Full description

Virus:	TR/Koobface.1.1
Type:	Trojan
In the wild:	No
Reported Infections:	Low
Distribution Potential:	Low
Damage Potential:	Low
File size:	66574 Bytes
MD5 checksum:	32b6d74310c5ba3ab9b219432c54e58b
VDF version:	7.10.06.229
IVDF version:	7.10.14.225 - Wednesday, December 8, 2010

General Method of propagation:
   • No own spreading routine

Aliases:
   • Mcafee: PWS-Zbot.gen.di
   • Kaspersky: Packed.Win32.Krap.ar
   • Sophos: Troj/Krap-U
   • Bitdefender: Gen:Variant.Zbot.25
   • Grisoft: Win32/Heri
   • Eset: Win32/Ramnit.A virus
   • GData: Gen:Variant.Zbot.25
   • DrWeb: Trojan.Rmnet.1
   • Norman: Trojan W32/Ramnit.Y

Platforms / OS:
   • Windows 2000
   • Windows XP
   • Windows 2003
   • Windows Vista
   • Windows Server 2008
   • Windows 7

Side effects:
   • Drops a file

Files It deletes the following files:
   • %Temp%/TM3.tmp
   • %Temp%/TM4.tmp

The following files are created:

– Non malicious file:
   • %PROGRAM FILES%\Internet Explorer\dmlconf.dat

– %HOME%\Start Menu\Programs\Startup\culuorba.exe

Miscellaneous Internet connection:
In order to check for its internet connection the following DNS servers are contacted:
   • zahlung.name
   • tybdtyutjfyvetscev.com
   • bestmocleaner.com
   • ervwetyrbuyouiylkdhrbt.com
   • wervynuuyjhnbvfservdy.com
   • tybsyiutnrtvtybdrser.com

Event handler:
It creates the following Event handlers:
   • CreateFile
   • GetDriveType
   • FindNextFile
   • FindFirstFile
   • ShellExecute

Trusted file pretending:
Its process pretends to be the following trusted process: SAFlashPlayer.exe

说明添加者： Wensin Lee 打开 2012年5月9日星期三
说明更新者： Wensin Lee 打开 2012年5月9日星期三

反馈 . . . .

我的帐户