Worm:Win32/Vobfus.gen!S

Worm:Win32/Vobfus.gen!S is the generic detection for obfuscated Visual Basic (VB)-compiled malware that spread via removable drives and download additional malware from remote servers.

Installation

Upon execution, Worm:Win32/Vobfus.gen!S creates a mutex named "A" to make sure that only a single copy of its process is executing in the computer at any given time.

It then drops a copy of itself in the %USERPROFILE% folder using a random file name, for example:

%USERPROFILE%\zzhuul.exe

It then creates the following registry entry so that this copy is executed at each Windows start:

In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Sets value: "<random value>"
With data: "%USERPROFILE%\<malware file name> /<random parameter>"

For example:

In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Sets value: "zzhuul"
With data: "%USERPROFILE%\zzhuul.exe /n"

Spreads via...

Network and removable drives

Worm:Win32/Vobfus.gen!S copies itself to the root folder of all available network and removable drives with the file name "rcx<hexadecimal number>.tmp". It then renames this file to any of the following:

• subst.exe
• secret.exe
• sexy.exe
• porn.exe
• passwords.exe

It writes an Autorun configuration file named "autorun.inf" pointing to the worm copy. When the drive is accessed from a computer supporting the Autorun feature, the worm is launched automatically.

Payload

Modifies computer settings

Worm:Win32/Vobfus.gen!S modifies the following registry entries to prevent the user from changing how hidden files and folders are displayed in Windows Explorer:

In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Sets value: "ShowSuperHidden"
With data: "0"

Worm:Win32/Vobfus.gen!S also modifies the following registry entries to disable the affected computer's Automatic Updates feature:

In subkey: HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
Sets value: "NoAutoUpdate"
With data: "1"

Downloads arbitrary files

Worm:Win32/Vobfus.gen!S also tries to contact the following remote servers using a TCP port such as 8000 or 8003, in order to download additional malware:

• ns1.spanse<removed>er.org
• ns1.spanse<removed>er.net
• ns1.player<removed>.com
• ns1.player<removed>.net

These dropped and/or downloaded malware are commonly detected as members of the following families:

• Win32/Sirefef
• Win32/Hiloti
• Win32/Alureon
• Win32/Renos
• Win32/Virut
• Win32/Cycbot
• Win32/Fareit

Analysis by Edgardo Diaz