Worm:Win32/Ippedo

This family of worms uses the AutoIt scripting language to infect PCs by spreading through removable drives. It can also download and run files, and steal your personal information.

Installation

We have seen this threat install the following files to either C:\Google or C:\Skypee:

• AutoIt3.exe - AutoIt executable, a clean file
• Google.lnk - malicious shortcut file that runs "Skypee/googleupdate.a3x"
• googleupdate.a3x - the main AutoIt script, malicious
• GoogleUpdate.lnk - malicious  shortcut file that runs "C:\Google\googleupdate.a3x"
• Skypee.lnk - malicious shortcut file that runs "Skypee/googleupdate.a3x"
• Windowsupdate.lnk - malicious shortcut file that runs "C:\Google\googleupdate.a3x"

These files are detected as either Worm:AutoIt/Ippedo or Worm:Win32/Ippedo!lnk.

It might also add shortcut files (.LNK) to other folders and removable drives in the infected PC that run the Autoit script using Autoit3.exe.

For example, if you have folder C:\Temp, it might add C:\Temp\Temp.lnk.

It changes the following registry entry so that it runs each time you start your PC:

In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Sets value: Windows Update
With data: C:\Google\Windowsupdate.lnk

In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Sets value: AdopeUpdate
With data: C:\Google\GoogleUpdate.lnk

In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Sets value: AdopeFlash
With data:

In subkey: HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Sets value: Windows Update
With data: "C:\Google\Windowsupdate.lnk"

In subkey: HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Sets value: JavaUpdate
With data: "C:\Google\GoogleUpdate.lnk"

In subkey: HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Sets value: NewJavaInstall
With data:

It tries to connect to yahoo.com to check if your PC is connected to the internet.

The threat also checks the location of your PC by contacting the following site:

• geoplugin.net/json.gp

Payload

Steals your sensitive information

This threat can collect the following information from your PC and send it to a malicious hacker:

• Programs you are running
• PC name
• User name
• Installed antivirus information
• PC location or country

We have seen it send the stolen information to the following domain:

• superyou.<removed>.org

Analysis by Rex Plantado