Worm.Kolabc.A

By Sumo3000 in Worms

Threat Scorecard

Popularity Rank:	11,521
Threat Level:	50 % (Medium)
Infected Computers:	121

First Seen:	May 24, 2011
Last Seen:	June 8, 2026
OS(es) Affected:	Windows

Worm.Kolabc.A is a malicious worm which spreads through removable drives and other computers connected to the network. Worm.Kolabc.A opens a back door to help remote attackers get full access to the compromised machine and makes changes to the Windows Firewall and other security reports by modifying the system registry. When Worm.Kolabc.A is installed onto the targeted PC, it drops a copy of itself in the Windows fonts folder. Worm.Kolabc.A makes effort to corrupt other PCs which are connected to the infected computer via a mapped network share. Worm.Kolabc.A also attempts to use certain ports to connect to some remote servers to get further instructions from its makers. Worm.Kolabc.A creates a unique 'Desktop.ini' file which changes the icon of its executable so that it will occur as a 'recycle bin' file, which then executes from the original Worm.Kolabc.A's executable. Delete Worm.Kolabc.A before it harms your PC.

Table of Contents

Aliases

15 security vendors flagged this file as malicious.

Antivirus Vendor	Detection
Panda	Suspicious file
BitDefender	Gen:Trojan.Heur.VP.fm0@am8ECzob
BitDefender	Gen:Trojan.Heur.VP.fm0@aaM@Nlcb
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Gen:Trojan.Heur.VP.fm0@amouf3eb
Kaspersky	Trojan.Win32.VBKrypt.darp
Fortinet	MSIL/Agent.SH!tr.pws
Antiy-AVL	Trojan/win32.agent.gen
Sophos	Mal/MSIL-A
eSafe	Win32.MSILAgent.SH.P
McAfee	Artemis!63CBB1DAD54E
AhnLab-V3	Trojan/Win32.VBKrypt
BitDefender	Gen:Trojan.Heur.VP.fm0@a4pElSeb
Kaspersky	Trojan.Win32.VBKrypt.daqk
NOD32	probably a variant of Win32/VB.PTG

SpyHunter Detects & Remove Worm.Kolabc.A

File System Details

Worm.Kolabc.A may create the following file(s):

Expand All | Collapse All

#	File Name	MD5	Detections Detections: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
1.	Kobalc.exe	15717cd327a723820d71900611545917	21
Name: Kobalc.exe MD5: 15717cd327a723820d71900611545917 Size: 189.99 KB (189990 bytes) Detections: 21 Type: Executable File Path: C:\$Recycle.Bin\S-1-5-21-1796601305-1522010646-4059278833-1001\$RQ9PVZD\Net-Worm\Kolabc\Kobalc.exe Group: Malware file Last Updated: November 20, 2025
2.	8pyt.exe	38d42ab8f27c9a10d0a2678173a9abd2	14
Name: 8pyt.exe MD5: 38d42ab8f27c9a10d0a2678173a9abd2 Size: 90.11 KB (90112 bytes) Detections: 14 Type: Executable File Path: %TEMP% Group: Malware file Last Updated: May 31, 2011
3.	e8wb.exe	b7d92b68457272ddde8d2ce057dcf53d	11
Name: e8wb.exe MD5: b7d92b68457272ddde8d2ce057dcf53d Size: 90.11 KB (90112 bytes) Detections: 11 Type: Executable File Path: %WINDIR%\TEMP Group: Malware file Last Updated: May 27, 2011
4.	8l964.exe	ba78d8e48a99127b52806d424d57989b	5
Name: 8l964.exe MD5: ba78d8e48a99127b52806d424d57989b Size: 90.11 KB (90112 bytes) Detections: 5 Type: Executable File Path: %TEMP% Group: Malware file Last Updated: May 27, 2011
5.	urlmon32.exe	7c11cd111476ccdf5bf395bf69756ba2	4
Name: urlmon32.exe MD5: 7c11cd111476ccdf5bf395bf69756ba2 Size: 1.37 MB (1373696 bytes) Detections: 4 Type: Executable File Path: %WINDIR%\system32 Group: Malware file Last Updated: May 26, 2011
6.	snvztea.exe	243e58918479b990209a3de43cafac9b	1
Name: snvztea.exe MD5: 243e58918479b990209a3de43cafac9b Size: 90.11 KB (90112 bytes) Detections: 1 Type: Executable File Path: %TEMP% Group: Malware file Last Updated: May 26, 2011
7.	sv.exe
Name: sv.exe Type: Executable File Group: Malware file
8.	iexplorer.exe
Name: iexplorer.exe Type: Executable File Group: Malware file
9.	umdmgr.exe
Name: umdmgr.exe Type: Executable File Group: Malware file
10.	waw32.exe
Name: waw32.exe Type: Executable File Group: Malware file
11.	avdrive32.exe
Name: avdrive32.exe Type: Executable File Group: Malware file
12.	scvchost.exe
Name: scvchost.exe Type: Executable File Group: Malware file
13.	audiodh.exe
Name: audiodh.exe Type: Executable File Group: Malware file
14.	winupd01.exe
Name: winupd01.exe Type: Executable File Group: Malware file
15.	csrss.exe
Name: csrss.exe Type: Executable File Group: Malware file
16.	jjdrive32.exe
Name: jjdrive32.exe Type: Executable File Group: Malware file
17.	winupd.exe
Name: winupd.exe Type: Executable File Group: Malware file
18.	715.exe
Name: 715.exe Type: Executable File Group: Malware file
19.	file.exe
Name: file.exe Type: Executable File Group: Malware file
20.	8pyt.exe
Name: 8pyt.exe Type: Executable File Group: Malware file
21.	msvmcls64.exe
Name: msvmcls64.exe Type: Executable File Group: Malware file
22.	services.exe
Name: services.exe Type: Executable File Group: Malware file
23.	lsass.exe
Name: lsass.exe Type: Executable File Group: Malware file
24.	xfgn.exe
Name: xfgn.exe Type: Executable File Group: Malware file
25.	sysmngsr322.exe
Name: sysmngsr322.exe Type: Executable File Group: Malware file
26.	wind7upd.exe
Name: wind7upd.exe Type: Executable File Group: Malware file
27.	sysdiag64.exe
Name: sysdiag64.exe Type: Executable File Group: Malware file
28.	ihost.exe
Name: ihost.exe Type: Executable File Group: Malware file
29.	wndrive32.exe
Name: wndrive32.exe Type: Executable File Group: Malware file
30.	cidrive32.exe
Name: cidrive32.exe Type: Executable File Group: Malware file
31.	taskmrg32.exe
Name: taskmrg32.exe Type: Executable File Group: Malware file

Registry Details

Worm.Kolabc.A may create the following registry entry or registry entries:

HKEY..\..\..\..{RegistryKeys}

HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ Windows Management Service

HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ file

HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ Advanced DHTML Enable

HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ Microsoft Update Setup

HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ Microsoft Driver Setup

HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ 788

HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ winupdate

HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ MS Virtual CLS

HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ MicrosoftNAPC

HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ Windows automatic updates

Analysis Report

General information

Family Name:	Worm.Kolabc.A
Signature status:	No Signature

Known Samples

MD5: a12562f9f70b649e7ef992ff59030642

SHA1: 1500350d88130582983459bc09252725ea003433

SHA256: 03D2B5A2665AA51BAAC8C82DBEF14176094E28CBD9BDEA9FAC5515ABEDE0C26A

File Size: 990.72 KB, 990720 bytes

Windows Portable Executable Attributes

File doesn't have "Rich" header
File doesn't have debug information
File doesn't have exports table
File doesn't have security information
File has TLS information
File is 32-bit executable
File is either console or GUI application
File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
File is Native application (NOT .NET application)
File is not packed

IMAGE_FILE_DLL is not set inside PE header (Executable)
IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

File Traits

big overlay
No Version Info
x86

Block Information

Total Blocks:	190
Potentially Malicious Blocks:	32
Whitelisted Blocks:	158
Unknown Blocks:	0

Visual Map

0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 0 x x x x x x x x 0 x x 0 x 0 x 0 0 0 0 0 x x x 0 0 0 x x 0 0 x 0 x x x 0 0 x x x x x x 0 x x 0 x 0 0 x

0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

EnigmaSoft’s Payment Processor Digital River GmbH Filing for Bankruptcy Does Not Impact SpyHunter Customers’ Anti-Malware Protection

Search

Change Region

Worm.Kolabc.A

Threat Scorecard

EnigmaSoft Threat Scorecard

Aliases

SpyHunter Detects & Remove Worm.Kolabc.A

File System Details

Registry Details

Analysis Report

General information

Known Samples

Known Samples

Windows Portable Executable Attributes

Windows Portable Executable Attributes

File Icons

File Icons

File Traits

Block Information

Block Information

Visual Map

Submit Comment

Trending

Adware.FreeWorkz

Lantixprostream.co.in

Tradersuper5.xyz

Most Viewed

Pornktube.porn

How To Fix 'Printer Driver is Unavailable' Error

Discord Shows Black Screen when Sharing Screen