Worm.Win32.AutoItGen_681abfdb24

by malwarelabrobot on June 29th, 2017 in Malware Descriptions.

AIT:Trojan.Agent.CFSH (BitDefender), Backdoor:Win32/NetWiredRC.D (Microsoft), Trojan.MSIL.Agent.fowh (Kaspersky), Trojan.Win32.Generic!BT (VIPRE), Trojan.DownLoader20.41166 (DrWeb), AIT:Trojan.Agent.CFSH (B) (Emsisoft), Artemis!681ABFDB247B (McAfee), Trojan.Lodarat (Symantec), Trojan.MSIL.Krypt (Ikarus), AIT:Trojan.Agent.CFSH (FSecure), AutoIt:Agent-ANZ [Trj] (AVG), AutoIt:Agent-ANZ [Trj] (Avast), TSPY_INFOSTEAL.SM (TrendMicro), Trojan.Win32.Swrort.3.FD, Worm.Win32.AutoIt.FD, WormAutoItGen.YR (Lavasoft MAS)
Behaviour: Trojan, Backdoor, Worm

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

Dynamic Analysis

Static Analysis

Network Activity

Map

Strings from Dumps

Removals

MD5: 681abfdb247b295ec1ac593db13cb5f6
SHA1: 26ea411c346f30143d2bd9c824ed765462ee52d5
SHA256: 00921c8e0faa408b303bd5d17d777115c4f84b3e319b4421f904f00d418868e6
SSDeep: 49152:swWgbORbl2XLlNqPIYPcG9zn4SLDDQ4J2RCXcl:gRbWLlsPjTnfxYYsl
Size: 2686814 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: MicrosoftVisualC, NETexecutable, UPolyXv05_v6
Company: no certificate found
Created at: 2017-06-01 18:59:45
Analyzed on: Windows7 SP1 32-bit

Summary:

Worm. A program that is primarily replicating on networks or removable drives.

Payload

No specific payload has been found.

Process activity

The Worm creates the following process(es):

filename.exe:2824
filename.exe:312
filename.exe:3172
xcopy.exe:2432
javaw.exe:3740
rundll32.exe:2628
WWWire.exe:1588
Host.exe:3896
%original file name%.exe:452

The Worm injects its code into the following process(es):

IM000.exe:1600
filename.exe:3736
javaw.exe:632
java.exe:2232
java.exe:1604

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process IM000.exe:1600 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Imminent\Logs\28-06-2017 (162 bytes)

The process filename.exe:2824 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JBDOC.jar (484 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WWWire.exe (176 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IM000.exe (704 bytes)

The process filename.exe:3736 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PIGPIK.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Skyp\DQARUY.exe (18394 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\bafrjeu (3193 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\checkip[1].htm (6513 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aut2D95.tmp (1825 bytes)