Win32/Copali

Installation

Worms in this malware family create a new folder on the root drive of an infected PC and copy themselves as csrss.exe. They also create desktop.ini in the same folder. We have seen variants using the following folder names:

• '
• 000
• z

They can create one of the following registry entries so they runs each time you start your PC:

In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Sets value: "MySQL Connector"
With data: "<malware location>"

Sets value: "Microsoft Office Word"
With data: "<malware location>"

Sets value: "Google Updater"
With data: "<malware location>"

Sets value: "Microsoft Office Outlook"
With data: "<malware location>"

They can also modify the following registry entries as part of the malware payload:

In subkey: HKLM\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\ShowAll
Sets value: "CheckedValue"
With data: "0"

In subkey: HKCU\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Explorer\Advanced
Sets value: "Hidden"
With data: "2"

Spreads through...

Copali worms create a new folder on connected network and removable drives, such as USB flash drives. We have seen it use the same folder name as listed in the installation section.

They then copies themselves into the new folder as csrss.exe.

They also create the file desktop.ini in the same location.

The worms search for documents with the following extensions and create a copy of themselves using the same file name, with an appended .exe extension.    

• doc
• docx
• rtf

Payload

Downloads and runs malware

We have seen worms in the Copali family download and run the following threats:

• PWS:Win32/Zbot

We have seen this family connect to the following sites to download malicious files:

• aibuma.org/<removed>
• daisycurators.co.ke/<removed>
• frfv-org.co.cc/<removed>
• isecutrix.co.cc/<removed>
• lifetips.co.ke/<removed>
• onlinecampuskenya.com/<removed>

The downloaded file is can be saved to one of the following folders :

• '
• 000
• %TEMP%
• z

It can use of the following file names:

• Firefox.exe
• HPConnector.exe
• MySQLConnector.exe
• PostgreSQL.exe
• Word.exe

Stops processes

Copali variants can stop the following processes from running:

• avguard.exe
• avp.exe
• afwserv.exe

Additional information

When the malware runs it also tries to open a document with the same name as the worm copy. For example, if the worm is saved as test.exe, it will open a Microsoft Word document with the file name test.doc, test.docx and test.rtf. It does this to hide its payload. 

Analysis by Diana Lopera