RE: Increased Kuang2 activity

Logan F.D. Greenlee wrote Monday, February 10, 2003 13:37

> According to the information out there port 17300 is the control port

Kuang2 is related to a whole family of file infectors carrying backdoors - look for PE_Weird and related. I do not recommend Symantec's site in this particular case - their info is pretty skimpy.

There were updated versions released in mid-2002: http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=PE_WEIRD.D http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=TROJ_KUANG.B (client component only)

Some variant of PE_Weird was also circulating last year as a file infection piggybacking on Klez.(x) infected mail. Most of the variants I know of are file infectors, so they could circulate pretty easily along with any PE file. There may be another new version circulating, and it would still be easy for older versions to find new victims.