Threat Description

Trojan: W32/Waledac.gen

Details

Category: Malware
Type: Trojan, Email-Worm
Platform: W32
Aliases: Trojan:W32/Waledac.gen, Trojan:W32/Waledac, Packed:W32/Waledac

Summary


Trojan:W32/Waledac.gen is a Generic Detection of variants in the Trojan:W32/Waledac family.



Removal


Automatic action

Once detected, the F-Secure security product will automatically disinfect the suspect file by either deleting it or renaming it.

More scanning & removal options

More information on scanning or removal options is available in the documentation for your F-Secure security product on the Downloads section of our Home - Global site.

You may also refer to the Knowledge Base on the F-Secure Community site for more information.

Contact Support

For further assistance, F-Secure customers can request support online via the Request support or the Chat forms on our Home - Global site.



Technical Details


The following details are general characteristics applicable to many, but not all, variants in the Waledac family.

Propagation

Waledac spreads in an e-mail attachment. Social engineering tricks are used to tempt the victim. Waledac spam frequently uses holidays and news headlines. For example, a fake Barack Obama websites was used as bait during the US 2008 Presidential Elections. Obama spam was also used during the US Presidential Inauguration.

Activity

Waledac is capable of receiving commands from a remote server. Commands include instructions on functions to perform (for example, update malware components or send information from the infected computer).Samples analyzed in the lab also downloaded Rogue antispyware applications. Waledac variants use lists of hardcoded IP addresses to determine where it sends harvested data. More recent variants can also update their lists from the remote command server.

Packers

The packers used by Waledac are different depending on the variant. Cryptor is being used as of January, 2009.






SUBMIT A SAMPLE

Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Now

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

Learn More