Virus:TR/Hamweq.A
Date discovered:15/10/2009
Type:Trojan
In the wild:Yes
Reported Infections:Low
Distribution Potential:Low
Damage Potential:Low
Static file:Yes
File size:65.536 Bytes
MD5 checksum:0a55c1a79534b88592487c92c54f5b69
IVDF version:7.01.06.111 - Thursday, October 15, 2009

 General Aliases:
   •  Sophos: Mal/Delf-Z
   •  Panda: W32/IRCBot.CKA.worm
   •  Eset: Win32/IRCBot.ANC
   •  Bitdefender: Backdoor.Bot.91975


Platforms / OS:
   • Windows 2000
   • Windows XP
   • Windows 2003


Side effects:
   • Drops malicious files
   • Registry modification




   Continuously creates a child process of itself and exits the parent process, within an interval of 1 sec, making difficult to locate and terminate from task manager.

 Files It copies itself to the following location:
   • %SYSDIR%\svhost.exe

 Registry The following registry key is added in order to run the process after reboot:

– [HKLM\SYSTEM\CurrentControlSet\Services\MSNETDED]
   • "Description"=" intrusion detection."
   • "DisplayName"="Network Monitor service"
   • "ErrorControl"=dword:0x00000000
   • "FailureActions"=hex:0A,00,00,00,00,00,00,00,00,00,00,00,01,00,00,00,00,00,00,00,01,00,00,00,B8,0B,00,00
   • "ImagePath"=""%SYSDIR%\svhost.exe""
   • "ObjectName"="LocalSystem"
   • "Start"=dword:0x00000002
   • "Type"=dword:0x00000110



The following registry keys are added:

– [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MSNETDED]
   • "@"="Service"

– [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSNETDED]
   • "@"="Service"

 File details Programming language:
 The malware program was written in Delphi.

Description inserted by Petre Galan on Monday, November 23, 2009
Description updated by Petre Galan on Monday, November 23, 2009

Back . . . .