Home / malware

PDF

Worm:AutoIt/Helompy.A

First posted on 16 June 2010.
Source: SecurityHome

Aliases :

Worm:AutoIt/Helompy.A is also known as Mal_SHND-4 (Trend Micro), Trojan-Spy.Win32.KeyLogger.cor (Kaspersky), W32.Imaut (Symantec).

Explanation :

Worm:AutoIt/Helompy.A is a worm - a self-propagating program that can spread itself from one computer to another. Worms may spread themselves via a variety of different channels in order to compromise new machines. Commonly, worms may spread directly by copying themselves to removable or network drives, or by attempting to exploit particular vulnerabilities on targeted machines. Worms also often attempt to spread via platforms that require user interaction in order to run. They may send themselves as an attachment to an email or an instant message, or send a link to a copy of themselves in the body of a message. In these cases the message needs to be convincing enough to encourage the victim to click on the link or attachment and run or download a copy of the worm.
Top

Worm:AutoIt/Helompy.A is a worm - a self-propagating program that can spread itself from one computer to another. Worms may spread themselves via a variety of different channels in order to compromise new machines. Commonly, worms may spread directly by copying themselves to removable or network drives, or by attempting to exploit particular vulnerabilities on targeted machines. Worms also often attempt to spread via platforms that require user interaction in order to run. They may send themselves as an attachment to an email or an instant message, or send a link to a copy of themselves in the body of a message. In these cases the message needs to be convincing enough to encourage the victim to click on the link or attachment and run or download a copy of the worm. Installation When executed, Worm:AutoIt/Helompy.A copies itself to c:\win\lsass.exe.
The malware modifies the following registry entry/ies to ensure that its copy executes at each Windows start: Adds value: "run32"
With data: "c:\win\lsass.exe"
To subkey: HKLM\Software\Microsoft\Windows\CurrentVersion\Run
The malware creates the following file(s) on an affected machine:

c:\documents and settings\administrator\local settings\temp\aute.tmp

c:\win\names.txt

Spreads via€¦ Removable drives Worm:AutoIt/Helompy.A copies itself to the following location/s on removable drives:
<targeted drive>:\subst.exe.

It also places an autorun.inf file in the root directory of the targeted drive. Such autorun.inf files contain execution instructions for the operating system, so that when the removable is accessed from another machine supporting the Autorun feature, the malware is launched automatically. Note: this worm was observed to write an executable and create an autorun.inf file on a targeted drive in our automated testing environment. This is particularly common malware behavior, generally utilized in order to spread malware from machine to machine. It should also be noted that autorun.inf files on their own are not necessarily a sign of infection, as they are used by legitimate programs and installation CDs.
This malware description was produced and published using our automated analysis system's examination of file SHA1 50b5a175adda3b67e8dc6417029fa7223582e9d1. If you would like to comment on this analysis, please send your feedback to mmpc-amd@microsoft.com.

Last update 16 June 2010

 

TOP