Malware Information

Malware name Worm.Zhelatin.zi Type Worm Affected platform Win32 Media-Type application/executable MD5 checksum 9C70BE59ECBDFB9F71FF5136FBCFE704 Static file no Filesize 90,624 Bytes Alias names (also known as) Sophos Mal/Dorf-O McAfee W32/Nuwar@MM CA ETrust Win32/Sintun.FK Side effects Drops files Propagation Email Local network

Description:

The following files are created:

– %WINDIR%\glok+serv.config This is a non malicious text file with the following content:
• [config]
[local]
[peers]
0000472DD17ECA4C2F0BB96FD7794A73=D9DA078C2AD400
01006023137DA429CD240A468A5CFB77=D3F6E118166700
0200AA5495413422502AAA57FB00CB2C=CA803A63585600
0300EA776E0AA0591202531C3F0D4F53=7647B0A8321700
04001B29A86C3570BF00D7351501460F=5C2E073C265300
0500A71EC719C622B27ADE6BE2416463=C879C5BC09A100
06001709255A3721431D0E69732E9551=3A4049CE049D00
0700F41EF75A8D012D7D1F0C894B2F55=7C6B254D23A300
0800BA60242320060233666E5C135067=3D11CBE4206900
09004D0B336B44757A3D475AB0355C6D=76449C14337400
0A0011554065B727F03B167C971C3136=599789651ABE00
0B0082735501391F296AFA369A3BA822=DEE1913F504B00
0C00387F7570B2105E017737C1283A7A=7B1600401B3300
0D00F67D3654AC6C35099F55A41C6E67=44979EC5589400


– %WINDIR%\glok+22bd-6274.sys Furthermore it gets executed after it was fully created. Detected as: Trojan.Rootkit.Gen


The following registry key is added in order to run the process after reboot:

– HKLM\System\ControlSet001\Services\glok+b89-6227
• %WINDIR%\glok+b89-6227.sys


Avoid addresses:
It does not send emails to addresses containing one of the following strings:
• postmaster@; root@; @avp.; panda; abuse; @messagelab; free-av; @foo;
ntivi; admin; kasp; noone@; info@; help@; f-secur; @microsoft; rating@


In order to ensure its propagation the malware attemps to connect to other machines as described below.


IP address generation:
It creates random IP addresses and tries to establish a connection with them.


It is a malware-specific technology. The malware hides its presence from system utilities, security applications and in the end, from the user.


Hides the following:
– Its own files
– Its own registry keys

– The following files:
• glok+22bd-6274.sys
• glok+serv.config

– The following registry keys:
• HKLM\System\ControlSet001\Services\glok+b89-6227
• HKLM\System\ControlSet001\Enum\Root\legacy_glok+b89-6227
• HKLM\System\ControlSet001\Enum\Root\LEGACY_GLOK+B89-6227\0000


Method used:
• Hidden from Interrupt Descriptor Table (IDT)

Hooks the following API functions:
• ZwEnumerateKey
• ZwEnumerateValueKey
• ZwQueryDirectoryFile


Runtime packer:
In order to aggravate detection and reduce size of the file it is packed with a runtime packer.