Signature Detail

WORM: Dabber TFTP File Transfer

This signature detects attempts by the Dabber worm to transfer itself to a target computer using TFTP. The Dabber worm infects targets already infected by the Sasser worm; this signature detects Dabber's fourth stage infection process. If this signature is detected in your network traffic, the target computer is infected with the Dabber worm and the attacking (requesting) computer is most likely infected with both the Sasser and Dabber worms.

Extended Description

WORM_DABBER.A is a worm that exploits a vulnerability in the FTP server component of Sasser worm. It opens a backdoor, modifies the Windows registry, and installs a TFTP server on a target system.

References

• URL: http://www.lurhq.com/dabber.html