Kido

Overview

Worm:Win32/Kido (universally known in the cybersecurity community as **Conficker**) is one of the most infamous, widespread, and devastating computer worms in history. First detected in late 2008, it rapidly infected millions of Windows computers globally, including critical government, military, and corporate infrastructure. It is famous for its aggressive self-propagation mechanisms, its pioneering use of a Domain Generation Algorithm (DGA) for command-and-control, and its ability to completely disable Windows security services.

Understanding the Conficker (Kido) Worm
To an end-user, a Conficker infection might result in the inability to access security vendor websites (e.g., microsoft.com, symantec.com) and account lockouts. For a network administrator, Conficker is a nightmare; it causes massive network congestion due to its aggressive scanning and creates a highly resilient botnet capable of receiving arbitrary payloads from its masters. It proved how devastating a worm utilizing a known, unpatched vulnerability could be.

Execution and Unprecedented Spreading Mechanics
Conficker primarily spreads by exploiting **MS08-067**, a critical vulnerability in the Windows Server service (`T1210`). It actively scans the local subnet and the internet for unpatched machines, sending a crafted RPC request that triggers a buffer overflow, allowing it to execute code remotely and install itself without user interaction. It also spreads via USB drives using deceptive `autorun.inf` files (`T1091`) and attempts to brute-force network file shares using weak administrator passwords (`T1110.001`). Once installed, it drops itself as a randomly named DLL (e.g., `C:\Windows\System32\xxyyzz.dll`) and registers itself as a hidden Windows service (`svchost.exe`) (`T1543.003`). To prevent removal, it terminates AV processes, blocks access to security websites via DNS poisoning, and disables Windows AutoUpdate (`T1562.001`). Crucially, to receive updates and commands, later variants generated up to 50,000 pseudo-random domain names a day (DGA), making it incredibly difficult for authorities to sinkhole the C2 infrastructure (`T1568.002`).

Indicators of Compromise & Impact
The impact was the creation of the largest botnet in history at the time, and severe network disruption. Host-based IoCs include EDR alerts for anomalous DLLs loading into `svchost.exe` (specifically the `netsvcs` group), the inability to access Windows Update, and sudden Account Lockout events across the domain as the worm attempts lateral movement. Network IoCs include massive spikes in outbound port 445 (SMB) traffic (scanning) and thousands of DNS requests for non-existent, randomly generated domains.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_KIDO {
    meta:
        description = "Detects Kido (advanced_threat)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "kido" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Kido Activity
id: 48fee25d4f16349a6fd250bd0a6d4e8d
status: experimental
description: Detects generic indicators of the kido malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*kido*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Isolate infected segments immediately; Conficker spreads autonomously at high speed via SMB over the local network.
2. Ensure the MS08-067 patch (and all subsequent critical SMB patches) is applied universally across the enterprise.
3. Implement strong Account Lockout policies and ensure local Administrator passwords are unique across all workstations (e.g., using Microsoft LAPS) to halt SMB brute-forcing.
4. Use specialized Conficker removal tools, as the worm aggressively defends itself against manual removal and standard AV scans.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not assume the network is clean until every single machine has been verified and patched; a single unpatched machine will re-infect the entire network.
2. Avoid leaving default open file shares or weak passwords on network drives, as Conficker will rapidly exploit them to spread.

References & External Analysis

• Search "kido" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: advanced_threat)

Explore other malware families in the same category:

• Joosoft
• Rpcdcom
• Chisburg
• Asktoolbar
• Uniblue

Machine-readable

Get this profile as JSON: https://jordan123234-malware-families-explorer.static.hf.space/api/kido.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.