Worm:VBS/Jenxcus.BC

Installation

When run, this VBScript worm creates a copy of itself in %TEMP%. The file name can vary; some of the file names we have seen include:

• 5588.vbs
• google.vbs
• mzab.vbs
• xxxxxxxx.vbs

It modifies the following registry entry so that it runs each time you start your PC:

In subkey: HKLM\software\microsoft\windows\currentversion\run
Sets value: "<malware file name>"
With data: "wscript.exe //B "<folder>\<malware file name>.vbs""

The worm also copies itself to the <startup folder>.

It creates the registry key HKLM\software\<MalwareFilename> as an infection marker.

Spreads via...

Removable drives

This worm spreads via removable storage drives, such as USB flash drives.

It checks your PC for removable drives. If a removable drive is found the worm copies itself into that drive. It creates several link (.lnk) files that run the VBScript worm. The .lnk file names are created using file names already on the removable drive.

Payload

Give hacker access to your PC

This worm can give a hacker access and control of your PC.

This worm contacts a remote server using a HTTP POST command. We have seen it connect to http://servecounterstrike.servecounterstrike.com on port 99.

The remote server sends instructions to the worm, and can tell it to do the following:

• Run a command on the PC
• Download and run a file, including other malware
• Update the worm
• Remove the worm after an update or after other malware is run
• Send a local file for upload
• Get a list of installed drivers, folders, sub-folders, and running processes
• End certain processes

Analysis by Vincent Tiu