Worm:VBS/Jenxcus.CB

Installation

When run, this VBScript worm creates a copy of itself in %TEMP%. The file name can vary; some of the file names we have seen include:

• 5588.vbs
• google.vbs
• mzab.vbs
• xxxxxxxx.vbs

It modifies the following registry entry so that it runs each time you start your PC:

In subkey: HKLM\software\microsoft\windows\currentversion\run
Sets value: "<malware file name>"
With data: "wscript.exe //B "<folder>\<malware file name>.vbs""

The worm also copies itself to <startup folder>.

It creates the registry key HKLM\software\<MalwareFilename> as an infection marker.

Spreads via...

Removable drives

This worm spreads via removable storage drives, such as USB flash drives.

It checks your PC for removable drives. If a removable drive is found the worm copies itself into that drive. It creates several link (.lnk) files that run the VBScript worm. The .lnk file names are created using file names already on the removable drive.

Payload

Worm:VBS/Jenxcus.CB can give a hacker access and control of your PC.

This worm contacts a remote server using a HTTP POST command. We have seen it connect to lemsi.dvr-<removed>.com.

It sends the following information about your PC to the server:

• Disk volume serial number
• PC name
• User name
• Operating system information, for example, the name and version
• Antimalware software details

Once the server receives information about your PC, it replies to the worm with instructions on what to do next. The commands can be any of the following:

• Run a command in the PC
• Download and run a file, including other malware
• Update the worm
• Remove the worm after an update or after other malware is run

Analysis by Patrick Estavillo