Description:
Trend Micro has flagged this threat as noteworthy due to the increased potential for damage, propagation, or both, that it possesses.
To get a one-glance comprehensive view of the behavior of this malware, refer to the Threat Diagram shown below.
Malware Overview
This worm arrives via removable drives.
It drops files.
It adds key(s) as part of its installation routine.
It drops copies of itself in all removable drives.
It drops an .LNK file that references a copy of itself in removable drives.
It hides files, processes, and/or registry entries.
It drops component files.
It creates mutex(es) to ensure that only one instance of itself is running in memory.
This worm targets Siemens SCADA WinCC systems, which are used for machines and plant operations. On a target system, it attempts to send possibly malicious request to the system database with SQL commands. However, it requires to be in the targeted system to perform its intended routines.
|
Save & Share
