WORM_VBNA.SMY

This worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This worm drops the following copies of itself into the affected system:

• %User Profile%\Wilbert1\winlogon.exe

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.)

It creates the following folders:

• %User Profile%\Wilbert1

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.)

Other Details

This worm connects to the following possibly malicious URL:

• http://y-5-e-2-7-w-0-0-s-r-f-7-g-5-7-9-j-1-n-n-z-s-p-1-m-5-v-v-d-4-e-.{BLOCKED}{BLOCKED}{BLOCKED}{BLOCKED}0-26-{BLOCKED}{BLOCKED}{BLOCKED}{BLOCKED}0.info/VERSION.TXT
• http://5-1-g-u-g-l-4-7-2-7-9-a-z-2-1-5-4-3-g-7-2-7-0-j-u-3-n-8-p-e-e-.{BLOCKED}3-j-fi-1-il-h-il-3e-z-u-r-u-lk-h-wm-3-6-g-0o-s-dx.info/VERSION.TXT
• http://i-7-4-6-j-2-5-l-5-8-9-z-5-8-9-4-h-s-g-3-4-z-o-6-7-b-z-l-8-v-o-.{BLOCKED}l8-k-7o-8z-l-v-uhb-u-td-8i-oe-0gp-e2g-we6-ws-2vpd.info/VERSION.TXT
• http://l-h-9-0-4-4-g-3-o-2-w-2-q-5-2-0-d-5-9-4-p-7-s-m-d-i-0-1-8-v-9-.{BLOCKED}k-5g-z2-pu6-e5x-4h-yij-yx-duv-wpx-2r8-7vc-ox-4q-u.info/VERSION.TXT
• http://h-w-4-9-5-7-e-3-4-x-3-b-b-7-r-b-j-3-q-5-8-w-7-7-v-0-4-0-2-6-1-.{BLOCKED}-fj-o4-it-ok-n-9j-zjg-pz9x-1z-zekv-y4f-acg-cq3v-j.info/VERSION.TXT
• http://8-0-3-5-w-2-3-g-g-f-f-7-8-1-4-s-1-2-2-8-3-z-x-7-7-0-i-y-8-2-4-.{BLOCKED}na-5w-2z3-djmu-7pk-qy-0-bok-re9-ym-v9h-av-njx-2es.info/VERSION.TXT
• http://6-n-h-4-z-0-c-5-8-l-3-3-e-7-4-8-u-m-5-2-p-x-j-a-g-7-r-b-n-3-m-.{BLOCKED}o-nw-dug-uqv-kzn-m-jtu-uf-q3i-r0o-vc-l4k-h21y-a9r.info/VERSION.TXT
• http://n-q-6-3-1-f-c-w-8-3-p-s-e-6-z-v-3-o-j-c-h-o-6-8-b-9-0-3-3-0-7-.{BLOCKED}-y1a-zu-s-no-bq-q1p8-qjr-j1hr-nh8-22-af3q-7q-gu-7.info/VERSION.TXT
• http://p-u-v-j-r-g-2-7-o-4-u-y-8-z-1-v-5-e-w-q-v-1-o-k-9-1-p-m-4-7-5-.{BLOCKED}bq-7-9g-haf-13-m8-4t2e-cl-fzd-6kq-g6q-ba-c-dvd4m3.info/VERSION.TXT
• http://m-7-p-i-7-8-b-k-h-9-q-d-r-3-3-9-4-s-j-8-5-6-h-e-5-i-9-9-n-t-7-.{BLOCKED}-r6-ut0-jwl-9-th9-i4k-nt1s-sz4-mk4-ahr-hf8-yi-c-6.info/VERSION.TXT
• http://4-c-1-4-w-s-3-1-e-j-0-3-r-w-q-g-8-8-9-9-a-3-7-m-o-b-f-p-5-f-5-.{BLOCKED}s-k-q0-e3r-6s-23-m2wf-7xy1z0-c0u-5wc-g0rb-2-1-5-l.info/VERSION.TXT
• http://3-9-h-n-y-v-x-0-5-4-5-3-3-s-4-4-e-8-c-5-w-s-9-h-8-h-5-3-u-j-m-.{BLOCKED}o-5-8w-0yc-tzl8-h2a-7f-ezc-oxt1-7-8y-0elh-be-3k-d.info/VERSION.TXT
• http://z-w-m-b-c-e-r-0-w-t-5-8-k-0-3-0-8-x-1-0-7-i-0-5-p-y-d-f-3-3-3-.{BLOCKED}sy-7i-5j3-sf7-8z5-54-n8v7r-0-ih7-36992m-o3-0q-g-3.info/VERSION.TXT
• http://t-7-7-a-3-q-b-y-g-j-8-8-p-2-5-c-2-o-i-9-p-x-1-5-o-9-u-c-u-7-0-.{BLOCKED}-tr2p-7c-5lk-huxs-0wq-bma-0wvi-2y-a8s-elw-hv-o0-6.info/VERSION.TXT

This report is generated via an automated analysis system.