %TEMPDIR%\710.exe Further investigation pointed out that this file is malware, too. Detected as: Worm/Hamweq.DD.12

– %TEMPDIR%\370.exe Further investigation pointed out that this file is malware, too. Detected as: Worm/Hamweq.DD.15

– %recycle bin%\%CLSID%\dfe.exe Further investigation pointed out that this file is malware, too. Detected as: TR/BadHubby.F

– %TEMPDIR%\580.exe Further investigation pointed out that this file is malware, too. Detected as: Worm/Hamweq.DD.9

– %TEMPDIR%\716.exe Further investigation pointed out that this file is malware, too. Detected as: Worm/Hamweq.DD.16

– %temporary internet files%\serv8[1].exe Further investigation pointed out that this file is malware, too. Detected as: TR/BackDoor.27.1

– %temporary internet files%\new2[1].exe Further investigation pointed out that this file is malware, too. Detected as: Worm/Pushbot60154.A

– %HOME%\new1.exe Further investigation pointed out that this file is malware, too. Detected as: Worm/Pushbot60154.A

– %drive%\RECYCLER\R-1-5-21-1482476501-1644491937-682003330-1013\vcleaner.exe Further investigation pointed out that this file is malware, too. Detected as: Worm/Hamweq.A.68

– %recycle bin%\%CLSID%\psyjo3.exe Further investigation pointed out that this file is malware, too. Detected as: Worm/Hamweq.DD.10

– %temporary internet files%\mix[1].exe Further investigation pointed out that this file is malware, too. Detected as: Worm/Hamweq.DD.10

– %recycle bin%\%CLSID%\t7vd.exe Further investigation pointed out that this file is malware, too. Detected as: Worm/Hamweq.DD.9

– %HOME%\hdcd.exe Further investigation pointed out that this file is malware, too. Detected as: TR/Agent.40960

– %temporary internet files%\m[1].exe Further investigation pointed out that this file is malware, too. Detected as: Worm/Hamweq.A.68

– %TEMPDIR%\554.exe Further investigation pointed out that this file is malware, too. Detected as: TR/Dldr.FirNix.AD

– %temporary internet files%\dq[1].exe Further investigation pointed out that this file is malware, too. Detected as: TR/Agent.40960

– %recycle bin%\%CLSID%\system.exe Further investigation pointed out that this file is malware, too. Detected as: Worm/Hamweq.DD.7

– %HOME%\hddd.exe Further investigation pointed out that this file is malware, too. Detected as: TR/BackDoor.27.1

– C:\xdx.exe Further investigation pointed out that this file is malware, too. Detected as: Worm/Hamweq.A.68

– %recycle bin%\%CLSID%\syitm.exe Further investigation pointed out that this file is malware, too. Detected as: TR/Agent.40960

– %recycle bin%\%CLSID%\lsvb.exe Further investigation pointed out that this file is malware, too. Detected as: Worm/Hamweq.DD.13




It tries to download some files:

– The location is the following:
   • http://two.natnatraoi.com/**********


– The location is the following:
   • http://two.natnatraoi.com/**********


– The location is the following:
   • http://two.natnatraoi.com/**********


– The location is the following:
   • http://two.natnatraoi.com/**********


– The location is the following:
   • http://two.natnatraoi.com/**********


– The location is the following:
   • http://two.natnatraoi.com/**********


– The location is the following:
   • http://195.14.112.145/**********


– The location is the following:
   • http://two.natnatraoi.com/**********


– The location is the following:
   • http://two.natnatraoi.com/**********


– The location is the following:
   • http://195.14.112.145/**********


– The location is the following:
   • http://two.natnatraoi.com/**********


– The location is the following:
   • http://195.14.112.153/**********


– The location is the following:
   • http://two.natnatraoi.com/**********


– The location is the following:
   • http://two.natnatraoi.com/**********


– The location is the following:
   • http://two.natnatraoi.com/**********




It tries to execute the following files:

– Filename:
   • %TEMPDIR%\580.exe


– Filename:
   • %TEMPDIR%\041.exe


– Filename:
   • %WINDIR%\ghdrive32.exe


– Filename:
   • C:\xdx.exe


– Filename:
   • new1.exe


– Filename:
   • hdcd.exe


– Filename:
   • hddd.exe


– Filename:
   • %TEMPDIR%\052.exe


– Filename:
   • %TEMPDIR%\710.exe


– Filename:
   • %TEMPDIR%\906.exe


– Filename:
   • %TEMPDIR%\716.exe


– Filename:
   • %TEMPDIR%\611.exe


– Filename:
   • %TEMPDIR%\770.exe


– Filename:
   • %TEMPDIR%\554.exe


– Filename:
   • %TEMPDIR%\370.exe


– Filename:
   • %TEMPDIR%\285.exe

 Registry The following registry keys are added in order to run the processes after reboot:

– [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
   • "Taskman"="%recycle bin%\R-1-5-21-1482476501-1644491937-682003330-1013\vcleaner.exe"

– [HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
   • "Shell"="%recycle bin%\%CLSID%\syitm.exe,%recycle bin%\%CLSID%\dfe.exe,%recycle bin%\S-1-5-21-0243556031-888888379-781863308-1455\psyjo3.exe,%recycle bin%\S-1-5-21-0243556031-888888379-781863308-9143\jikd.exe,%recycle bin%\S-1-5-21-0243556031-888888379-781863308-1457\system.exe,%recycle bin%\S-1-5-21-0243556031-888888379-781863308-9043\jwkd.exe,%recycle bin%\S-1-5-21-0243556031-888888379-781863308-2734\ju7bd.exe,%recycle bin%\S-1-5-21-0243556031-888888379-781863308-1343\jwjqa.exe,%recycle bin%\S-1-5-21-0243556031-888888379-781863308-8333\lsvb.exe,%recycle bin%\S-1-5-21-0243556031-888888379-781863308-8763\lsq.exe,explorer.exe,%recycle bin%\S-1-5-21-0243556031-888888379-781863308-1214\t7vd.exe"

– [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   • "Fgfk"="%recycle bin%\%CLSID%\lsq.exe"
   • "Fnfx"="%recycle bin%\%CLSID%\dfe.exe"
   • "Fvbk"="%recycle bin%\%CLSID%\lsvb.exe"
   • "Teswf"="%recycle bin%\%CLSID%\system.exe"
   • "Tnaww"="%recycle bin%\%CLSID%\syitm.exe"
   • "jaqq"="%recycle bin%\%CLSID%\jwkd.exe"
   • "jkqq"="%recycle bin%\%CLSID%\jikd.exe"
   • "ju7bd"="%recycle bin%\%CLSID%\ju7bd.exe"
   • "psysjo3"="%recycle bin%\%CLSID%\psyjo3.exe"
   • "sdjwe"="%recycle bin%\%CLSID%\jwjqa.exe"
   • "t7vd"="%recycle bin%\%CLSID%\t7vd.exe"

– [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   • "Advanced HTTPL Enable"="%HOME%\hddd.exe"
   • "Microsoft Driver Setup"="%WINDIR%\ghdrive32.exe"

– [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\
   Run]
   • "Microsoft Driver Setup"="%WINDIR%\ghdrive32.exe"



It creates the following entry in order to bypass the Windows XP firewall:

– [HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\
   FirewallPolicy\StandardProfile]
   • "EnableFirewall"=dword:0x00000000

 P2P In order to infect other systems in the Peer to Peer network community the following action is performed:   It retrieves shared folders by querying the following registry keys:
   • Software\BearShare\General
   • Software\iMesh\General
   • Software\Shareaza\Shareaza\Downloads
   • Software\Kazaa\LocalContent
   • Software\DC++
   • Software\eMule
   • Software\Microsoft\Windows\CurrentVersion\Uninstall\eMule Plus_is1

   It searches for directories that contain the following substring:
   • \Local Settings\Application Data\Ares\My Shared Folder


 Messenger It is spreading via Messenger. The characteristics are described below:

– Windows Messenger

The URL then refers to a copy of the described malware. If the user downloads and executes this file the infection process will start again.

 Backdoor Contact server:
All of the following:
   • ff.fjp**********.com:1863 (UDP)
   • serv8.alw**********.info:18384 (UDP)


 Stealing It tries to steal the following information:
– Recorded passwords used by the AutoComplete function

– Passwords from the following programs:
   • Internet Explorer
   • Mozilla Firefox

 Injection – It injects itself as a remote thread into a process.

    Process name:
   • explorer.exe


 Miscellaneous Accesses internet resources:
   • http://www.nippon.to/cgi-bin/**********
   • http://www.cooleasy.com/cgi-bin/**********
   • http://obsoletegod.com/cgi-bin/**********
   • http://mobi-sys.ru/img/**********
   • http://www.mcreate.net/cgi-bin/envchk/**********


Mutex:
It creates the following Mutexes:
   • fwghw
   • psyjo
   • ihp013
   • fewhx
   • mdge
   • sewwwefwef
   • f7bd
   • fsmgr
   • omdgv
   • fedfw
   • jhg28gdhrg2fcs
   • dwcfewf
   • acddww
   • g37v

 File details Programming language:
 The malware program was written in MS Visual C++.


Runtime packer:
In order to aggravate detection and reduce size of the file it is packed with a runtime packer.

Description inserted by Petre Galan on Tuesday, June 14, 2011
Description updated by Petre Galan on Tuesday, June 14, 2011

Back . . . .
 
 
 
 

© 2013 Avira Operations GmbH & Co. KG. All rights reserved.

My Account

https:// This window is encrypted for your security.