Worm:Win32/Gamarue.B

Worm:Win32/Gamarue.B is malware that may spread to removable drives and also communicates with a remote server to report its infection and download arbitrary files.

Installation

Worm:Win32/Gamarue.B may be encountered as an attachment to a spam email message with a subject line that references a fictitious canceled ACH payment. When run, the malware copies itself as the following:

• %TEMP%\<8 hexadecimal characters>.com

The registry is modified to run the dropped copy at each Windows start.

In subkey: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
Sets value: "2600"
With data: "%TEMP%\<8 hexadecimal characters>.com"

Worm:Win32/Gamarue.B also injects code into a newly created process "svchost.exe".

Spreads via...

Removable drives
Depending on the malware configuration, Worm:Win32/Gamarue.B may copy itself to removable drives as a file named "diskrun.exe". The malware then writes an autorun configuration file named 'autorun.inf' pointing to one of the files listed above. When the removable or networked drive is accessed from another computer supporting the Autorun feature, the malware is launched automatically.

Payload

Communicates with a remote server
Worm:Win32/Gamarue.B tries to connect to the following remove servers to report its infection and to download additional arbitrary files:

• randomcrappy.com
• karabasdobryak.eu
• loshatemikontara551.ru
• serioslyfucked.ru

At the time of this writing, the servers and requested files were unavailable for further analysis.

Analysis by Shawn Wang