This application requires Javascript for optimal performance.

W32/Sohanad.T!worm.im - Released Dec 23, 2006 - Last Updated Dec 30, 2006

Alias/es

IM-Worm.Win32.Sohanad.t, Win32.Worm.Sohanat.U, Trj/Downloader.LZ

Detection Availability

Active DatabaseExtended Database
FortiGate
low
high
FortiClient
FortiMail N/A

Visible Symptoms

  • The following files exist:
    • %SYSTEM%\SVICHOST.exe
    • %WINDOWS%\SVICHOST.exe
    • %WINDOWS%\At1.job
  • Possible firewall alert that an executable is attempting to connect to the internet.

    • Detailed Analysis

  • Creates copies of itself to the following location:
    • %SYSTEM%\SVICHOST.exe
    • %WINDOWS%\SVICHOST.exe
  • Drops the following file:
    • %WINDOWS%\At1.job
  • Adds the following registry:
    • key: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • value: Yahoo Messengger
    • data: %SYSTEM%\SVICHOST.exe
  • Adds the following registry:
    • key: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
    • value: DisableTaskMgr
    • data: dword:1
  • Adds the following registry:
    • key: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
    • value: DisableRegistryTools
    • data: dword:1
  • Adds the following registry:
    • key: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
    • value: NofolderOptions
    • data: dword:1
  • Modifies the following registry:
    • key: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
    • value: Shell
    • data: Explorer.exe SVICHOST.exe
  • Modifies the following registry:
    • key: HKLM\SYSTEM\CurrentControlSet\Services\Schedule
    • value: NextAtJobId
    • data: dword:2
  • Sends one of the following messages to contacts of Yahoo Messenger:
    • E may, vao day coi co con nho nay ngon lam http://{REMOVED}.0catch.com
    • Vao day nghe bai nay di ban http://{REMOVED}.0catch.com
    • Vao day nghe bai nay di ban http://{REMOVED}.0catch.com
    • Biet tin gi chua, vao day coi di http://{REMOVED}.0catch.com
    • Trang Web nay coi cung hay, vao coi thu di http://{REMOVED}.0catch.com
    • Toi di lang thang lan trong bong toi buot gia, ve dau khi da mat em roi? Ve dau khi bao nhieu mo mong gio da vo tan... Ve dau toi biet di ve dau? http://{REMOVED}.0catch.com
    • Khoc cho nho thuong voi trong long, khoc cho noi sau nhe nhu khong. Bao nhieu yeu thuong nhung ngay qua da tan theo khoi may bay that xa... http://{REMOVED}.0catch.com
    • Tha nguoi dung noi se yeu minh toi mai thoi thi gio day toi se vui hon. Gio nguoi lac loi buoc chan ve noi xa xoi, cay dang chi rieng minh toi... http://{REMOVED}.0catch.com
    • Loi em noi cho tinh chung ta, nhu doan cuoi trong cuon phim buon. Nguoi da den nhu la giac mo roi ra di cho anh bat ngo... http://{REMOVED}.0catch.com
    • Tra lai em niem vui khi duoc gan ben em, tra lai em loi yeu thuong em dem, tra lai em niem tin thang nam qua ta dap xay. Gio day chi la nhung ky niem buon... http://{REMOVED}.0catch.com
  • Attemps to close windows with the following names:
    • Bkav2006
    • System Configuration
    • Registry
    • Windows Task
  • Attempts to download malicious files from the following URLs:
    • http://{REMOVED}.0catch.com
    • http://{REMOVED}.0catch.com
    • http://{REMOVED}.0catch.com
    • http://{REMOVED}.0catch.com

    Recommended Action

      FortiGate Systems

    • Check the main screen using the web interface for your FortiGate unit to ensure that the latest AV/NIDS database has been downloaded and installed on your system - if required, enable the "Allow Push Update" option.

    Reference: ID - 316037