Allaple

Overview

Allaple (also cataloged in threat research as Rahack, Net-Worm.Win32.Allaple, and W32/Allaple) is an infamous, self-propagating polymorphic computer worm first detected in 2006. Engineered to autonomously spread across internal networks and the public internet, Allaple weaponized a critical stack-based buffer overflow in the Windows Server Service (srvsvc.dll) canonicalize routine (CVE-2006-3439 / MS06-040). Operating over SMB TCP ports 139 and 445, Allaple generated massive sweeps of random IP addresses, blasting malicious NetprPathCanonicalize RPC requests that forced target machines to execute injected shellcode without any authentication or user interaction. Allaple is renowned for its advanced polymorphic XOR decryptor engine: upon infecting an executable file or spawning a new network propagation thread, the worm rewrote its entire decryption routine using randomly generated mathematical operations, registers, and junk instructions (NOPs, increment, decrement), fundamentally defeating signature-based antivirus detection at the time. Beyond autonomous propagation, Allaple executed local file infection across all fixed and removable storage drives, modifying PE executables (.exe and .scr) by appending its polymorphic shellcode to file headers. The worm generated such staggering volumes of outbound network scanning packets and ICMP echo requests that it routinely caused catastrophic denial-of-service conditions, collapsing corporate switches, saturating ISP uplinks, and knocking enterprise networks offline.

Known aliases

Threat reports may refer to this family under multiple names:

• Rahack
• Net-Worm.Win32.Allaple
• W32/Allaple
• Worm.Allaple
• Win32.Allaple.A

Family Pedigree & Lineage

Malware authors regularly fork and iterate upon existing codebases. Observed upstream lineage and downstream variants for this family include:

Known Derivatives & Downstream Variants: Allaple_A · Allaple_B · Rahack

MITRE ATT&CK Techniques

This family has been observed using the following ATT&CK techniques: T1210 · T1059 · T1083 · T1547.001 · T1027.002 · T1498

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1059: Restrict execution of scripting languages such as PowerShell, VBScript, or Python to authorized administrators. Enforce Script Block Logging.

MITRE D3FEND™ Defensive Countermeasures

Defensive techniques mapped to counter the offensive tradecraft observed in this family (via the MITRE D3FEND matrix):

Exploited Vulnerabilities (CVEs)

This malware family is documented weaponizing the following common vulnerabilities and exposures:

• CVE-2006-3439 — In-depth exploitation analysis and catalog intelligence (NIST NVD ↗).

Indicators of Compromise

Public indicators drawn from CISA advisories and vendor reporting. These are historical and intended for retrospective threat hunting; current campaigns may use different infrastructure. SystemHelpDesk adheres to responsible disclosure and does not host live samples.

File hashes (SHA-256, sample)

Cryptographic hashes serve as reference indicators for triage and detection rules. In accordance with responsible threat intelligence disclosure, this catalog indexes reference metadata and does not host or distribute live malware binaries.

• 3e62f02cb8594d6e902b115ee877990155b46e38a202722b51ee2bc3a4ea8474
• 88a107ef4ef3b34208a0df70216b3f7f8d689626bc6594c9f187a27eb2a29c15

Delivery vectors

• Autonomous network worm propagation exploiting NetAPI buffer overflow CVE-2006-3439 over SMB TCP port 445
• File infection of PE executables (.exe, .scr) on local and removable USB storage devices

Persistence mechanisms

• Registry Run key under HKLM\Software\Microsoft\Windows\CurrentVersion\Run pointing to dropped copy in %SYSTEM32%
• Infection of existing legitimate system binaries to ensure execution upon user program launch

Tiered Detection Rules (Cisco CAIRN Model)

Modern threat detection requires multi-layered rule engineering. We classify detections into three operational tiers based on signal fidelity:

rule MALWARE_WIN_ALLAPLE_T1_ARTIFACT {
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Allaple"
        tier = "T1 - Primitive Artifact"
        confidence = "Low-Medium (Fast Triage)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        $s1 = "allaple" ascii wide nocase
        $s2 = "rahack" ascii wide nocase
        $s3 = "net-worm.win32.allaple" ascii wide nocase
        $s4 = "w32/allaple" ascii wide nocase
        $s5 = "worm.allaple" ascii wide nocase
        $s6 = "win32.allaple.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

title: SystemHelpDesk Detection - Allaple (Worm) Execution & Triage
id: b785f6bb-e0bb-523c-9323-3d6a7833e021
status: production
description: Detects execution, defense evasion, and persistence behaviors associated
  with the Allaple malware family. Detects suspicious execution from temporary user
  directories with hidden window flags and background transfer utilities.
references:
- https://malware-families-catalog.systemhelpdesk.com/families/allaple
- https://malware-families-catalog.systemhelpdesk.com/defensive/ransomware-protection
- https://malware-families-catalog.systemhelpdesk.com/
author: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP
date: '2026-10-14'
modified: '2026-10-14'
tags:
- attack.worm
- author.ricky-jordan
- source.systemhelpdesk-mfc
- attack.t1210
- attack.t1059
- attack.t1083
- attack.t1547_001
- attack.t1027_002
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \cscript.exe
    - \wscript.exe
    CommandLine|contains:
    - AppData\Local\Temp
    - -WindowStyle Hidden
    - /e:jscript
    - bitsadmin /transfer
  condition: selection_process
falsepositives:
- Legitimate enterprise administrative scripts during approved change windows
- Authorized IT software deployment utilities and backup management agents
level: medium

rule MALWARE_WIN_ALLAPLE_T3_ATTRIBUTION {
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Allaple tradecraft"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        // Core family identifier & heuristic payload signatures
        $attrib_str = "allaple" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker = "http" ascii nocase
    condition:
        uint16(0) == 0x5a4d and ($attrib_str and $net_marker) and filesize < 15MB
}

References & External Analysis

• Microsoft Security Bulletin MS06-040: Vulnerability in Server Service
• F-Secure Threat Intelligence: Allaple Worm Profile
• Symantec Threat Report: W32.Allaple Technical Analysis
• Search "allaple" on VirusTotal (External Analysis)
• Search "allaple" on Any.Run (Sandbox Sandbox)
• Search "allaple" on MalwareBazaar (Malware Samples)

Frequently Asked Questions

Related Threats (Category: Worm)

Explore other documented threats in the same operational category:

• Ngrbot
• Blasterx
• Sfone
• Perinet
• Sytro
• Sasser
• Pykspa
• Brambul

Machine-readable

Get this profile as JSON: https://malware-families-catalog.systemhelpdesk.com/api/allaple.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.