Threat Encyclopedia

Selected viruses, spyware, and other threats: sorted alphabetically

Short description
Win32/Waledac.JT is a trojan that is used for spam distribution.
Installation
The trojan does not create any copies of itself.

In order to be executed on every system start, the trojan sets the following Registry entries:
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
    CurrentVersion\Run]
    "PromoReg" = "%filepath%"
  • [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\
    Run]
    "PromoReg" = "%filepath%"
The following Registry entries are created:
  • [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion]
    "RList" = "%hex_value1%"
    "MyID" = "%hex_value2%"
    "FWDone" = "%variable%"
A string with variable content is used instead of %variable% .
Spreading
The trojan generally spreads through links in spam emails which point to websites containing malware.

Some examples follow.

Example [1.] :
Example [2.] :
Example [3.] :
Information stealing
The trojan gathers e-mail addresses from all local files.

It avoids files with the following extensions:
  • .7z
  • .avi
  • .bmp
  • .class
  • .dll
more...
The trojan connects to some of the following IP addresses:
  • 10.10.0.182
  • 112.76.132.115
  • 113.252.87.198
  • 113.254.126.104
  • 113.255.57.219
more...
The trojan can send the information to a remote machine. The HTTP protocol is used.
Other information
The trojan is sent data and commands from a remote computer or the Internet.

The trojan can be used for sending spam.

The trojan may create the following files:
  • %random%.htm
  • %random%.png
A string with variable content is used instead of %random% .

The trojan can download and execute a file from the Internet.

By adding an exception in Windows Firewall settings, the trojan ensures that it is not blocked.