W32/Kullan-A is a complex worm with backdoor functionality that targets
available network shared resources.
When executed the worm copies itself to the Windows system folder with the
filename Services.exe and sets the following registry entries:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
or
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\load
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\run
and adds the full path to Services.exe to:
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell
Running as a background process the worm uses the "net view" command to be
able to drop the copy to the Start Menu folder of the available computer using
the computer name as a filename.
As a backdoor the worm provides access to such confidential information
as OS type, keystroke logs and email details.
The worm may also change the Win.ini and System.ini files to make sure it
will be executed at the next restart.