Description:
This memory-resident worm, and several variants of its family, is first seen in the wild when the news of bogus Obama news sites were found several days before the inauguration of President elect Barack Obama. Researchers have found that it is found in several sites containing Obama-related key words. Samples of these spammed emails are as follows:
More information from this blog post.
It is also found to arrive on a system in several ways: as a file unknowingly downloaded by a user when visiting certain malicious Web sites, or as a file hosted on a Web site and run when a user accesses the said Web site.
When executed, it propagates by sending spam mails containing links where it can be downloaded.
To get a one-glance comprehensive view of the behavior of WORM_WALEDAC.KAX, refer to the Behavior Diagram shown below.
This worm is also capable of stealing information. It does this by searching for email addresses in files found in fixed, network, and RAM drives except files with certain extension names, most of which are media files. It then connects to several IP addresses to send all gathered information via HTTP POST.
For additional information about this threat, see:
Solution
Technical Details
Description created: Jan. 16, 2009 7:44:55 PM GMT -0800
Search a new malware
Tell us how we did. Take our quick survey.
|
Save & Share
