Worm:Win32/RJump.I is a minor variant of the Win32/RJump family.
Worm:Win32/RJump is a worm that attempts to spread by copying itself to newly attached media (such as USB storage devices or network drives). It also contains backdoor functionality that allows an attacker unauthorized access to an affected machine.
Installation
When executed, Worm:Win32/RJump copies itself to the %windir% directory with a file name that may vary according to minor variant. Microsoft has observed Worm:Win32/RJump using the following file names in the wild:
RavMon.exe
RavMonE.exe
AdobeR.exe
bittorrent.exe
Note: %windir% refers to a variable location that is determined by the malware by querying the Operating System. The default installation location for the Windows directory for Windows 2000 and NT is C:\Winnt; and for XP and Vista is C:\Windows.
The worm also modifies the registry to execute this copy at each Windows start (for example):
Values: "RavAV" or "Bittorrent"
With data: "<path to worm executable>"
To subkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
The worm may also modify the following registry keys in order to set Internet Explorer as the default browser on the affected machine:
HKEY_CLASSES_ROOT\HTTP\shell\(Default) = "open"
HKEY_CLASSES_ROOT\HTTP\shell\open\command\(Default) = ""C:\Program Files\Internet Explorer\iexplore.exe" -nohome"
HKEY_CLASSES_ROOT\htmlfile\shell\(Default) = "opennew"
HKEY_CLASSES_ROOT\htmlfile\shell\open\command\(Default) = ""C:\Program Files\Internet Explorer\iexplore.exe" -nohome"
HKEY_CLASSES_ROOT\InternetShortcut\shell\open\command\(Default) = "rundll32.exe shdocvw.dll,OpenURL %l"
Spreads Via…
Network Shares & Removable Media
In order to spread, the worm copies itself (using one of the aforementioned file names) to any newly attached media, such as USB storage devices or network drives. In order to execute this new copy, it also creates an INF file that contains the following text:
[AutoRun]
open = <file name> e
shellexecute = <file name> e
shell\Auto\command = <file name> e
shell = Auto
For example:
[AutoRun]
open = RavMon.exe e
shellexecute = RavMon.exe e
shell\Auto\command = RavMon.exe e
shell = Auto
Payload
Backdoor Functionality / SOCKS Proxy
The worm connects to one of several websites and sends an identifier for the local infected machine (the local machine's computer name) and the port number being used for the establishment of a SOCKS proxy. The SOCKS proxy port number is stored in a file named 'RavMonLog', which is created in either the same location as the worm's executable, or in the user's %UserProfile% directory. (A typical location for this folder is C:\Documents and Settings\<username>.)
Some variants may also manipulate or remove browser cookies.
Analysis by Neno Lakinski & Josh Phillips
