The biggest threat companies are facing today is corporate espionage. Even the most secure networks aren't 100% safe, but there are ways network administrators can spot a worm or attacker before the damage is done. Recently I came across a worm that has the potential to send the internal infrastructure of a network to the attacker by using a service related to Backdoor.CVM.
The infection begins like it usually does. Someone clicks something they shouldn't. Regardless of how it happens, the results are the same.
You can expect to see this many added/modified files across your network if this worm has its way.
The worm's first order of business is to contact the site hosting the malicious content. This particular variant of this threat phoned home to http:// 513389.cn/kk.txt. Once there it downloads 34 executable files, the last of which being okok.exe. Once okok.exe is saved to the infected machine as C:\Windows\System32\Microsoft\svchost.exe it sends out an ARP broadcast to map the network.
Svchost.exe (okok.exe) sends out an ARP broadcast across the network.
After that it's only a matter of time until more and more computers on the network start displaying similar network activity. We detect this threat as OkOk.
Leave a comment