F-Secure
Tools
P2P-Worm:W32/Bacteraloh
| Name : | P2P-Worm:W32/Bacteraloh |
| Detection Names : |
P2P-Worm.Win32.Bacteraloh Win32.Sality |
| Category: | Malware |
| Type: | P2P-Worm |
| Platform: | W32 |
Summary
A type of worm that spreads over Peer-to-Peer (P2P) networks.
Additional Details
P2P-Worm.Win32.Bacteraloh is a family of P2P-Worms similar to P2P.Worm.Win32.Backterra.
Unlike Backterra, Bacteraloh variants may have the additional functionality of dropping Virus.Win32.Sality variants. For a description of Sality, please see our description of Virus.Win32.Sality.Q
Distribution
Bacteraloh spreads through file-sharing networks (primarily Emule) by disguising itself as a software crack.
To give credibility to the illusion, when executed the worm will display a fake interface and a dialog box with the message "Missing MFClibary.dll", as seen in the samples below:
Installation
The Bateraloh variants that include functionality to install Virus.Win32.Sality will drop a standalone DLL in the folder %system32%. The DLL file is then injected into running processes.
If Emule file sharing software is detected, Bacteraloh will create multiple copies of itself in:
The copies are labeled using names selected from a long list. The names are mostly in the following format:
Unlike Backterra, Bacteraloh variants may have the additional functionality of dropping Virus.Win32.Sality variants. For a description of Sality, please see our description of Virus.Win32.Sality.Q
Distribution
Bacteraloh spreads through file-sharing networks (primarily Emule) by disguising itself as a software crack.
To give credibility to the illusion, when executed the worm will display a fake interface and a dialog box with the message "Missing MFClibary.dll", as seen in the samples below:
Installation
The Bateraloh variants that include functionality to install Virus.Win32.Sality will drop a standalone DLL in the folder %system32%. The DLL file is then injected into running processes.
If Emule file sharing software is detected, Bacteraloh will create multiple copies of itself in:
• C:\Windows\Temp\Bactera\Â
The copies are labeled using names selected from a long list. The names are mostly in the following format:
• Crack & Keygen all Versions
e.g., Spacetanks Crack & Keygen all Versions
e.g., Spacetanks Crack & Keygen all Versions
• Crack & Keygen and all lower versions
e.g., Winamp 5.112 Pro and all lower Versions Crack & Keygen
e.g., Winamp 5.112 Pro and all lower Versions Crack & Keygen