{ "id": "44d97b65-493a-45c2-9001-088475c94d23", "created_at": "2026-04-06T00:16:11.849921Z", "updated_at": "2026-04-10T13:11:44.656239Z", "deleted_at": null, "sha1_hash": "fb86d4dd332bbbcb658052885d6daa0d73c766e5", "title": "CONFICKER - Threat Encyclopedia | Trend Micro (US)", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 54204, "plain_text": "CONFICKER - Threat Encyclopedia | Trend Micro (US)\r\nArchived: 2026-04-05 19:22:29 UTC\r\nThe first variant of the CONFICKER malware family was seen propagating via the MS08-067 Server service\r\nvulnerability back in 2008. Other variants after the first CONFICKER worm spread to other machines by\r\ndropping copies of itself in removable drives and network shares.\r\nWhat makes CONFICKER notable is the fact that most of these worms are capable of generating hundreds of\r\nURLs that it connects to. It attempts to connect to a randomly-generated URL, which it created using its own\r\ndomain-generation algorithm, to download additional files to infected systems.\r\nPart of the difficulty of removing a CONFICKER infection is its capability to block access to security and\r\nantivirus-related websites. Also, the AUTORUN feature on Windows systems, which is enabled by default,\r\nallowed easy propagation and execution when a CONFICKER-infected USB is plugged in to a clean machine. To\r\nadd to this, there was a significant number of machines that were not patched because of various reasons - some\r\nwere revealed to be because of piracy, others were legacy systems running old programs that were only supported\r\nby older Windows operating systems.\r\nThe CONFICKER infection brought to light many security issues that were later actively addressed by updates in\r\nnewer Windows operating systems. It also highlighted the need to patch and the need for better management of\r\nlegacy systems, especially those systems that are hooked up to a company's network.\r\nInstallation\r\nThis worm drops the following files:\r\n{drive letter}:\\autorun.inf\r\nIt drops the following copies of itself into the affected system:\r\n%Application Data%\\{random file name}.dll\r\n%System%\\{random file name}.dll\r\n%System%\\{random number}.tmp\r\n%Program Files%\\Internet Explorer\\{random file name}.dll\r\n%Program Files%\\Movie Maker\\{random file name}.dll\r\n%User Temp%\\{random file name}.dll\r\n{drive letter}:\\Recycler\\{SID}\\{random characters}.{random}\r\n(Note: %Application Data% is the current user's Application Data folder, which is usually C:\\Documents and\r\nSettings\\{user name}\\Application Data on Windows 2000, XP, and Server 2003, or C:\\Users\\{user\r\nname}\\AppData\\Roaming on Windows Vista and 7.. %System% is the Windows system folder, which is usually\r\nC:\\Windows\\System32.. %Program Files% is the default Program Files folder, usually C:\\Program Files in\r\nWindows 2000, Server 2003, and XP (32-bit), Vista (32-bit), and 7 (32-bit), or C:\\Program Files (x86) in Windows\r\nhttps://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/conficker\r\nPage 1 of 4\n\nXP (64-bit), Vista (64-bit), and 7 (64-bit).. %User Temp% is the current user's Temp folder, which is usually\r\nC:\\Documents and Settings\\{user name}\\Local Settings\\Temp on Windows 2000, XP, and Server 2003, or\r\nC:\\Users\\{user name}\\AppData\\Local\\Temp on Windows Vista and 7.)\r\nIt creates the following folders:\r\n{drive letter}:\\Recycler\\{SID}\r\nAutostart Technique\r\nThis worm registers itself as a system service to ensure its automatic execution at every system startup by adding\r\nthe following registry entries:\r\nHKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\\r\nWindows NT\\CurrentVersion\\SvcHost\\\r\n{random characters}\r\nHKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\\r\nServices\\{random characters}\r\nImagePath = \"%System Root%\\system32\\svchost.exe -k\"\r\nHKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\\r\nServices\\{random characters}\\Parameters\r\nServiceDll = \"%System%\\{malware file name}\"\r\nHKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\\r\nServices\\{random service name}\r\nType = \"1\"\r\nHKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\\r\nServices\\{random service name}\r\nStart = \"3\"\r\nHKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\\r\nServices\\{random service name}\r\nErrorControl = \"0\"\r\nHKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\\r\nServices\\{random service name}\r\nImagePath = \"%System%\\{random number}.tmp\"\r\nHKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\\r\nServices\\{random service name}\r\nDisplayName = \"{random service name}\"\r\nIt adds the following registry entries to enable its automatic execution at every system startup:\r\nhttps://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/conficker\r\nPage 2 of 4\n\nHKEY_CURRENT_USER\\Software\\Microsoft\\\r\nWindows\\CurrentVersion\\Run\r\n{random characters} = \"rundll32.exe {malware path and file name}, Parameter\"\r\nOther System Modifications\r\nThis worm adds the following registry entries as part of its installation routine:\r\nHKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\\r\nWindows\\CurrentVersion\\Applets\r\ndl = \"0\"\r\nHKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\\r\nWindows\\CurrentVersion\\Applets\r\nds = \"0\"\r\nHKEY_CURRENT_USER\\Software\\Microsoft\\\r\nWindows\\CurrentVersion\\Applets\r\ndl = \"0\"\r\nHKEY_CURRENT_USER\\Software\\Microsoft\\\r\nWindows\\CurrentVersion\\Applets\r\nds = \"0\"\r\nIt modifies the following registry entries:\r\nHKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\\r\nServices\\Tcpip\\Parameters\r\nTcpNumConnections = \"00FFFFFE\"\r\n(Note: The default value data of the said registry entry is user-defined.)\r\nHKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\\r\nServices\\BITS\r\nStart = \"4\"\r\n(Note: The default value data of the said registry entry is 2.)\r\nHKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\\r\nServices\\wuauserv\r\nStart = \"4\"\r\n(Note: The default value data of the said registry entry is 2.)\r\nHKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\\r\nWindows\\CurrentVersion\\Explorer\\\r\nAdvanced\\Folder\\Hidden\\\r\nhttps://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/conficker\r\nPage 3 of 4\n\nSHOWALL\r\nCheckedValue = \"0\"\r\n(Note: The default value data of the said registry entry is 1.)\r\nDownload Routine\r\nThis worm connects to the following website(s) to download and execute a malicious file:\r\nhttp://{DGA IP address}/search?q=0\r\nOther Details\r\nThis worm connects to the following URL(s) to get the affected system's IP address:\r\nhttp://www.getmyip.org\r\nhttp://www.whatsmyipaddress.com\r\nhttp://www.whatismyip.org\r\nhttp://checkip.dyndns.org\r\nIt connects to the following time servers to determine the current date:\r\nmyspace.com\r\nmsn.com\r\nebay.com\r\ncnn.com\r\naol.com\r\nw3.org\r\nask.com\r\nyahoo.com\r\ngoogle.com\r\nbaidu.com\r\nSource: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/conficker\r\nhttps://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/conficker\r\nPage 4 of 4\n\nname}\\AppData\\Roaming C:\\Windows\\System32.. on Windows %Program Vista and 7.. %System% Files% is the default is the Windows Program Files folder, system folder, usually C:\\Program which is usually Files in\nWindows 2000, Server 2003, and XP (32-bit), Vista (32-bit), and 7 (32-bit), or C:\\Program Files (x86) in Windows\n Page 1 of 4", "extraction_quality": 1, "language": "EN", "sources": [ "MITRE" ], "origins": [ "web" ], "references": [ "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/conficker" ], "report_names": [ "conficker" ], "threat_actors": [], "ts_created_at": 1775434571, "ts_updated_at": 1775826704, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/fb86d4dd332bbbcb658052885d6daa0d73c766e5.pdf", "text": "https://archive.orkl.eu/fb86d4dd332bbbcb658052885d6daa0d73c766e5.txt", "img": "https://archive.orkl.eu/fb86d4dd332bbbcb658052885d6daa0d73c766e5.jpg" } }