Worm:JS/Bondat

Installation

The threat copies itself as <random>.js to %USERPROFILE%\<random folder>. The name of the file and the folder is generated from your PC's name, for example %USERPROFILE%\badce\tvuwyx.js. 

The worm edits the permissions of the folder and file so that members of the "Users" group have full access.

It creates five copies of the legitimate Windows file wscript.exe in the folder, using a combination of the following names:

• First part:
• amd
• cmd
• disk
• dll
• dsk
• hp
• intel
• ms
• udp
• tcp
• win
   
• Second part:
• host
• mgr
• mon
• monitor
• proc
• process
• sys
• update
• updater
   
• Third part:
• 32
• 64

The following are some examples:

• dllupdate64.exe
• disksys.exe
• dllmgr.exe 
• winprocess32.exe

It drops a shortcut file called Windows Explorer.lnk in the <startup folder>. The shortcut link runs the copied malware file by running the following:

• "%USERPROFILE%\<random folder>\<renamed copy of wscript.exe>" "%USERPROFILE%\<random folder>\<random>.js"

For example, the shortcut link might point to the following:

• "%USERPROFILE%\badce\dllupdate64.exe" "%USERPROFILE%\badce\tvuwyx.js"

The shortcut file uses an icon to make it look like a folder: 

It does all this to try to trick you into double clicking on the file, thinking it is a link or folder, which runs the malware the malware instead.

The worm also deletes all files with the following extensions in the folder where it dropped the Windows Explorer.lnk file:

• .js
• .jse
• .vbe
• .vbs

To prevent hidden files from being seen in Windows Explorer (in particular, the files and folders it has created and moved), it also sets the following registry entries:

In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Sets value: "Hidden"
With data: "REG_DWORD:0x2"

In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Sets value: "ShowSuperHidden"
With data: "REG_DWORD:0x0"

Spreads by...

The worm creates the following hidden folder on any USB or removable drive attached to your PC:

• <drive>:\.Trashes

It will also create a copy of the worm in <drive>:\.Trashes\<numbers>\<random string>.js, for example E:\.Trashes\586\tvuwyx.js. This copy runs if you open any of the shortcut files that are created by the worm.

It moves all the folders found on the removable drive into those hidden folders it created. It then creates a shortcut file that uses the same name as the original folder, and an icon to make it look like a folder.

If you click the shortcut file, thinking it is a folder, you will run the worm. The shortcut file also opens the folder that was copied to the .Trashes folder, to make it look like you opened a normal folder.

The icons can be any of the following:

The worm also searches for files with the following extensions, and moves each file to the .Trashes folder it created.

• Applications:
• .exe
   
• Documents:
• .doc
• .docx
• .pdf
   
• Text files:
• .rtf
• .txt
   
• Audio files:
• .m4a
• .mp3
• .mp4
• .ogg
• .wav
• .wma
   
• Video files:
• .avi
• .webm
• .flv
• .mov
• .wmv
• .mpeg
• .mpg
   
• Picture files:
• .gif
• .jpeg
• .jpg
• .png

The files are replaced with shortcut files (.lnk), and their icons might diplay like the following, depending on the file extension:

Payload 

Steals information about your PC

The worm collects information about your PC, including:

• Malware version
• User name
• Computer name
• Product ID
• Infection GUID
• Language/localization (for example, "0409" for "en-us")
• Operating system version (for example, "5.1.2600.0")

This information is encoded using the RC4 algorithm, plus another custom encoder, and sent to a remote server through HTTP POST. The server's URL is hardcoded in the malware body.

We have seen the worm try to send information to the following URLs:

• 109.95.211.244
• 148.251.192.195
• 217.23.3.136
• 91.200.85.69
• 91.200.85.79
• cdn.httpowered.com
• conectar.gma-telecom.com
• jtvcdn.com
• mail.futbolglobo.net
• static.myquickweb.net
• www.webhebio.com
• www2.httpoptions.com
• www2.mshttpconnect.com
• ytvidstream.com

Closes antivirus and security software

The malware searches for the following processes using Windows management instrumentation (WMI) queries:

If any of the process are running, the worm closes the application. In addition, it shows a message box similar to the following if the path (folder) of the process does not contain "Windows" or "Program".

The numbers shown in the example above are randomly generated.

Additional information

The worm checks if it is running inside a sandbox or virtual machine. If it detects that it is running inside a sandbox, it will immediately stop itself from running. 

Analysis by Allan Sepillo