Sophos

14 August 2007 17:34 GMT

Cynical, Suicidal, Pathetic, Deranged

The worm W32/Kukoo-A was written by someone who is ostensibly screaming out for help. The author claims to wish for a visit from the Grim Reaper with a certain pathos in the choice of words:

registry2.JPG

However, the worm uses social engineering on multiple levels in order to get the hapless victim to execute it:

folder1.JPG

If the option to hide known extensions is chosen (not recommended but part of the default configuration) in Explorer, it is clear that the worm’s attempt to masquerade as a standard Windows folder with interesting content is quite effective.

One can perhaps conclude that the author has cynically taken advantage of human pity to further some pathetic ambition. The author has quite possibly gone a bit “Kukoo” in my opinion.

SKM, SophosLabs UK