W32/Tibs.KF!tr

description-logoAnalysis

  • Creates a mutex named klllekkdkkd  to make sure that only one instance is running.
  • Some variants drop a file in the current folder. Examples of filenames that are used are the following:
    • u0ugT0K.exe
    • MD6656l.exe

    These files are also detected as Tibs variants.
    Email Propagation
  • Uses its own SMTP engine to send emails to addresses found on the infected computer.
  • Avoids email addresses with the following strings:
    • .mil
    • .gov
    • microsoft

  • Email format:
    From: may be one of the following:
    • Aldora
    • Alysia
    • Amorita
    • Anita
    • April
    • Ara
    • Aretina
    • Barbra
    • Becky
    • Bella
    • Bettina
    • Blenda
    • Briana
    • Bridget
    • Caitlin
    • Camille
    • Cara
    • Carla
    • Carmen
    • Chelsea
    • Clarissa
    • Damita
    • Danielle
    • Daria
    • Diana
    • Donna
    • Dora
    • Doris
    • Ebony
    • Eden
    • Eliza
    • Emily
    • Erika
    • Eve
    • Evelyn
    • Faith
    • Gale
    • Gilda
    • Gloria
    • Haley
    • Helga
    • Holly
    • Ida
    • Idona
    • Iris
    • Isabel
    • Ivana
    • Ivory
    • Janet
    • Jewel
    • Joanna
    • Julie
    • Juliet
    • Kacey
    • Kali
    • Kara
    • Kassia
    • Katrina
    • Kyle
    • Lara
    • Laura
    • Linda
    • Lisa
    • Lolita
    • Lynn
    • Maia
    • Mary
    • Melody
    • Mimi
    • Myra
    • Nadia
    • Naomi
    • Natalie
    • Nicole
    • Nina
    • Nora
    • Nova
    • Olga
    • Olivia
    • Pamela
    • Peggy
    • Queen
    • Rachel
    • Rae
    • Rita
    • Rosa
    • Ruby
    • Sharon
    • Silver
    • Ula
    • Uma
    • Valda
    • Valora
    • Vanessa
    • Vicky
    • Violet
    • Vivian
    • Wendy
    • Willa
    • Xandra
    • Xenia
    • Xylia
    • Zenia
    • Zilya
    • Zoe

    Subject: one of the following:
    • 5 Reasons I Love You
    • A Bouquet of Love
    • A Day in Bed Coupon
    • A Hug & Roses
    • A Kiss for You
    • A Kiss So Gentle
    • A Little (sex) Card
    • A Monkey Rose for You
    • A Red Hot Kiss
    • A Relaxing Coupon
    • A Romantic Place
    • A Song to You
    • A Special Flower for You
    • A Special Kiss
    • A Sweet Love
    • A Token of My Love
    • A Weekend Getaway
    • Against All Odds
    • All For You
    • All That Matters
    • Angel of Love
    • Awaiting Your Love
    • Baby, I'll Be There
    • Back Together
    • Between Us
    • Bewitching Moonlight
    • Brand New Love
    • Breakfast in Bed Coupon
    • Bubble Bath Coupon
    • Can't Wait to See You!
    • Crazy way to say I Luv U
    • Cuddle Me Please
    • Cuddle Up
    • Cyber Love
    • Dancing With You
    • Dinner Coupon
    • Doing It for You
    • Dream Date Coupon
    • Dream Girl
    • Emptiness Inside Me
    • Eternity of Your Love
    • Evening Romance
    • Every Inch of Your Body
    • Everyone Needs Someone
    • Falling In Love with You
    • Feeling Horny?
    • Fields Of Love
    • For Better of For Worse
    • For You
    • For You....My Love
    • Forever and Ever
    • Forever in Love
    • From this day forward
    • Full Heart
    • Hand in Hand
    • He Blessed Our Lives
    • Heart is Breaking
    • Heart of Mine
    • Hey Cutie
    • Hold Me (distant love)
    • Hold On
    • How Much I Love You
    • Hugging My Pillow
    • I Always Knew
    • I am Complete
    • I Am Lost In You
    • I Believe
    • I Can't Function
    • I Dream of you
    • I Give to You
    • I Love Thee
    • I Love You Mower
    • I Love You So
    • I Love You Soo Much
    • I Love You with All I Am
    • I Still Love You
    • I Think of You
    • I Win with You
    • I wish
    • I Woof You
    • I Would Do Anything
    • I Would Give you Anything
    • If I Could
    • If I Knew
    • I'll Be Your Man
    • In Love
    • In My Heart
    • Inside My Heart
    • Internet Love
    • It's Your Move
    • Just You
    • Just You & Me
    • Kiss Coupon
    • Kisses, Hugs & Roses
    • Last Night was Hot!
    • Let's Get Frisky
    • Live With Me
    • Longing for You
    • Love at First Sight
    • Love Birds
    • Love for Granted
    • Love is in the Air
    • Love Remains
    • Love You Deeply
    • Made for Each Other
    • Magic of Flowers
    • Massage Coupon
    • Memories
    • Miracle of Love
    • Moonlit Waterfall
    • Most Beautiful Girl
    • My Eye on You
    • My Heart belongs to you
    • My Heart is Thinking
    • My Invitation
    • My Love
    • My Perfect Love
    • Now and Forever
    • Now I Know
    • Old Together
    • Only You
    • Our Love
    • Our Love Everyday
    • Our Love is Free
    • Our Love is Strong
    • Our love is torn by miles
    • Our Love Nest
    • Our Love Will Last
    • Our Two Hearts
    • Our Wedding Day
    • P.M.S
    • Passionate Kiss
    • Peek-A-Boo
    • Pockets of Love
    • Puppy Love
    • Red Rose
    • Romantic Picnic Coupon
    • Rose for my Love
    • Safe and Sound
    • Safe With You
    • Search for One
    • Sending Kiss
    • Sending You My Love
    • Showers Of Love
    • So in Love
    • So Unique
    • Solitary Beauty
    • Someone at Last
    • Soul Mates
    • Soul Partners
    • Steamy Dream
    • Steamy Sex Coupon
    • Summer Love
    • Take My Hand
    • Teddy Bear & Roses
    • Tender Whispers
    • Thanks...Love
    • That Special Love
    • The Candle's Light
    • The Dance of Love
    • The Kiss
    • The Letter
    • The Long Haul
    • The Love Bugs
    • The Miracle of Love
    • The Mood for Love
    • The Sweet Taste of Love
    • The Time for Love
    • Thinking about you
    • Thinking of You
    • This Day Forward
    • This Feeling
    • Til the End of Time
    • Till Morning's Light
    • Till Morninig's Light
    • Times Are Hard, I Luv U
    • To New Spouse
    • Together Again
    • Together You and I
    • Touched by Love
    • True Love
    • Trunk Full Of Love
    • Twice Blest
    • Twilight Paradise
    • Two of a Kind
    • Unique Love
    • Unmatchable Beauty
    • Until the Day
    • Vacation Love
    • Waiting for You
    • Want to Meet?
    • Want You to Know
    • We Are Different
    • We Have Walked
    • We're a Perfect Fit
    • When I look at you
    • When I'm With You
    • When You Fall in Love
    • Why I Love You
    • Wild Nights--Wild Nights
    • Will You?
    • Window of Beauty
    • Wine and Roses
    • Wish I Could Tell You
    • Wish Upon a Star
    • With All My Love
    • With All of My Heart
    • With This Ring
    • Without Your Love
    • Won't you dance with me
    • Words I Write
    • Worthy of You
    • Wrapped in Your Arms
    • Wrapped Up
    • You + Me
    • You and I
    • You and I Forever
    • You Are My Guiding Star
    • You are out of this world
    • You Asked Me Why
    • You Brighten My Day
    • You Lucky Duck!
    • You Rock Me!
    • You Were Worth the Wait
    • Your Love Has Opened
    • Your Silly Smile
    • You're My Hero
    • You're so Far Away
    • You're Soo kissable
    • You're the One

    Message: blank
    Attachment: one of the following:
    • Flash Postcard.exe
    • flash postcard.exe
    • greeting card.exe
    • Greeting Card.exe
    • greeting postcard.exe
    • Greeting Postcard.exe
    • postcard.exe
    • Postcard.exe

    Other Behavior
  • Attempts to terminate security-related processes with the following strings in their names:
    • anti
    • avg
    • avp
    • blackice
    • firewall
    • f-pro
    • hijack
    • lockdown
    • mcafee
    • msconfig
    • nav
    • nod32
    • rav
    • reged
    • spybot
    • taskmgr
    • troja
    • viru
    • vsmon
    • zonea

  • Modifies the following value to disable the Shared Access service in Windows 2000/XP:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess
      Start = dword:00000004 (Default value is dword:00000003)

recommended-action-logoRecommended Action

    FortiGate Systems
  • Check the main screen using the web interface for your FortiGate unit to ensure that the latest AV/NIDS database has been downloaded and installed on your system - if required, enable the "Allow Push Update" option.

Telemetry logoTelemetry

Detection Availability

FortiClient
Extreme
FortiMail
Extreme
FortiSandbox
Extreme
FortiWeb
Extreme
Web Application Firewall
Extreme
FortiIsolator
Extreme
FortiDeceptor
Extreme
FortiEDR