Full description

Virus:	Worm/Koobface.40960D
Date discovered:	01/02/2010
Type:	Worm
In the wild:	Yes
Reported Infections:	Low to medium
Distribution Potential:	Low
Damage Potential:	Low
Static file:	Yes
File size:	40.960 Bytes
MD5 checksum:	0663ffb6fa3e7195a10e30e3317df9fd
IVDF version:	7.10.03.145 - Monday, February 1, 2010

General Aliases:
   • Panda: W32/Koobface.GI.worm
   • Eset: Win32/Koobface.NCL
   • Bitdefender: Trojan.Generic.IS.131893

Platforms / OS:
   • Windows 2000
   • Windows XP
   • Windows 2003

Side effects:
   • Drops malicious files
   • Registry modification

Files It copies itself to the following location:
   • %WINDIR%\pp14.exe

It deletes the initially executed copy of itself.

It deletes the following file:
   • %WINDIR%\dxxdv34567.bat

The following files are created:

– %WINDIR%\dxxdv34567.bat Furthermore it gets executed after it was fully created. This batch file is used to delete a file.
– %WINDIR%\fdgg34353edfgdfdf

It tries to executes the following files:

– Filename:
   • %WINDIR%\pp14.exe %malware execution directory%\%executed file%

– Filename:
   • cmd /c %WINDIR%\dxxdv34567.bat

Registry One of the following values is added in order to run the process after reboot:

– [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
• "pp"="%WINDIR%\pp14.exe"

File details Runtime packer:
In order to aggravate detection and reduce size of the file it is packed with a runtime packer.

說明撰寫者 Petre Galan 開啟 2010年4月7日星期三
說明更新者 Petre Galan 開啟 2010年4月7日星期三

返回 . . . .

我的帳戶