W32.Waledac Description

W32.Waledac or Trojan.Waledac, is a computer Trojan infection that is designed to secretly download and install other malware onto an infected system. Waledac has been reported to install parasites such as Trojans, Keylogger infections, Adware and others. Waledac functions as a backdoor allowing remote access to the infected system.

Waledac was commonly attached to fake holiday e-cards spreading other infections onto the recipient’s computer once a malicious link is clicked upon. One example of the Waledac e-card distribution scam was a valentine’s message, with the subject line “A Valentine Ecard Notificaiton,” which was found to spread the MS AntiSpyware 2009 rogue anti-spyware application. Recent discoveries have confirmed that the Conficker Worm variant, Conficker.E, distributes Waledac.

Type: Worms

Aliases: TROJ_GENETIK.TI (Trend)
, WORM_WALEDAC.C (Trend)
, WORM_WALEDAC.AB (Trend)
, WORM_WALEDAC.AS (Trend)
, WORM_WALEDAC.AI (Trend)
, WORM_WALEDAC.ED (Trend)
, WORM_WALEDAC.CRV (Trend)
, WORM_WALEDAC.BK (Trend)
, Win32/Waledac.AJ (Computer Associates)
, Win32/Waledac.Z (Computer Associates)
, W32/Waled-Q (Sophos)
, Troj/Waled-AB (Sophos)
, W32/Waled-AF (Sophos)
, Mal/WaledPak-B (Sophos)
, W32/Waled-R (Sophos)
, Troj/Waled-U (Sophos)
, Troj/Waled-C (Sophos)
, W32/Waled-AW (Sophos)
, Mal/WaledPak-D (Sophos)
, W32/Waled-Z (Sophos)
, Email-Worm:W32/Waledac.A (F-Secure)
, Trojan:W32/Waledac.A (F-Secure)
, Iksmas.A.worm (Panda Software)
, W32/Waledac.AX (Panda Software).

Automatic Detection of W32.Waledac

W32.Waledac Technical Report

As new W32.Waledac details are reported by our customers and findings from our Threat Research Center, we will update this section.

The following W32.Waledac files with its MD5s were created in the system:

W32.Waledac has typically the following processes in memory:

• %SYSTEMROOT%\system32\9782.exe
• msauc.exe
• %SYSTEMROOT%\system32\drivers\svchost.exe
• _ex-08.exe
• %USERPROFILE%\LOCALS~1\Temp\yPjX.exe
• _ex-68.exe
• sam.exe.exe

W32.Waledac creates the following registry entries:

• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\”MyID” = “[HEXADECIMAL DIGITS]“
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\”RList” = “[HEXADECIMAL DIGITS]”
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\”PromoReg” = “[PATH TO THREAT FILE]”

Important Article Disclaimer