Sonicwall Signatures


Go to All Categories list.

Dabber.A is a Worm. Worms spread from computer to computer, making copies of themselves over the network. They could spread over email, IM, peer-to-peer networks, or directly over the wire by leveraging vulnerabilities. Dabber.A is compressed using the UPX executable packer and its file size is 29,696 bytes. Dabber.A drops the following files on the hard drive:
  • C:\WINDOWS\SYSTEM32\package.exe (29696 bytes)
It also changes Windows registry:
  • Creates value "sassfix"="C:\WINDOWS\SYSTEM32\package.exe" in key "HKLM\Software\Microsoft\Windows\CurrentVersion\Run".
  • Creates key "HKCU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run".
It creates the following mutex to ensure only one instance is running: sas4dab. It also has possible backdoor functionality [unknown] port 9898, is executed every time Windows starts.

Relevant Information