W32/Tibs.KF!tr
Analysis
- Creates a mutex named klllekkdkkd to make sure that only one instance is running.
- Some variants drop a file in the current folder. Examples of filenames that are used are the following:
- u0ugT0K.exe
- MD6656l.exe
These files are also detected as Tibs variants.
Email Propagation
- Uses its own SMTP engine to send emails to addresses found on the infected computer.
- Avoids email addresses with the following strings:
- .mil
- .gov
- microsoft
- Email format:
From: may be one of the following:
- Aldora
- Alysia
- Amorita
- Anita
- April
- Ara
- Aretina
- Barbra
- Becky
- Bella
- Bettina
- Blenda
- Briana
- Bridget
- Caitlin
- Camille
- Cara
- Carla
- Carmen
- Chelsea
- Clarissa
- Damita
- Danielle
- Daria
- Diana
- Donna
- Dora
- Doris
- Ebony
- Eden
- Eliza
- Emily
- Erika
- Eve
- Evelyn
- Faith
- Gale
- Gilda
- Gloria
- Haley
- Helga
- Holly
- Ida
- Idona
- Iris
- Isabel
- Ivana
- Ivory
- Janet
- Jewel
- Joanna
- Julie
- Juliet
- Kacey
- Kali
- Kara
- Kassia
- Katrina
- Kyle
- Lara
- Laura
- Linda
- Lisa
- Lolita
- Lynn
- Maia
- Mary
- Melody
- Mimi
- Myra
- Nadia
- Naomi
- Natalie
- Nicole
- Nina
- Nora
- Nova
- Olga
- Olivia
- Pamela
- Peggy
- Queen
- Rachel
- Rae
- Rita
- Rosa
- Ruby
- Sharon
- Silver
- Ula
- Uma
- Valda
- Valora
- Vanessa
- Vicky
- Violet
- Vivian
- Wendy
- Willa
- Xandra
- Xenia
- Xylia
- Zenia
- Zilya
- Zoe
Subject: one of the following:
- 5 Reasons I Love You
- A Bouquet of Love
- A Day in Bed Coupon
- A Hug & Roses
- A Kiss for You
- A Kiss So Gentle
- A Little (sex) Card
- A Monkey Rose for You
- A Red Hot Kiss
- A Relaxing Coupon
- A Romantic Place
- A Song to You
- A Special Flower for You
- A Special Kiss
- A Sweet Love
- A Token of My Love
- A Weekend Getaway
- Against All Odds
- All For You
- All That Matters
- Angel of Love
- Awaiting Your Love
- Baby, I'll Be There
- Back Together
- Between Us
- Bewitching Moonlight
- Brand New Love
- Breakfast in Bed Coupon
- Bubble Bath Coupon
- Can't Wait to See You!
- Crazy way to say I Luv U
- Cuddle Me Please
- Cuddle Up
- Cyber Love
- Dancing With You
- Dinner Coupon
- Doing It for You
- Dream Date Coupon
- Dream Girl
- Emptiness Inside Me
- Eternity of Your Love
- Evening Romance
- Every Inch of Your Body
- Everyone Needs Someone
- Falling In Love with You
- Feeling Horny?
- Fields Of Love
- For Better of For Worse
- For You
- For You....My Love
- Forever and Ever
- Forever in Love
- From this day forward
- Full Heart
- Hand in Hand
- He Blessed Our Lives
- Heart is Breaking
- Heart of Mine
- Hey Cutie
- Hold Me (distant love)
- Hold On
- How Much I Love You
- Hugging My Pillow
- I Always Knew
- I am Complete
- I Am Lost In You
- I Believe
- I Can't Function
- I Dream of you
- I Give to You
- I Love Thee
- I Love You Mower
- I Love You So
- I Love You Soo Much
- I Love You with All I Am
- I Still Love You
- I Think of You
- I Win with You
- I wish
- I Woof You
- I Would Do Anything
- I Would Give you Anything
- If I Could
- If I Knew
- I'll Be Your Man
- In Love
- In My Heart
- Inside My Heart
- Internet Love
- It's Your Move
- Just You
- Just You & Me
- Kiss Coupon
- Kisses, Hugs & Roses
- Last Night was Hot!
- Let's Get Frisky
- Live With Me
- Longing for You
- Love at First Sight
- Love Birds
- Love for Granted
- Love is in the Air
- Love Remains
- Love You Deeply
- Made for Each Other
- Magic of Flowers
- Massage Coupon
- Memories
- Miracle of Love
- Moonlit Waterfall
- Most Beautiful Girl
- My Eye on You
- My Heart belongs to you
- My Heart is Thinking
- My Invitation
- My Love
- My Perfect Love
- Now and Forever
- Now I Know
- Old Together
- Only You
- Our Love
- Our Love Everyday
- Our Love is Free
- Our Love is Strong
- Our love is torn by miles
- Our Love Nest
- Our Love Will Last
- Our Two Hearts
- Our Wedding Day
- P.M.S
- Passionate Kiss
- Peek-A-Boo
- Pockets of Love
- Puppy Love
- Red Rose
- Romantic Picnic Coupon
- Rose for my Love
- Safe and Sound
- Safe With You
- Search for One
- Sending Kiss
- Sending You My Love
- Showers Of Love
- So in Love
- So Unique
- Solitary Beauty
- Someone at Last
- Soul Mates
- Soul Partners
- Steamy Dream
- Steamy Sex Coupon
- Summer Love
- Take My Hand
- Teddy Bear & Roses
- Tender Whispers
- Thanks...Love
- That Special Love
- The Candle's Light
- The Dance of Love
- The Kiss
- The Letter
- The Long Haul
- The Love Bugs
- The Miracle of Love
- The Mood for Love
- The Sweet Taste of Love
- The Time for Love
- Thinking about you
- Thinking of You
- This Day Forward
- This Feeling
- Til the End of Time
- Till Morning's Light
- Till Morninig's Light
- Times Are Hard, I Luv U
- To New Spouse
- Together Again
- Together You and I
- Touched by Love
- True Love
- Trunk Full Of Love
- Twice Blest
- Twilight Paradise
- Two of a Kind
- Unique Love
- Unmatchable Beauty
- Until the Day
- Vacation Love
- Waiting for You
- Want to Meet?
- Want You to Know
- We Are Different
- We Have Walked
- We're a Perfect Fit
- When I look at you
- When I'm With You
- When You Fall in Love
- Why I Love You
- Wild Nights--Wild Nights
- Will You?
- Window of Beauty
- Wine and Roses
- Wish I Could Tell You
- Wish Upon a Star
- With All My Love
- With All of My Heart
- With This Ring
- Without Your Love
- Won't you dance with me
- Words I Write
- Worthy of You
- Wrapped in Your Arms
- Wrapped Up
- You + Me
- You and I
- You and I Forever
- You Are My Guiding Star
- You are out of this world
- You Asked Me Why
- You Brighten My Day
- You Lucky Duck!
- You Rock Me!
- You Were Worth the Wait
- Your Love Has Opened
- Your Silly Smile
- You're My Hero
- You're so Far Away
- You're Soo kissable
- You're the One
Message: blank
Attachment: one of the following:
- Flash Postcard.exe
- flash postcard.exe
- greeting card.exe
- Greeting Card.exe
- greeting postcard.exe
- Greeting Postcard.exe
- postcard.exe
- Postcard.exe
Other Behavior
- Attempts to terminate security-related processes with the following strings in their names:
- anti
- avg
- avp
- blackice
- firewall
- f-pro
- hijack
- lockdown
- mcafee
- msconfig
- nav
- nod32
- rav
- reged
- spybot
- taskmgr
- troja
- viru
- vsmon
- zonea
- Modifies the following value to disable the Shared Access service in Windows 2000/XP:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess
Start = dword:00000004 (Default value is dword:00000003)
Recommended Action
-
FortiGate Systems
- Check the main screen using the web interface for your FortiGate unit to ensure that the latest AV/NIDS database has been downloaded and installed on your system - if required, enable the "Allow Push Update" option.
Telemetry
Detection Availability
FortiClient | |
---|---|
Extreme | |
FortiMail | |
Extreme | |
FortiSandbox | |
Extreme | |
FortiWeb | |
Extreme | |
Web Application Firewall | |
Extreme | |
FortiIsolator | |
Extreme | |
FortiDeceptor | |
Extreme | |
FortiEDR |