Hello,
A complete newbie here, with a little problem.
I'm looking for info and advice about a piece of Win malware (perhaps), involving the names "kukuriba", "marica", and "Loesrmx".
Here are the details.
A few days ago, a colleague attended a conference in Asia. He used a FAT32-formatted USB thumb drive to copy a presentation from his Win XP laptop to one of the public PCs at the site. (He did not connect the thumb drive to his PC afterwards.)
Today, he gave me (Mac OS X) the thumb drive and asked me to copy some files to it. Immediately I noticed at the root level of the drive a folder named "kukuriba", which could not have had anything to do with the conference or his presentation; the folder contained only the file "marica.exe", approx 96k. My colleague confirmed he hadn't copied it and didn't know anything about it. The modification date was 2011/04/26 for "marica.exe"; for the "kukuriba" directory and the "autorun.inf" file (see below), they coincided with the time when he attached his thumb drive to the public PC.
First, I used ClamXav (Mac OS X GUI for ClamAV; v2.2.2 (252), engine v0.97.2) to scan the USB drive, but it gave it a clean bill of health.
Then I googled it, but found few solid hits. The most reliable appeared to be this one
<http://www.virustotal.com/file-scan/report.html?id=27ce421fa2c0069f44a7e63073a4494f90a358a58018e4ce468aeac8d23d1687-1310399637>
which indicated I was dealing with some kind of malware, identified by some, missed by many others, (including Clam), but without any indication of what it was supposed to do.
Next, I looked for an "autorun.inf" file, and, surely enough, one had been created and modified immediately after the "kukuriba" directory:
=====
[autorun]
USEAUTOPLAY=1
shellexcute=kukuriba/marica.exe
Shellwips
shell\\Explore\\command=kukuriba/marica.exe
shell\Open\\command=kukuriba/marica.exe
icon=kukuriba/marica.exe
open=kukuriba/marica.exe
action=Open folder to view files using Windows Explorer
=====
Finally, I used a hex editor to look at the "marica.exe" file, and extracted
Copyright (c) Loesrmx Software 1995-2011
Original Filename Loesrmx.exe
File Version 881
Knowing little about malware and little more about Win, I'm left in a quandary.
On one hand, this item behaves like malware -- it was copied to the thumb drive and an autorun.inf file created without user notice or permission.
OTOH, for malware, it doesn't seem to try very hard to hide itself. As for the autorun.inf file, does Win interpret correctly paths with a slash (/) instead of a backslash (\)? And wouldn't Win XP or later launch Autoplay instead of executing "marica.exe" or opening the "kukuriba" directory?
So what is this, and what should I do?
Should I submit it to the ClamAV database? (And if so, just "marica.exe", or both it and the autorun.inf file?) Warn other conference participants about it?
Or could it be an obnoxious, but not malevolent, piece of software installed by whatever was running legitimately on the public PC, perhaps same advertising engine?
Thanks for your patience.
_______________________________________________
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-win32
A complete newbie here, with a little problem.
I'm looking for info and advice about a piece of Win malware (perhaps), involving the names "kukuriba", "marica", and "Loesrmx".
Here are the details.
A few days ago, a colleague attended a conference in Asia. He used a FAT32-formatted USB thumb drive to copy a presentation from his Win XP laptop to one of the public PCs at the site. (He did not connect the thumb drive to his PC afterwards.)
Today, he gave me (Mac OS X) the thumb drive and asked me to copy some files to it. Immediately I noticed at the root level of the drive a folder named "kukuriba", which could not have had anything to do with the conference or his presentation; the folder contained only the file "marica.exe", approx 96k. My colleague confirmed he hadn't copied it and didn't know anything about it. The modification date was 2011/04/26 for "marica.exe"; for the "kukuriba" directory and the "autorun.inf" file (see below), they coincided with the time when he attached his thumb drive to the public PC.
First, I used ClamXav (Mac OS X GUI for ClamAV; v2.2.2 (252), engine v0.97.2) to scan the USB drive, but it gave it a clean bill of health.
Then I googled it, but found few solid hits. The most reliable appeared to be this one
<http://www.virustotal.com/file-scan/report.html?id=27ce421fa2c0069f44a7e63073a4494f90a358a58018e4ce468aeac8d23d1687-1310399637>
which indicated I was dealing with some kind of malware, identified by some, missed by many others, (including Clam), but without any indication of what it was supposed to do.
Next, I looked for an "autorun.inf" file, and, surely enough, one had been created and modified immediately after the "kukuriba" directory:
=====
[autorun]
USEAUTOPLAY=1
shellexcute=kukuriba/marica.exe
Shellwips
shell\\Explore\\command=kukuriba/marica.exe
shell\Open\\command=kukuriba/marica.exe
icon=kukuriba/marica.exe
open=kukuriba/marica.exe
action=Open folder to view files using Windows Explorer
=====
Finally, I used a hex editor to look at the "marica.exe" file, and extracted
Copyright (c) Loesrmx Software 1995-2011
Original Filename Loesrmx.exe
File Version 881
Knowing little about malware and little more about Win, I'm left in a quandary.
On one hand, this item behaves like malware -- it was copied to the thumb drive and an autorun.inf file created without user notice or permission.
OTOH, for malware, it doesn't seem to try very hard to hide itself. As for the autorun.inf file, does Win interpret correctly paths with a slash (/) instead of a backslash (\)? And wouldn't Win XP or later launch Autoplay instead of executing "marica.exe" or opening the "kukuriba" directory?
So what is this, and what should I do?
Should I submit it to the ClamAV database? (And if so, just "marica.exe", or both it and the autorun.inf file?) Warn other conference participants about it?
Or could it be an obnoxious, but not malevolent, piece of software installed by whatever was running legitimately on the public PC, perhaps same advertising engine?
Thanks for your patience.
_______________________________________________
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-win32