Home / malware

PDF

Worm:MSIL/Autorun.AD

First posted on 20 May 2015.
Source: Microsoft

Aliases :

There are no other names known for Worm:MSIL/Autorun.AD.

Explanation :

Threat behavior

Installation
This threat can create files on your PC, including:

• %SystemRoot%\tasks\system32.exe

It modifies the registry so that it runs each time you start your PC. For example:

In subkey: HKCU\software\microsoft\windows\currentversion\run
Sets value: "%SystemRoot%\Tasks\system32.exe"
With data: "%SystemRoot%\tasks\system32.exe"



Spreads through...


Network and removable drives

This worm can spread by creating files on network or removable drives, such as USB flash drives. For example:

• :\very important.exe
• :\new folder 2.exe
• :\subst.exe

Payload


Connects to a remote host

We have seen this threat connect to a remote host, including:

• thevampire_vvv.byethost32.com using port 80

Malware can connect to a remote host to do any of the following:

• Check for an Internet connection
• Download and run files (including updates or other malware)
• Report a new infection to its author
• Receive configuration or other data
• Receive instructions from a malicious hacker
• Search for your PC location
• Upload information taken from your PC
• Validate a digital certificate

This malware description was published using automated analysis of file SHA1 8b91a54ec33a93139acdecb06898e72988630ca2.

Symptoms

The following can indicate that you have this threat on your PC:

• You see a file similar to:
  • %SystemRoot%\tasks\system32.exe

• You see registry modifications such as:
  
  • In subkey: HKCU\software\microsoft\windows\currentversion\run
    Sets value: "%SystemRoot%\Tasks\system32.exe"
    With data: "%SystemRoot%\tasks\system32.exe"

Last update 20 May 2015

 

TOP