Home / malware

PDF

VBS.Kagra.A@mm

First posted on 21 November 2011.
Source: BitDefender

Aliases :

VBS.Kagra.A@mm is also known as N/A.

Explanation :

It open a text file named "JENNA-JAMESON-FREE-SUPERFUCK.txt"
with "Notepad.exe". The
file content is:

"Here are some VERY interesting addresses
for SEX--SEX-SEX:

www.megap*ssy.com
www.f*ck.com
www.tits.com
www.porn.com
www.superf*ck.com
www.megati*s.com
ALSO IN WWW.NTUA.COM U CAN DOWNLAOD:JENNA JAMESON SUPERF*CK,
BILL GATES SMASHING HIS PC
IN ANGER,PAMELA ANDERSON+TOMY LEE
EXTRAF*CK VIDEO IN THE BOAT AND IN THE HOUSE,DEAD MAN BEING
F*CKED BY A WOMAN,THE WOMAN WITH A D*CK,THE LARGEST D*CK IN AFRICA,
A TIGER EATING HER KIDS,A DOG IS F*CKING MY AUNT,MATRIX 2:A SAMPLE
JULIA ROBERT'S BL*WJOB,AND THE SPECIAL THEME FROM:
THE MOST TERRIBLE D*CKHOLE IN EAST,KAJAYAMI
Please,pass this message to everyone u know,and enjoy!"

On May the 12-th,
it opens an information message box with the text "Your
PC has been hacked by KaGra[ATZI virus ver 2.1]" and the title
"From the KaGra".

On May the 13-th it deletes the windows folder (C:Windows or C:Winnt).

It copies itself as "kernel32.vbs"
and "JENNA-JAMESON-FREE-SUPERF*CK.TXT.vbs"
in the %windows% folder (C:Windows
or C:Winnt),
as "ALEXIA.TXT.vbs"
in %system% folder (C:Windowssystem
or C:Winntsystem32),
as "Natasa.TXT.vbs"
in temporary folder (C:Windowssystem emp
or C:Winntsystem32 emp ).
It also copies itself on
the floppy disk as
"KISSme.TXT.vbs"
"PUSSY.TXT.vbs"
"FUCK.TXT.vbs"
"2TITS.TXT.vbs"
"myDICK.TXT.vbs"
"PORN.TXT.vbs"
"UFOxxx.TXT.vbs"
"ALIENS.TXT.vbs"
"theBAR.TXT.vbs" or
"DrDICK.TXT.vbs".
If the virus location is
the floppy disk, it copies itself as "C:x-FUCK.TXT.vbs".
It writes in registry the key:

"HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunWupdate"
in order to launch "kernel32.vbs" (a virus copy) at the system
restart.
It writes in registry
the key:

"HKEY_LOCAL_MACHINESOFTWAREWupdate"
in order to count the infections: it spread through Outlook only 5 times.

It spreads through the Outlook to all contacts in address book, as an email
with the attachment "JENNA-JAMESON-FREE-SUPERFUCK.TXT.vbs",
the subject "Jenna Jameson pornostar
free superfuck+photo addresses" and
the body
"Do you wanna see super pornostar,Jenna
Jameson,in a special
superf*ck?Double click on the attachment of this mail,and get
also some interesting sex-sex-sex addreses... ".

Last update 21 November 2011

 

TOP