Full description

Virus:	Worm/Koobface.cju
Date discovered:	10/11/2009
Type:	Worm
In the wild:	Yes
Reported Infections:	Low
Distribution Potential:	Low
Damage Potential:	Low to medium
Static file:	Yes
File size:	40.960 Bytes
MD5 checksum:	35db3190c235dcbfc5e235e632599f48
IVDF version:	7.01.06.216 - Tuesday, November 10, 2009

General Aliases:
   • Mcafee: W32/Koobface.worm.gen.s
   • Panda: W32/Koobface.HC.worm
   • Eset: Win32/Koobface.NCK
   • Bitdefender: Worm.Generic.98708

Platforms / OS:
   • Windows 2000
   • Windows XP
   • Windows 2003

Side effects:
   • Downloads a malicious file
   • Drops malicious files
   • Registry modification

Files It copies itself to the following location:
   • %WINDIR%\ld15.exe

It deletes the initially executed copy of itself.

It deletes the following files:
   • C:\vx\sd.dat
   • %WINDIR%\dxxdv34567.bat

The following file is created:

– %WINDIR%\dxxdv34567.bat Furthermore it gets executed after it was fully created. This batch file is used to delete a file.

It tries to download a file:

– The locations are the following:
   • http://ita-eg.com/**********/?action=ldgen&v=15
   • http://cleopatra.com.cy/**********/?action=ldgen&v=15
   • http://www.preferredflood.com/**********/?action=ldgen&v=15
   • http://videoleverage.com/**********/?action=ldgen&v=15
   • http://www.electronicstoday.org/**********/?action=ldgen&v=15
   • http://daveshieldsmedia.com/**********/?action=ldgen&v=15
   • http://www.redcode.rs/**********/?action=ldgen&v=15
   • http://abbottpainting.com/**********/?action=ldgen&v=15
   • http://nippontrading.se/**********/?action=ldgen&v=15
   • http://www.thedeathsquadmovement.com/**********/?action=ldgen&v=15
   • http://sigmai.co.il/**********/?action=ldgen&v=15
   • http://rowanhenderson.com/**********/?action=ldgen&v=15
   • http://www.electronicstoday.org/**********/?action=ldgen&a=544453496&v=15&l=1000&c_fb=0&c_ms=0&c_hi=0&c_tw=0&c_be=0&c_tg=0&c_nl=0
   • http://mm2dc.com/**********/?action=ldgen&v=15
   • http://stopreporter.com/**********/?action=ldgen&v=15
   • http://www.alkhoei.org/**********/?action=ldgen&v=15
   • http://www.ceutelcottage.nl/**********/?action=ldgen&v=15
   • http://veggiemama.com.hk/**********/?action=ldgen&v=15
   • http://www.folcon-mex.com/**********/?action=ldgen&v=15
   • http://lagrucostruzioni.it/**********/?action=ldgen&v=15
   • http://davedolbin.com/**********/?action=ldgen&v=15
   • http://liezerserv.com/**********/?action=ldgen&v=15
   • http://rjupnahaed.kopavogur.is/**********/?action=ldgen&v=15
   • http://exceleronmedical.com/**********/?action=ldgen&v=15
   • http://static.e-lady.pl/**********/?action=ldgen&v=15
   • http://delawyers.com/**********/?action=ldgen&v=15
Further investigation pointed out that this file is malware, too.

Registry One of the following values is added in order to run the process after reboot:

– [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   • "sysldtray"="%WINDIR%\ld15.exe"

The following registry key is changed:

– [HKLM\SYSTEM\CurrentControlSet\Hardware Profiles\0001\Software\
   Microsoft\windows\CurrentVersion\Internet Settings]
   New value:
   • "ProxyEnable"=dword:0x00000000

File details Runtime packer:
In order to aggravate detection and reduce size of the file it is packed with a runtime packer.

설명 삽입자 Petre Galan 2010년 3월 12일 금요일
설명 업데이트 Petre Galan 2010년 3월 12일 금요일

뒤로 . . . .

내 계정