Threat Database Worms Java.Cogyeka

Java.Cogyeka

By ZulaZuza in Worms

Threat Scorecard

Ranking: 6,391
Threat Level: 20 % (Normal)
Infected Computers: 6,541
First Seen: July 9, 2012
Last Seen: September 19, 2023
OS(es) Affected: Windows

Java.Cogyeka is a worm that proliferates through mapped and removable drives. Java.Cogyeka also adds a remote file onto the corrupted machine. When activated, Java.Cogyeka creates a few potentially malevolent files. Java.Cogyeka also creates the particular registry entry. Java.Cogyeka drops a module from the certain location '[RANDOM LETTERS].[DOMAIN NAME]:[RANDOM PORT NUMBER]'. Java.Cogyeka then opens a random UDP port on the infected PC used by the downloaded module.

File System Details

Java.Cogyeka may create the following file(s):
# File Name Detections
1. %Temp%\hsperfdata_[USER NAME]\[RANDOM LETTERS].dll
2. %Temp%\hsperfdata_[USER NAME]\[SYSTEM EXECUTABLE FILE NAME].exe
3. %DriveLetter%\autorun.inf
4. %Temp%\hsperfdata_[USER NAME]\[RANDOM DIGITS]
5. %DriveLetter%\RECYCLER\[SID]\[RANDOM LETTERS].[THREE RANDOM LETTERS]
6. %Temp%\jar_cache[RANDOM DIGITS].tmp
7. %DriveLetter%\RECYCLER\[SID]\desktop.ini

Registry Details

Java.Cogyeka may create the following registry entry or registry entries:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{175975F5-C68F-0875-C827-9225E76EAC65}\"StubPath" = "cmd /q /c start "" /I /B javaw -classpath %Temp%\jar_cache[NUMBERS].tmp"

URLs

Java.Cogyeka may call the following URLs:

-about.me

Trending

Most Viewed

Loading...