Home / malware

PDF

P2P-Worm:W32/Bacteraloh

First posted on 26 February 2009.
Source: SecurityHome

Aliases :

There are no other names known for P2P-Worm:W32/Bacteraloh.

Explanation :

A type of worm that spreads over Peer-to-Peer (P2P) networks.

right]P2P-Worm.Win32.Bacteraloh is a family of P2P-Worms similar to P2P.Worm.Win32.Backterra.

Unlike Backterra, Bacteraloh variants may have the additional functionality of dropping Virus.Win32.Sality variants. For a description of Sality, please see our description of Virus.Win32.Sality.Q

Distribution

Bacteraloh spreads through file-sharing networks (primarily Emule) by disguising itself as a software crack.

To give credibility to the illusion, when executed the worm will display a fake interface and a dialog box with the message "Missing MFClibary.dll", as seen in the samples below:






Installation

The Bateraloh variants that include functionality to install Virus.Win32.Sality will drop a standalone DLL in the folder %system32%. The DLL file is then injected into running processes.

If Emule file sharing software is detected, Bacteraloh will create multiple copies of itself in:

• C:WindowsTempBactera

The copies are labeled using names selected from a long list. The names are mostly in the following format:

• Crack & Keygen all Versions
  e.g., Spacetanks Crack & Keygen all Versions
• Crack & Keygen and all lower versions
  e.g., Winamp 5.112 Pro and all lower Versions Crack & Keygen

Last update 26 February 2009

 

TOP