virus logo Virus

W32/Feebs.Z!worm

description-logoAnalysis

W32/Feebs.Z!worm - 06-10-10


More Info:

  • It drops the following files:
    • C:\recycled\userinit.exe
  • Added the following registry:
    • key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CD5AC91B-AE7B-E83A-0C4C-E616075972F3}
    • value: Stubpath
    • data: C:\recycled\userinit.exe
  • Added the following registry:
    • key: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer
    • value: mal
    • data: [EMAIL ADDRESS OF victim]
  • Added the following registry:
    • key: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer
    • value: web
    • data: 68 74 74 70 3A 2F 2F 70 6F 70 63 61 70 66 72 65 65 2E 74 33 35 2E 63 6F 6D 2F 00
  • Email Propagation:
    • Email format:
      • Body:
        • ID: [RANDOM #s]
Password: [RANDOM characters]

[random footer/signature]
      • Attachments:
        One of the following:


msg.zip 
message.zip 
data.zip 
mail.zip

    Telemetry logoTelemetry

    Detection Availability

    FortiClient
    Extreme
    FortiMail
    Extreme
    FortiSandbox
    Extreme
    FortiWeb
    Extreme
    Web Application Firewall
    Extreme
    FortiIsolator
    Extreme
    FortiDeceptor
    Extreme
    FortiEDR

    Version Updates

    Date Version Detail
    2018-12-11 64.82100 Sig Updated
    2018-11-17 64.25300 Sig Added
    ID 146370
    Released Oct 10, 2006
    Description
    Updated    		 Oct 10, 2006
    Aliases .
    Platform Profile Win32 file format / PE 32 bit
    Profile Type Worm (worm)