W32/Koddro is a mass mailing worm. The worm will infect Windows systems and spreads through email.

The subject of the infected email will be any one of the following;

hello
Re: hello
postcard
how are you?
nissan skyline

The body of the infected email will be any one of the following;

helo dear friend
Hi, Mike, this is Jane
nissan skyline is cool!
You have got the postcard from your friend

The name of the infected attachment will be any one of the following;

cool.scr
work.exe
coolcar.scr
clickme.exe
behappy.scr

Upon execution, the worm executes the file ojsps.exe if present. It creates a mutex named "wkoddr1".

It also gathers the email addresses from the files having the following extensions;

adb, asp, dbx, eml, fpt, inb, mbx, php, pmr, sht, tbb, htm, txt and wab

The worm attempts to steal banking information when the user visits the following URLs:

https://meine.deutsche-bank.de/mod/WebObjects/dbp(Blocked)
https://meine.deutsche-bank.de/mod/WebObjects/dbpb(Blocked)
https://my.hypovereinsbank.de/prot/templates/login_(Blocked)
https://my.hypovereinsbank.de/prot/templates/ind(Blocked)
https://www.dresdner-privat.de/inde(Blocked)
https://www.dresdner-privat.de/inde(Blocked)
https://bankingportal.kreissparkasse-schwalm-eder.de/ban(Blocked)
https://bankingportal.kreissparkasse-schwalm-eder.de/ban(Blocked)
https://bankingportal.sparkasse-koelnbonn.de/ban(Blocked)
https://bankingportal.sparkasse-koelnbonn.de/ban(Blocked)
https://banking.sparkasse-dessau.de/cgi/anfa(Blocked)
https://banking.sparkasse-dessau.de/cgi/log(Blocked)
https://ww2.homebanking-berlin.de/cgi/anfa(Blocked)
https://ww2.homebanking-berlin.de/cgi/log(Blocked)
https://portal.izb.de/ihb/sparkasse-passau/Ma(Blocked)
https://portal.izb.de/ihb/sparkasse-passau/Main;se(Blocked)
https://portal1.izb.de/ihb/sparkasse-miltenberg-obernburg/M(Blocked)
https://portal1.izb.de/ihb/sparkasse-miltenberg-obernburg/Main;se(Blocked)
https://banking.postbank.de/app/legitimat(Blocked)
https://www.seb-banking.de/pt/defau(Blocked)
https://ebanking.spardaban(Blocked)

Then sends the stolen information to the following URLs:

http://217.159.217.222/ctrl/tn(Blocked)
http://217.159.217.222/ctrl/l2(Blocked)

This worm first appeared on December 25, 2006.

 Other names of W32/Koddro Worm:

This Worm is also known as W32.Koddro@mm.