Home / malware

PDF

Worm:Win32/Yeltminky.A

First posted on 08 March 2012.
Source: Microsoft

Aliases :

Worm:Win32/Yeltminky.A is also known as Worm:Win32/Autorun.DM (other), Mal_Otorun9 (Trend Micro), Trojan.Win32.Buzus.csuq (Kaspersky).

Explanation :

Worm:Win32/Yeltminky.A is a worm - a self-propagating program that can spread itself from one computer to another. Worms may spread themselves via a variety of different channels in order to compromise new computers. Worms usually spread using methods that include, but may not be limited to, copying themselves to removable or network drives, and placing an autorun.inf file in the root directory of each affected drive in an attempt to ensure that the worm is run when the removable drive is attached, or the network drive is visited from a remote system supporting the Autorun feature.
Top

Worm:Win32/Yeltminky.A is a worm - a self-propagating program that can spread itself from one computer to another. Worms may spread themselves via a variety of different channels in order to compromise new computers. Worms usually spread using methods that include, but may not be limited to, copying themselves to removable or network drives, and placing an autorun.inf file in the root directory of each affected drive in an attempt to ensure that the worm is run when the removable drive is attached, or the network drive is visited from a remote system supporting the Autorun feature. Installation When executed, Worm:Win32/Yeltminky.A copies itself to %ProgramFiles%\Common Files\sysm.exe. The malware modifies the following registry entries to ensure that its copy executes at each Windows start:

In subkey: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
Sets value: "Sysm"
With data: "c:\program files\common files\sysm.exe" The malware creates files on an affected computer using variable file names, for example:

• c:\documents and settings\administrator\gnaqc.drv - detected as Worm:Win32/Yeltminky.A!dll
• c:\documents and settings\administrator\gpqsb - detected as Trojan:Win32/KillProc.I
• c:\documents and settings\administrator\jtdbt.drv - detected as Worm:Win32/Yeltminky.A!dll
• c:\documents and settings\administrator\oiogq - detected as Trojan:Win32/KillProc.I

Spreads via€¦ Removable and network drives Worm:Win32/Yeltminky.A may copy itself to network and/or removable drives. It may also place an autorun.inf file in the root directory of the targeted drive. Such autorun.inf files contain execution instructions for the operating system, so that when the network and/or removable drive is accessed from another computer supporting the Autorun feature, the malware is launched automatically. This is particularly common malware behavior, generally utilized in order to spread malware from computer to computer. It should also be noted that autorun.inf files on their own are not necessarily a sign of infection, as they are used by legitimate programs and installation CDs.

Note: this worm was not observed to write an executable or create an autorun.inf file on a targeted drive in our automated testing environment. This may be because it does not begin spreading immediately, or because it may need to be commanded to spread from a remote source. Payload Modifies browser settings Worm:Win32/Yeltminky.A changes the start page for Internet Explorer by making the following registry modification:

In subkey: HKCU\Software\Microsoft\Internet Explorer\Main
Sets value: "Start Page"
To data: "http://www.xinfeng.net" Contacts remote host The malware may contact a remote host at dns.winsdown.com.cn using port 80. Commonly, malware may contact a remote host for the following purposes:

• To report a new infection to its author
• To receive configuration or other data
• To download and execute arbitrary files (including updates or additional malware)
• To receive instruction from a remote attacker
• To upload data taken from the affected computer

This malware description was produced and published using our automated analysis system's examination of file SHA1 7ff4fb53f7955f91fadf27ab6d2557df693465ec.

Last update 08 March 2012

 

TOP