VirusW32/Agent.NAF!tr
Analysis
- Creates a mutex named klllekkdkkd to make sure that only one instance is running.
- Drops the file [Random].exe, where [Random] consists of seven random characters.
- Drops the following files to the System folder:
- wincom32.ini
- wincom32.sys
The virus has rootkit capabilities, making these files hidden.
- Registers itself as a window service named wincom32.
- Email format:
- Subject: one of the following:
- 5 Reasons I Love You
- A Bouquet of Love
- A Day in Bed Coupon
- A Hug & Roses
- A Kiss for You
- A Kiss So Gentle
- A Little (sex) Card
- A Monkey Rose for You
- A Red Hot Kiss
- A Relaxing Coupon
- A Romantic Place
- A Song to You
- A Special Flower for You
- A Special Kiss
- A Sweet Love
- A Token of My Love
- A Weekend Getaway
- Against All Odds
- All For You
- All That Matters
- Angel of Love
- Awaiting Your Love
- Baby, I'll Be There
- Back Together
- Between Us
- Bewitching Moonlight
- Brand New Love
- Breakfast in Bed Coupon
- Bubble Bath Coupon
- Can't Wait to See You!
- Crazy way to say I Luv U
- Cuddle Me Please
- Cuddle Up
- Cyber Love
- Dancing With You
- Dinner Coupon
- Doing It for You
- Dream Date Coupon
- Dream Girl
- Emptiness Inside Me
- Eternity of Your Love
- Evening Romance
- Every Inch of Your Body
- Everyone Needs Someone
- Falling In Love with You
- Feeling Horny?
- Fields Of Love
- For Better of For Worse
- For You
- For You....My Love
- Forever and Ever
- Forever in Love
- From this day forward
- Full Heart
- Hand in Hand
- Hand in Hand
- He Blessed Our Lives
- Heart is Breaking
- Heart of Mine
- Hey Cutie
- Hold Me (distant love)
- Hold On
- How Much I Love You
- Hugging My Pillow
- I Always Knew
- I am Complete
- I Am Lost In You
- I Believe
- I Can't Function
- I Dream of you
- I Give to You
- I Love Thee
- I Love Thee
- I Love You Mower
- I Love You So
- I Love You Soo Much
- I Love You with All I Am
- I Still Love You
- I Think of You
- I Win with You
- I wish
- I Woof You
- I Would Do Anything
- I Would Give you Anything
- If I Could
- If I Knew
- I'll Be Your Man
- In Love
- In My Heart
- Inside My Heart
- Internet Love
- It's Your Move
- Just You
- Just You & Me
- Kiss Coupon
- Kisses, Hugs & Roses
- Last Night was Hot!
- Let's Get Frisky
- Live With Me
- Longing for You
- Love at First Sight
- Love Birds
- Love for Granted
- Love is in the Air
- Love Remains
- Love You Deeply
- Made for Each Other
- Massage Coupon
- Memories
- Miracle of Love
- Miracle of Love
- Moonlit Waterfall
- Most Beautiful Girl
- My Eye on You
- My Heart belongs to you
- My Heart is Thinking
- My Invitation
- My Love
- My Perfect Love
- Now and Forever
- Now I Know
- Old Together
- Only You
- Our Love
- Our Love Everyday
- Our Love is Free
- Our Love is Strong
- Our love is torn by miles
- Our Love Nest
- Our Love Will Last
- Our Two Hearts
- Our Wedding Day
- P.M.S
- Passionate Kiss
- Peek-A-Boo
- Pockets of Love
- Puppy Love
- Red Rose
- Romantic Picnic Coupon
- Rose for my Love
- Safe and Sound
- Safe With You
- Search for One
- Sending Kiss
- Sending You My Love
- Sending You My Love
- Showers Of Love
- So in Love
- So in Love
- So Unique
- Solitary Beauty
- Someone at Last
- Soul Mates
- Soul Partners
- Steamy Dream
- Steamy Sex Coupon
- Summer Love
- Take My Hand
- Teddy Bear & Roses
- Tender Whispers
- Thanks...Love
- That Special Love
- The Candle's Light
- The Dance of Love
- The Kiss
- The Letter
- The Long Haul
- The Love Bugs
- The Miracle of Love
- The Mood for Love
- The Mood for Love
- The Sweet Taste of Love
- The Time for Love
- Thinking about you
- Thinking of You
- This Day Forward
- This Feeling
- Til the End of Time
- Till Morning's Light
- Till Morninig's Light
- Times Are Hard, I Luv U
- To New Spouse
- Together Again
- Together You and I
- Touched by Love
- True Love
- Trunk Full Of Love
- Twice Blest
- Twilight Paradise
- Two of a Kind
- Unique Love
- Unmatchable Beauty
- Until the Day
- Vacation Love
- Waiting for You
- Want to Meet?
- Want You to Know
- We Are Different
- We Have Walked
- We're a Perfect Fit
- When I look at you
- When I'm With You
- When I'm With You
- When You Fall in Love
- Why I Love You
- Wild Nights--Wild Nights
- Will You?
- Window of Beauty
- Wine and Roses
- Wish I Could Tell You
- Wish Upon a Star
- With All My Love
- With All of My Heart
- With This Ring
- Without Your Love
- Won't you dance with me
- Words I Write
- Worthy of You
- Wrapped in Your Arms
- Wrapped Up
- You + Me
- You and I
- You and I Forever
- You Are My Guiding Star
- You are out of this world
- You Asked Me Why
- You Brighten My Day
- You Lucky Duck!
- You Rock Me!
- You Were Worth the Wait
- Your Love Has Opened
- Your Silly Smile
- You're My Hero
- You're so Far Away
- You're Soo kissable
- You're the One
- flash postcard.exe
- Flash Postcard.exe
- Greeting Card.exe
- greeting card.exe
- Greeting Postcard.exe
- greeting postcard.exe
- postcard.exe
Email Propagation
Attachment: one of the following:
Recommended Action
-
FortiGate Systems
- Check the main screen using the web interface for your FortiGate unit to ensure that the latest AV/NIDS database has been downloaded and installed on your system - if required, enable the "Allow Push Update" option.
Telemetry
Detection Availability
| FortiClient | |
|---|---|
| Extreme | |
| FortiMail | |
| Extreme | |
| FortiSandbox | |
| Extreme | |
| FortiWeb | |
| Extreme | |
| Web Application Firewall | |
| Extreme | |
| FortiIsolator | |
| Extreme | |
| FortiDeceptor | |
| Extreme | |
| FortiEDR |