Worm.Kolabc.A

By Sumo3000 in Worms

Threat Scorecard

Ranking:	14,392
Threat Level:	50 % (Medium)
Infected Computers:	94

First Seen:	May 24, 2011
Last Seen:	July 11, 2023
OS(es) Affected:	Windows

Worm.Kolabc.A is a malicious worm which spreads through removable drives and other computers connected to the network. Worm.Kolabc.A opens a back door to help remote attackers get full access to the compromised machine and makes changes to the Windows Firewall and other security reports by modifying the system registry. When Worm.Kolabc.A is installed onto the targeted PC, it drops a copy of itself in the Windows fonts folder. Worm.Kolabc.A makes effort to corrupt other PCs which are connected to the infected computer via a mapped network share. Worm.Kolabc.A also attempts to use certain ports to connect to some remote servers to get further instructions from its makers. Worm.Kolabc.A creates a unique 'Desktop.ini' file which changes the icon of its executable so that it will occur as a 'recycle bin' file, which then executes from the original Worm.Kolabc.A's executable. Delete Worm.Kolabc.A before it harms your PC.

Table of Contents

Aliases

15 security vendors flagged this file as malicious.

Anti-Virus Software	Detection
Panda	Suspicious file
BitDefender	Gen:Trojan.Heur.VP.fm0@am8ECzob
BitDefender	Gen:Trojan.Heur.VP.fm0@aaM@Nlcb
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Gen:Trojan.Heur.VP.fm0@amouf3eb
Kaspersky	Trojan.Win32.VBKrypt.darp
Fortinet	MSIL/Agent.SH!tr.pws
Antiy-AVL	Trojan/win32.agent.gen
Sophos	Mal/MSIL-A
eSafe	Win32.MSILAgent.SH.P
McAfee	Artemis!63CBB1DAD54E
AhnLab-V3	Trojan/Win32.VBKrypt
BitDefender	Gen:Trojan.Heur.VP.fm0@a4pElSeb
Kaspersky	Trojan.Win32.VBKrypt.daqk
NOD32	probably a variant of Win32/VB.PTG

SpyHunter Detects & Remove Worm.Kolabc.A

File System Details

Worm.Kolabc.A may create the following file(s):

Expand All | Collapse All

#	File Name	MD5	Detections Detections: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
1.	8pyt.exe	38d42ab8f27c9a10d0a2678173a9abd2	14
Name: 8pyt.exe MD5: 38d42ab8f27c9a10d0a2678173a9abd2 Size: 90.11 KB (90112 bytes) Detections: 14 Type: Executable File Path: %TEMP% Group: Malware file Last Updated: May 31, 2011
2.	Kobalc.exe	15717cd327a723820d71900611545917	11
Name: Kobalc.exe MD5: 15717cd327a723820d71900611545917 Size: 189.99 KB (189990 bytes) Detections: 11 Type: Executable File Path: C:\$Recycle.Bin\S-1-5-21-1796601305-1522010646-4059278833-1001\$RQ9PVZD\Net-Worm\Kolabc\Kobalc.exe Group: Malware file Last Updated: October 3, 2023
3.	e8wb.exe	b7d92b68457272ddde8d2ce057dcf53d	11
Name: e8wb.exe MD5: b7d92b68457272ddde8d2ce057dcf53d Size: 90.11 KB (90112 bytes) Detections: 11 Type: Executable File Path: %WINDIR%\TEMP Group: Malware file Last Updated: May 27, 2011
4.	8l964.exe	ba78d8e48a99127b52806d424d57989b	5
Name: 8l964.exe MD5: ba78d8e48a99127b52806d424d57989b Size: 90.11 KB (90112 bytes) Detections: 5 Type: Executable File Path: %TEMP% Group: Malware file Last Updated: May 27, 2011
5.	urlmon32.exe	7c11cd111476ccdf5bf395bf69756ba2	4
Name: urlmon32.exe MD5: 7c11cd111476ccdf5bf395bf69756ba2 Size: 1.37 MB (1373696 bytes) Detections: 4 Type: Executable File Path: %WINDIR%\system32 Group: Malware file Last Updated: May 26, 2011
6.	snvztea.exe	243e58918479b990209a3de43cafac9b	1
Name: snvztea.exe MD5: 243e58918479b990209a3de43cafac9b Size: 90.11 KB (90112 bytes) Detections: 1 Type: Executable File Path: %TEMP% Group: Malware file Last Updated: May 26, 2011
7.	sv.exe
Name: sv.exe Type: Executable File Group: Malware file
8.	iexplorer.exe
Name: iexplorer.exe Type: Executable File Group: Malware file
9.	umdmgr.exe
Name: umdmgr.exe Type: Executable File Group: Malware file
10.	waw32.exe
Name: waw32.exe Type: Executable File Group: Malware file
11.	avdrive32.exe
Name: avdrive32.exe Type: Executable File Group: Malware file
12.	scvchost.exe
Name: scvchost.exe Type: Executable File Group: Malware file
13.	audiodh.exe
Name: audiodh.exe Type: Executable File Group: Malware file
14.	winupd01.exe
Name: winupd01.exe Type: Executable File Group: Malware file
15.	csrss.exe
Name: csrss.exe Type: Executable File Group: Malware file
16.	jjdrive32.exe
Name: jjdrive32.exe Type: Executable File Group: Malware file
17.	winupd.exe
Name: winupd.exe Type: Executable File Group: Malware file
18.	715.exe
Name: 715.exe Type: Executable File Group: Malware file
19.	file.exe
Name: file.exe Type: Executable File Group: Malware file
20.	8pyt.exe
Name: 8pyt.exe Type: Executable File Group: Malware file
21.	msvmcls64.exe
Name: msvmcls64.exe Type: Executable File Group: Malware file
22.	services.exe
Name: services.exe Type: Executable File Group: Malware file
23.	lsass.exe
Name: lsass.exe Type: Executable File Group: Malware file
24.	xfgn.exe
Name: xfgn.exe Type: Executable File Group: Malware file
25.	sysmngsr322.exe
Name: sysmngsr322.exe Type: Executable File Group: Malware file
26.	wind7upd.exe
Name: wind7upd.exe Type: Executable File Group: Malware file
27.	sysdiag64.exe
Name: sysdiag64.exe Type: Executable File Group: Malware file
28.	ihost.exe
Name: ihost.exe Type: Executable File Group: Malware file
29.	wndrive32.exe
Name: wndrive32.exe Type: Executable File Group: Malware file
30.	cidrive32.exe
Name: cidrive32.exe Type: Executable File Group: Malware file
31.	taskmrg32.exe
Name: taskmrg32.exe Type: Executable File Group: Malware file

Registry Details

Worm.Kolabc.A may create the following registry entry or registry entries:

HKEY..\..\..\..{RegistryKeys}

HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ Windows Management Service

HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ file

HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ Advanced DHTML Enable

HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ Microsoft Update Setup

HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ Microsoft Driver Setup

HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ 788

HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ winupdate

HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ MS Virtual CLS

HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ MicrosoftNAPC

HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ Windows automatic updates

Enigma Software Group Prevails Over Malwarebytes at the Ninth Circuit

Search

Change Region

Worm.Kolabc.A

Threat Scorecard

EnigmaSoft Threat Scorecard

Aliases

SpyHunter Detects & Remove Worm.Kolabc.A

File System Details

Registry Details

Submit Comment

Trending

Wwty Ransomware

PracticalRemote

Campo Loader

Most Viewed

Is Lookmovie.io Safe?

How To Fix 'Printer Driver is Unavailable' Error

Discord Shows Black Screen when Sharing Screen