Virus: Worm/Feebs.AH.2 Date discovered: 23/02/2006 Type: Worm In the wild: No Reported Infections: Low Distribution Potential: Medium to high Damage Potential: Medium Static file: Yes File size: 58.006 Bytes MD5 checksum: 9b40c973384e689f3ec34669a8ff62bc VDF version: 6.33.01.20 - Thursday, February 23, 2006IVDF version: 6.33.01.20 - Thursday, February 23, 2006
General Methods of propagation: Alias: Platforms / OS: Side effects: Files %SYSDIR% \ms%two-digit random character string% .exe%SYSDIR% \ms%two-digit random character string% 32.dll Furthermore it gets executed after it was fully created. Further investigation pointed out that this file is malware, too. Detected as: Worm/Feebs.AS Registry %hex values% %hex values% %hex values% }%two-digit random character string% %two-digit random character string% .db%two-digit random character string% 32.dll%two-digit random character string% .exe%two-digit random character string% \%hex values% %hex values% %hex values% %hex values% %hex values% %hex values% %hex values% %hex values% %hex values% %hex values% %hex values% %hex values% %hex values% %hex values% %hex values% %random character string% dat] %collected email addresses% %generated CLSID% \InprocServer32] %two-digit random character string% 32.dll"%two-digit random character string% 32.dll" = "%generated CLSID% "%paths and filenames of malware copies% %paths to malware copies% Email From: %five-digit random character string% @%sender's domain% To: Subject: %sender's domain% user%sender's domain% )%sender's domain% )Body: %five-digit random character string% %random character string% %sender's domain% %sender's domain% %sender's domain% Attachment: HTML/Feebs.Gen Mailing Address generation for FROM field: P2P Backdoor Contact server: Injection %two-digit random character string% 32.dll Miscellaneous Internet connection: Rootkit Technology Hides the following: Method used: File details Runtime packer:
Descrizione inserita da Irina Boldea su mercoledì 13 settembre 2006
Indietro
.
.
.
.
