McAfee > Theat Center > Virus Detail Page

Overview

--

This is a trojan detection. Unlike viruses, trojans do not self-replicate. They are spread manually, often under the premise that they are beneficial or wanted. The most common installation methods involve system or security exploitation, and unsuspecting users manually executing unknown programs. Distribution channels include email, malicious or hacked web pages, Internet Relay Chat (IRC), peer-to-peer networks, etc.

Aliases

• Worm_Waledac.kax (Trend Micro)
• Email-Worm.Win32.Iksmas.y (Kaspersky)
• W32.Waledac (Symantec)
• Trojan:Win32/Waledac.A (Microsoft)

Characteristics

This malware has been observed as part of spam email messages enticing recipients to visit websites appearing to be related to Barack Obama.

The sites observed include those in the *.bamaonline.com, *.bamaguide.com, and *.bamadirect.com domains.

Upon execution, the following characteristics have been observed.

The following registry keys are modified/added :

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion "MyID" HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion "RList" HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "PromoReg"

Attempts are made to harvest email addresses from files on the host excluding those with the following extensions:

• .7z
• .avi
• .bmp
• .class
• .dll
• .exe
• .gif
• .gz
• .hxd
• .hxh
• .hxn
• .hxw
• .jar
• .jpeg
• .jpg
• .mov
• .mp3
• .msi
• .ocx
• .ogg
• .rar
• .vob
• .wav
• .wave
• .wma
• .wmv
• .zip

Once the emails are harvested, an attempt is made to POST the data to remote IPs of files in a [Random Filename].png  format.

A partial and edited list appears below:

• [Edited].166.248
• [Edited].72.6
• [Edited].114.168
• [Edited].218.23
• [Edited].249.201
• [Edited].141.41
• [Edited].154.180
• [Edited].6.48
• [Edited].184.131
• [Edited].231.161
• [Edited].183.47
• [Edited].211
• [Edited].30.151
• [Edited].226.98
• [Edited].242.189
• [Edited].204.133
• [Edited].58.23
• [Edited].211.196
• [Edited].55.24
• [Edited].72.54
• [Edited].245.134
• [Edited].38.228
• [Edited].90.87
• [Edited].187.145
• [Edited].65.98
• [Edited].205.244
• [Edited].148.117
• [Edited].9.136
• [Edited].79.159
• [Edited].47.17
• [Edited].51.223
• [Edited].149.19
• [Edited].163.128
• [Edited].56.89
• [Edited].117.165
• [Edited].189.97
• [Edited].170.24
• [Edited].80.197
• [Edited].233.172
• [Edited].154.212
• [Edited].157.23
• [Edited].253.159
• [Edited].233.136
• [Edited].58.39
  

Symptoms

• Presence of  registry key(s) as previously mentioned.
• Unexpected network connections attempting to post data

Method of Infection

Trojans do not self-replicate. They are spread manually, often under the premise that the executable is something beneficial. Distribution channels include IRC, peer-to-peer networks, newsgroup postings, email, etc. Certain known variants were also known to be installed via web exploits. This malware was observed as part of spam email.

Removal

All Users:
Use current engine and DAT files for detection and removal.

Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).

Additional Windows ME/XP removal considerations

Variants

Variants

N/A

All Information

Overview -

-- January 20, 2009 --
The risk assessment of this threat has been updated to Low-Profiled due to media attention at:
http://www.eweek.com/c/a/Security/Malicious-Sites-With-Fake-Obama-News-Trying-to-Build-Botnet/?kc=rss

--

This is a trojan detection. Unlike viruses, trojans do not self-replicate. They are spread manually, often under the premise that they are beneficial or wanted. The most common installation methods involve system or security exploitation, and unsuspecting users manually executing unknown programs. Distribution channels include email, malicious or hacked web pages, Internet Relay Chat (IRC), peer-to-peer networks, etc.

Aliases

• Worm_Waledac.kax (Trend Micro)
• Email-Worm.Win32.Iksmas.y (Kaspersky)
• W32.Waledac (Symantec)
• Trojan:Win32/Waledac.A (Microsoft)

Characteristics

Characteristics -

This malware has been observed as part of spam email messages enticing recipients to visit websites appearing to be related to Barack Obama.

The sites observed include those in the *.bamaonline.com, *.bamaguide.com, and *.bamadirect.com domains.

Upon execution, the following characteristics have been observed.

The following registry keys are modified/added :

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion "MyID" HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion "RList" HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "PromoReg"

Attempts are made to harvest email addresses from files on the host excluding those with the following extensions:

• .7z
• .avi
• .bmp
• .class
• .dll
• .exe
• .gif
• .gz
• .hxd
• .hxh
• .hxn
• .hxw
• .jar
• .jpeg
• .jpg
• .mov
• .mp3
• .msi
• .ocx
• .ogg
• .rar
• .vob
• .wav
• .wave
• .wma
• .wmv
• .zip

Once the emails are harvested, an attempt is made to POST the data to remote IPs of files in a [Random Filename].png  format.

A partial and edited list appears below:

• [Edited].166.248
• [Edited].72.6
• [Edited].114.168
• [Edited].218.23
• [Edited].249.201
• [Edited].141.41
• [Edited].154.180
• [Edited].6.48
• [Edited].184.131
• [Edited].231.161
• [Edited].183.47
• [Edited].211
• [Edited].30.151
• [Edited].226.98
• [Edited].242.189
• [Edited].204.133
• [Edited].58.23
• [Edited].211.196
• [Edited].55.24
• [Edited].72.54
• [Edited].245.134
• [Edited].38.228
• [Edited].90.87
• [Edited].187.145
• [Edited].65.98
• [Edited].205.244
• [Edited].148.117
• [Edited].9.136
• [Edited].79.159
• [Edited].47.17
• [Edited].51.223
• [Edited].149.19
• [Edited].163.128
• [Edited].56.89
• [Edited].117.165
• [Edited].189.97
• [Edited].170.24
• [Edited].80.197
• [Edited].233.172
• [Edited].154.212
• [Edited].157.23
• [Edited].253.159
• [Edited].233.136
• [Edited].58.39
  

Symptoms

Symptoms -

• Presence of  registry key(s) as previously mentioned.
• Unexpected network connections attempting to post data

Method of Infection

Method of Infection -

Trojans do not self-replicate. They are spread manually, often under the premise that the executable is something beneficial. Distribution channels include IRC, peer-to-peer networks, newsgroup postings, email, etc. Certain known variants were also known to be installed via web exploits. This malware was observed as part of spam email.

Removal -

Removal -

All Users:
Use current engine and DAT files for detection and removal.

Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).

Additional Windows ME/XP removal considerations

Variants

Variants -

N/A