W32/Sohanad.T!worm.im

Alias/esIM-Worm.Win32.Sohanad.t, Win32.Worm.Sohanat.U, Trj/Downloader.LZ
Release DateDec 23, 2006
Detection Availability
Active DatabaseExtended Database
FortiGatelowhigh
FortiClient
FortiMailN/A
Current Antivirus Definition Database Version: 12.202
Description

Visible Symptoms

  • The following files exist:
    • %SYSTEM%\SVICHOST.exe
    • %WINDOWS%\SVICHOST.exe
    • %WINDOWS%\At1.job
  • Possible firewall alert that an executable is attempting to connect to the internet.

    • Detailed Analysis

  • Creates copies of itself to the following location:
    • %SYSTEM%\SVICHOST.exe
    • %WINDOWS%\SVICHOST.exe
  • Drops the following file:
    • %WINDOWS%\At1.job
  • Adds the following registry:
    • key: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • value: Yahoo Messengger
    • data: %SYSTEM%\SVICHOST.exe
  • Adds the following registry:
    • key: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
    • value: DisableTaskMgr
    • data: dword:1
  • Adds the following registry:
    • key: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
    • value: DisableRegistryTools
    • data: dword:1
  • Adds the following registry:
    • key: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
    • value: NofolderOptions
    • data: dword:1
  • Modifies the following registry:
    • key: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
    • value: Shell
    • data: Explorer.exe SVICHOST.exe
  • Modifies the following registry:
    • key: HKLM\SYSTEM\CurrentControlSet\Services\Schedule
    • value: NextAtJobId
    • data: dword:2
  • Sends one of the following messages to contacts of Yahoo Messenger:
    • E may, vao day coi co con nho nay ngon lam http://{REMOVED}.0catch.com
    • Vao day nghe bai nay di ban http://{REMOVED}.0catch.com
    • Vao day nghe bai nay di ban http://{REMOVED}.0catch.com
    • Biet tin gi chua, vao day coi di http://{REMOVED}.0catch.com
    • Trang Web nay coi cung hay, vao coi thu di http://{REMOVED}.0catch.com
    • Toi di lang thang lan trong bong toi buot gia, ve dau khi da mat em roi? Ve dau khi bao nhieu mo mong gio da vo tan... Ve dau toi biet di ve dau? http://{REMOVED}.0catch.com
    • Khoc cho nho thuong voi trong long, khoc cho noi sau nhe nhu khong. Bao nhieu yeu thuong nhung ngay qua da tan theo khoi may bay that xa... http://{REMOVED}.0catch.com
    • Tha nguoi dung noi se yeu minh toi mai thoi thi gio day toi se vui hon. Gio nguoi lac loi buoc chan ve noi xa xoi, cay dang chi rieng minh toi... http://{REMOVED}.0catch.com
    • Loi em noi cho tinh chung ta, nhu doan cuoi trong cuon phim buon. Nguoi da den nhu la giac mo roi ra di cho anh bat ngo... http://{REMOVED}.0catch.com
    • Tra lai em niem vui khi duoc gan ben em, tra lai em loi yeu thuong em dem, tra lai em niem tin thang nam qua ta dap xay. Gio day chi la nhung ky niem buon... http://{REMOVED}.0catch.com
  • Attemps to close windows with the following names:
    • Bkav2006
    • System Configuration
    • Registry
    • Windows Task
  • Attempts to download malicious files from the following URLs:
    • http://{REMOVED}.0catch.com
    • http://{REMOVED}.0catch.com
    • http://{REMOVED}.0catch.com
    • http://{REMOVED}.0catch.com
    Description Last Updated Date: Dec 30, 2006
    Reference: ID - 316037