arrow_back
search
close

WORM_DORKBOT.SMO

October 09, 2012
 PLATFORM:

Windows 2000, Windows XP, Windows Server 2003

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:

  • Threat Type: Worm

  • Destructiveness: No

  • Encrypted: No

  • In the wild: Yes

  OVERVIEW

This worm arrives by connecting affected removable drives to a system. It may be unknowingly downloaded by a user while visiting malicious websites.

It connects to certain URLs. It may do this to remotely inform a malicious user of its installation. It may also do this to download possibly malicious files onto the computer, which puts the computer at a greater risk of infection by other threats.

  TECHNICAL DETAILS

File Size:

155,648 bytes

File Type:

EXE

Memory Resident:

Yes

Initial Samples Received Date:

01 Aug 2011

Arrival Details

This worm arrives by connecting affected removable drives to a system.

It may be unknowingly downloaded by a user while visiting malicious websites.

Installation

This worm drops the following files:

  • {removable drive}\recycler.lnk

It drops the following copies of itself into the affected system:

  • {removable drive}\RECYCLER\{random}.exe

Propagation

This worm creates the following folders in all removable drives:

  • RECYCLER

Download Routine

This worm connects to the following malicious URLs:

  • {BLOCKED}new2.info
  • {BLOCKED}new1.info
  • {BLOCKED}new.info

Other Details

This worm connects to the following URL(s) to get the affected system's IP address:

  • http://{BLOCKED}i.{BLOCKED}nia.com