virus logo Virus

W32/Sohanad.AS!worm

description-logoAnalysis

  • The malware arrives as the file New Folder.exe  with an icon that resembles that of a folder.

  • It drops the following files:
    • undefinedWindowsundefined\SCVVHSOT.exe
    • undefinedWindowsundefined\Tasks\At1.job
    • undefinedSystemundefined\SCVVHSOT.exe
    • undefinedSystemundefined\blastclnnn.exe
    • undefinedSystemundefined\autorun.ini
  • The malware applies the following registry modifications:
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
      Yahoo Messengger = "undefinedSytemDirundefined\SCVVHSOT.exe"
    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\WorkgroupCrawler
  • The malware has been observed to be capable of the following behavior:
    • Spread itself via the Yahoo Instant Messaging client
    • Spread itself by copying itself to attached removable drives

    recommended-action-logoRecommended Action

      FortiGate Systems
    • Check the main screen using the web interface for your FortiGate unit to ensure that the latest AV/NIDS database has been downloaded and installed on your system - if required, enable the "Allow Push Update" option.
      FortiClient Systems
    • Quarantine/delete files that are detected and replace infected files with clean backup copies.

    Telemetry logoTelemetry

    Detection Availability

    FortiGate
    Extended
    FortiClient
    FortiMail
    FortiSandbox
    FortiWeb
    Web Application Firewall
    FortiIsolator
    FortiDeceptor
    FortiEDR

    Version Updates

    Date Version Detail
    2024-04-23 92.03632
    2023-08-29 91.06474
    2023-07-14 91.05083
    2023-05-30 91.03736
    2023-04-13 91.02310
    2023-02-21 91.00794
    2023-01-25 90.09964
    2023-01-12 90.09594
    2022-10-25 90.07227
    2022-09-13 90.05950
    ID 445559
    Released Mar 24, 2008
    Description
    Updated    		 May 27, 2008
    Aliases INF/Sohanad.AS!worm, IM-Worm.Win32.Sohanad.as, W32/YahLover.worm.gen virus, WORM_SOHANAD.EJ
    Platform Profile Win32 file format / PE 32 bit
    Profile Type Worm (worm)