Win32/Wecykler

Installation

In the wild, Worm:Win32/Wecykler has been observed using any of the following file names:

• Autorun.inf .exe
• Commgr.exe
• DCIM .exe
• DrivesGuideInfo .exe
• Images .exe
• New Folder (2) .exe
• New Folder .exe
• RECYCLER .exe
• WinAlert.exe
• WinSysApp.exe

Note: The format of some of these file names is designed to hide the file extension, and entice you to click and run the worm.

The worm creates copies of itself in the following locations:

• %ProgramFiles% \Windows Alerter\<malware file>
• %ProgramFiles%\Windows Common Files\<malware file>

The folders where its copies are located are hidden.

It also creates a hidden copy of itself as:

C:\RECYCLER\X-1-5-21-1960408961-725345543-839522115-1003\WinSysApp.exe

Worm:Win32/Wecykler adds the following registry entries to ensure that its copy runs each time you start your PC:

In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Sets value: "WindowMessenger"
With data: "C:\RECYCLER\X-1-5-21-1960408961-725345543-839522115-1003\WinSysApp.exe"
   
In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Sets value: "Windows Alerter"
With data: "%ProgramFiles%\Windows Alerter\WinAlert.exe"
 
In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Sets value: "Windows Common Files Manager"
With data: "%ProgramFiles%\Windows Common Files\Commgr.exe"
 
In subkey: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Sets value: "WindowMessenger"
With data: "C:\RECYCLER\X-1-5-21-1960408961-725345543-839522115-1003\WinSysApp.exe"
   
In subkey: HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Sets value: "Windows Alerter"
With data: "%ProgramFiles%\Windows Alerter\WinAlert.exe"
 
In subkey: HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Sets value: "Windows Common Files Manager"
With data: "%ProgramFiles%\Windows Common Files\Commgr.exe"

To keep files related to the worm hidden, it makes sure files with Hidden and System file attributes are not displayed in Windows Explorer, by making the following changes to the registry:

In subkey: In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Sets value: "Hidden"
With data: "00000002"
Sets value: "HideFileExt"
With data: "00000001"
Sets value: "SuperHidden"
With data: "00000000"
Sets value: "ShowSuperHidden"
With data: "00000000"

Spreads via...

Removable drives

Win32/Wecykler periodically (every 3 seconds) checks for any available removable drives, for example, floppy drives, USB sticks, and flash card readers.

If one is found, it copies itself into this drive, using the same file name as an existing folder it finds. It then applies "hidden" and "system" attributes to the original file, so that only the worm copy will display.

The worm uses a folder icon for its copy in an attempt to trick you into thinking that it is merely a folder, so that you might click and run the worm.

Payload

Logs keystrokes

The worm also logs keystrokes and saves them in an encrypted file named info" for example:

C:\RECYCLER\X-1-5-21-1960408961-725345543-839522115-1003\info

Stops processes

Worm:Win32/Wecykler stops security-related and other processes, including:

Additional information

Worm:Win32/Wecykler also drops the following image file which contains adult content:

C:\RECYCLER\X-1-5-21-1960408961-725345543-839522115-1003\bnf0342

Analysis by Zarestel Ferrer