Virus

W32/Tibs.KD!tr

Analysis

  • Drops the following files:
    • alsys.exe
    • SERVICES.EXE
  • Adds the following registry:
    • key: HKCU\Software\Microsoft\Windows\CurrentVersion\Run
    • value:
    • data: undefinedSystemundefined\alsys.exe
    • key: HKLM\Software\Microsoft\Windows\CurrentVersion\Run
    • value:
    • data: undefinedSystemundefined\alsys.exe
  • Modifies the following registry:
    • key: HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess
    • value: Start
    • data: 4
  • Email Propagation:
    • Email format:

      • Subject:
      • I Think of You
        
      • Attachments: one of the following:
        • flash postcard.exe
        • greeting card.exe
        • greeting postcard.exe
        • postcard.exe

    Recommended Action

      FortiGate Systems
    • Check the main screen using the web interface for your FortiGate unit to ensure that the latest AV/NIDS database has been downloaded and installed on your system - if required, enable the "Allow Push Update" option.