Virus:Worm/Sohanad.bm
Date discovered:19/11/2008
Type:Worm
In the wild:No
Reported Infections:Low to medium
Distribution Potential:Medium to high
Damage Potential:Low to medium
Static file:Yes
File size:501.017 Bytes
MD5 checksum:eb4215326d739ef7393270fb48f6dbcb
IVDF version:7.01.00.110 - Wednesday, November 19, 2008

 General Methods of propagation:
   • Local network
   • Messenger


Aliases:
   •  Kaspersky: IM-Worm.Win32.Sohanad.bm
   •  F-Secure: IM-Worm.Win32.Sohanad.bm
   •  Sophos: W32/SillyFDC-G
   •  Panda: W32/Hakaglan.A.worm
   •  Grisoft: I-Worm/Sohanad.J
   •  Eset: Win32/Hakaglan.AH
   •  Bitdefender: Trojan.AutoIt.TD


Platforms / OS:
   • Windows 95
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003


Side effects:
   • Downloads files
   • Drops a file
   • Lowers security settings
   • Registry modification

 Files It copies itself to the following locations:
   • %SYSDIR%\RVHOST.exe
   • %WINDIR%\RVHOST.exe



The following file is created:

– %WINDIR%\Tasks\At1.job File is a scheduled task that runs the malware at predefined times.



It tries to download a file:

– The location is the following:
   • http://nhatquanglan2.0catch.com/**********
It is saved on the local hard drive under: %SYSDIR%\setting.ini

 Registry The following registry keys are added in order to run the processes after reboot:

– [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   • Yahoo Messengger="%SYSDIR%\RVHOST.exe"

– [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
   • Shell="Explorer.exe RVHOST.exe"



The following registry keys are added:

– [HKLM\SYSTEM\ControlSet001\Services\Schedule]
   • AtTaskMaxHours=dword:00000000

– [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\
   WorkgroupCrawler\Shares]
   • shared="%all shared folders%\New Folder.exe"



The following registry keys are changed:

Various Explorer settings:
– [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
   Old value:
   • NofolderOptions=%user defined settings%
   New value:
   • NofolderOptions=dword:00000001

Disable Regedit and Task Manager:
– [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System]
   Old value:
   • DisableTaskMgr=%user defined settings%
   • DisableRegistryTools=%user defined settings%
   New value:
   • DisableTaskMgr=dword:00000001
   • DisableRegistryTools=dword:00000001

 Messenger It is spreading via Messenger. The characteristics are described below:

– Yahoo Messenger


To:
All entries in the contact list.


Message
The sent message looks like one of the following:

   • E may, vao day coi co con nho nay ngon lam http://nhattruongquang.**********.com

   • Vao day nghe bai nay di ban http://nhattruongquang.**********.com

   • Biet tin gi chua, vao day coi di http://nhattruongquang.**********.com

   • Trang Web nay coi cung hay, vao coi thu di http://nhattruongquang.**********.com

   • Toi di lang thang lan trong bong toi buot gia, ve dau khi da mat em roi? Ve dau khi bao nhieu mo mong gio da vo tan... Ve dau toi biet di ve dau? http://nhattruongquang.**********.com

   • Khoc cho nho thuong voi trong long, khoc cho noi sau nhe nhu khong. Bao nhieu yeu thuong nhung ngay qua da tan theo khoi may bay that xa... http://nhattruongquang.**********.com

   • Tha nguoi dung noi se yeu minh toi mai thoi thi gio day toi se vui hon. Gio nguoi lac loi buoc chan ve noi xa xoi, cay dang chi rieng minh toi... http://nhattruongquang.**********.com

   • Loi em noi cho tinh chung ta, nhu doan cuoi trong cuon phim buon. Nguoi da den nhu la giac mo roi ra di cho anh bat ngo... http://nhattruongquang.**********.com

   • Tra lai em niem vui khi duoc gan ben em, tra lai em loi yeu thuong em dem, tra lai em niem tin thang nam qua ta dap xay. Gio day chi la nhung ky niem buon...http://nhattruongquang.**********.com


The received message may look like the following:


 Network Infection In order to ensure its propagation the malware attemps to connect to other machines as described below.

It drops a copy of itself to the following network share:
   • %all shared folders%\New Folder.exe

Description inserted by Adriana Popa on Tuesday, February 10, 2009
Description updated by Adriana Popa on Wednesday, February 11, 2009

Back . . . .