Klez

Overview

Worm:Win32/Klez is a historic, highly destructive mass-mailing worm that first appeared in late 2001 and raged across the internet for years. Klez fundamentally changed the landscape of malware by being one of the first major worms to utilize **'Sender Spoofing'**. By forging the 'From:' address in its emails, it caused massive confusion, resulting in innocent users being accused of spreading the virus, and making the true source of the infection incredibly difficult to track down.

Understanding the Klez Worm
To an infected user, the computer might slow down, and their antivirus software would suddenly stop working. To the rest of the world, it appeared as if everyone was emailing the virus to everyone else. For security analysts, Klez represents the peak of the mass-mailing worm era. It was highly aggressive, exploiting an unpatched vulnerability in Microsoft Outlook/Internet Explorer that allowed the malicious attachment to execute *automatically* just by viewing the email in the preview pane.

Propagation and Spoofing Mechanics
The infection cycle begins when a victim receives a seemingly legitimate email containing the Klez executable. It exploited the `IFRAME` vulnerability (CVE-2001-0154) (`T1190`) to execute without user interaction (`T1204`). Upon execution, Klez drops itself into the Windows System folder and establishes persistence (`T1547.001`). Its core function is propagation (`T1534`). It scans the victim's hard drive for email addresses (in address books, cached web pages, and documents). When sending a copy of itself, Klez randomly selects an address from the victim's address book to place in the 'To:' field, and crucially, selects *another* random address to place in the 'From:' field (Sender Spoofing). Furthermore, Klez actively attempts to disable and delete dozens of popular antivirus programs to ensure its survival (`T1562.001`).

Indicators of Compromise & Impact
The primary impact was massive network congestion, reputational damage due to spoofing, and the disabling of endpoint security. The most glaring IoC is an overwhelming surge in outbound SMTP traffic on port 25 originating from the endpoint. Host-based IoCs include EDR alerts for the sudden, forceful termination of antivirus processes and the creation of randomly named executables in the `%SystemRoot%`.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_KLEZ {
    meta:
        description = "Detects Klez (advanced_threat)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "klez" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Klez Activity
id: d66118deb007508795d00042b53402a8
status: experimental
description: Detects generic indicators of the klez malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*klez*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Isolate the endpoint from the network immediately to halt the mass-mailing engine and stop the outbound flood of infected emails.
2. Block outbound SMTP (Port 25) traffic at the enterprise firewall for all workstations, ensuring only authorized mail servers can send email.
3. Ensure the endpoint's antivirus is actually running, as Klez explicitly targets and disables security software.
4. Deploy the MS01-020 (or cumulative) patch for Internet Explorer to prevent the automatic execution vulnerability.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not trust the 'From:' address of a Klez-infected email; the person listed there is almost certainly innocent and likely not the source of the infection.
2. Avoid assuming the threat is modern; Klez relies on early 2000s exploits, so an infection indicates severely outdated software.

References & External Analysis

• Search "klez" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: advanced_threat)

Explore other malware families in the same category:

• Iobit
• Lollipop
• Brosafe
• Eorezo
• Gameol

Machine-readable

Get this profile as JSON: https://jordan123234-malware-families-explorer.static.hf.space/api/klez.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.