Virus:WORM/Koobface.J
Date discovered:21/10/2010
Type:Worm
In the wild:Yes
Reported Infections:Low
Distribution Potential:Low
Damage Potential:Low to medium
Static file:Yes
File size:331.776 Bytes
MD5 checksum:77be30318b2cdcb8c9708ba1ef04f5c0
VDF version:7.10.05.230
IVDF version:7.10.13.15 - Thursday, October 21, 2010

 General Method of propagation:
   • No own spreading routine


Aliases:
   •  Kaspersky: Net-Worm.Win32.Koobface.hdz
   •  F-Secure: Net-Worm.Win32.Koobface.hdz
   •  Microsoft: Trojan:Win32/Koobface
   •  Eset: Win32/Koobface.NDI


Platforms / OS:
   • Windows 2000
   • Windows XP
   • Windows Vista
   • Windows 7


Side effects:
   • Disable security applications
   • Downloads a malicious file
   • Registry modification

 Files It copies itself to the following location:
   • %WINDIR%\andy138.exe



The following files are created:

– Non malicious files:
   • %WINDIR%\fdgg34353edfgdfdf
   • %WINDIR%\bk23567.dat

– C:\3.reg Detected as: TR/REG.Koobface.89

 Registry The following registry key is added in order to run the process after reboot:

– [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   • "xuri49tkd"="%WINDIR%\andy138.exe"



The values of the following registry key are removed:

–  [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   • "syspptray"=-
   • "sysfbtray"=-



The following registry keys are added:

– [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender]
   • "DisableAntiSpyware"=dword:00000001

– [HKCR\Mime\Database\Content Type\application/xhtml+xml]
   • "CLSID"="{25336920-03F9-11cf-8FD0-00AA00686F13}"
   • "Extension"=".xml"
   • "Encoding"=hex:08,00,00,00

 Backdoor Contact server:
All of the following:
   • 195.28.**********?action=fbgen&v=136&crc=669
   • 76.12.**********?action=fbgen&v=136&crc=669
   • 782cockta**********?action=fbgen&v=136&crc=669
   • 99**********?action=fbgen&v=136&crc=669
   • alimt**********?action=fbgen&v=136&crc=669
   • bigcoun**********?action=fbgen&v=136&crc=669
   • bizz**********?action=fbgen&v=136&crc=669
   • bmt**********?action=fbgen&v=136&crc=669
   • boxer**********?action=fbgen&v=136&crc=669
   • braitm**********?action=fbgen&v=136&crc=669
   • cedele**********?action=fbgen&v=136&crc=669
   • cfscons**********?action=fbgen&v=136&crc=669
   • christm**********?action=fbgen&v=136&crc=669
   • clarksh**********?action=fbgen&v=136&crc=669
   • counter.xtsd20**********?action=fbgen&v=136&crc=669
   • dancin**********?action=fbgen&v=136&crc=669
   • dip-a-d**********?action=fbgen&v=136&crc=669
   • djmu**********?action=fbgen&v=136&crc=669
   • draco-il**********?action=fbgen&v=136&crc=669
   • dreamch**********?action=fbgen&v=136&crc=669
   • ebesu**********?action=fbgen&v=136&crc=669
   • elect**********?action=fbgen&v=136&crc=669
   • emse**********?action=fbgen&v=136&crc=669
   • entertainme**********?action=fbgen&v=136&crc=669
   • eurobaustoff.marke**********?action=fbgen&v=136&crc=669
   • foods**********?action=fbgen&v=136&crc=669
   • frankne**********?action=fbgen&v=136&crc=669
   • godsho**********?action=fbgen&v=136&crc=669
   • gross**********?action=fbgen&v=136&crc=669
   • grupoc**********?action=fbgen&v=136&crc=669
   • hills**********?action=fbgen&v=136&crc=669
   • igles**********?action=fbgen&v=136&crc=669
   • indiana**********?action=fbgen&v=136&crc=669
   • infor**********?action=fbgen&v=136&crc=669
   • jugen**********?action=fbgen&v=136&crc=669
   • kerten**********?action=fbgen&v=136&crc=669
   • ledtlon**********?action=fbgen&v=136&crc=669
   • lene.aa**********?action=fbgen&v=136&crc=669
   • lifec**********?action=fbgen&v=136&crc=669
   • losek**********?action=fbgen&v=136&crc=669
   • mahjo**********?action=fbgen&v=136&crc=669
   • marios**********?action=fbgen&v=136&crc=669
   • mgmmdi**********?action=fbgen&v=136&crc=669
   • mswcon**********?action=fbgen&v=136&crc=669
   • my3boys.hittin**********?action=fbgen&v=136&crc=669
   • ottoma**********?action=fbgen&v=136&crc=669
   • pngse**********?action=fbgen&v=136&crc=669
   • polis**********?action=fbgen&v=136&crc=669
   • prostr**********?action=fbgen&v=136&crc=669
   • pvpont**********?action=fbgen&v=136&crc=669
   • raur**********?action=fbgen&v=136&crc=669
   • rdsch**********?action=fbgen&v=136&crc=669
   • rememberwhenohio.netf**********?action=fbgen&v=136&crc=669
   • renog**********?action=fbgen&v=136&crc=669
   • rentsa**********?action=fbgen&v=136&crc=669
   • s172760532.onl**********?action=fbgen&v=136&crc=669
   • s220405294.onlin**********?action=fbgen&v=136&crc=669
   • scambus**********?action=fbgen&v=136&crc=669
   • shann**********?action=fbgen&v=136&crc=669
   • silkroa**********?action=fbgen&v=136&crc=669
   • stellar**********?action=fbgen&v=136&crc=669
   • swimandscuba.netf**********?action=fbgen&v=136&crc=669
   • thecon**********?action=fbgen&v=136&crc=669
   • tommie**********?action=fbgen&v=136&crc=669
   • usedca**********?action=fbgen&v=136&crc=669
   • webster**********?action=fbgen&v=136&crc=669
   • welov**********?action=fbgen&v=136&crc=669
   • www.agap**********?action=fbgen&v=136&crc=669
   • www.aic**********?action=fbgen&v=136&crc=669
   • www.associaz**********?action=fbgen&v=136&crc=669
   • www.bastak**********?action=fbgen&v=136&crc=669
   • www.beauti**********?action=fbgen&v=136&crc=669
   • www.cayge**********?action=fbgen&v=136&crc=669
   • www.cheryl**********?action=fbgen&v=136&crc=669
   • www.edilt**********?action=fbgen&v=136&crc=669
   • www.heran**********?action=fbgen&v=136&crc=669
   • www.ilterrazzo**********?action=fbgen&v=136&crc=669
   • www.its-**********?action=fbgen&v=136&crc=669
   • www.limen**********?action=fbgen&v=136&crc=669
   • www.musi**********?action=fbgen&v=136&crc=669
   • www.oneonon**********?action=fbgen&v=136&crc=669
   • www.ricksmusi**********?action=fbgen&v=136&crc=669
   • www.sevenpi**********?action=fbgen&v=136&crc=669
   • www.suzann**********?action=fbgen&v=136&crc=669
   • www.tcab**********?action=fbgen&v=136&crc=669
   • www.vinfinit**********?action=fbgen&v=136&crc=669
   • xrysan**********?action=fbgen&v=136&crc=669
   • yanisl**********?action=fbgen&v=136&crc=669
   • yasary**********?action=fbgen&v=136&crc=669

This is done via the HTTP POST method using a PHP script.


Remote control capabilities:
    • Download file

 Miscellaneous  Checks for an internet connection by contacting the following web site:
   • www.google.com

Descripción insertada por Mihai Dilimot el viernes, 1 de abril de 2011
Descripción actualizada por Mihai Dilimot el viernes, 1 de abril de 2011

Volver . . . .
 
 
 
 

© 2013 Avira Operations GmbH & Co. KG. Todos los derechos reservados.

Mi Cuenta

https:// Esta ventana está cifrada para su seguridad.