TR/Autoit.X - Trojan

See also

Summary

Full description

Statistics

Virus:	TR/Autoit.X
Date discovered:	24/10/2006
Type:	Trojan
In the wild:	No
Reported Infections:	Low
Distribution Potential:	Low to medium
Damage Potential:	Low to medium
Static file:	Yes
File size:	184.830 Bytes
MD5 checksum:	49f1472c7d714b55675c4787c65e8b4f
VDF version:	6.36.00.154 - Tue, 24 Oct 2006 08:00 (GMT+1)
IVDF version:	6.36.00.171 - Thu, 26 Oct 2006 11:21 (GMT+1)

General Method of propagation:
   • Messenger

Aliases:
   • Mcafee: W32/YahLover.worm
   • Kaspersky: Trojan.Win32.Autoit.x
   • Sophos: Troj/Tiotua-A
   • VirusBuster: Trojan.KeySpyLog.H
   • Bitdefender: Win32.Worm.Sohanat.E

Platforms / OS:
   • Windows 95
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003

Side effects:
   • Downloads a file
   • Registry modification

Files – The location is the following:
• http://chendang.net/nguyen/**********
It is saved on the local hard drive under: %WINDIR%\taskmng.exe At the time of writing this file was not online for further investigation.

Registry The following registry key is added in order to run the process after reboot:

– HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
   • "Task Manager"="%WINDIR%\taskmng.exe"

The following registry keys are added:

– HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
   • "DisableTaskMgr"=dword:00000001
   • "DisableRegistryTools"=dword:00000001

– HKCU\Software\Microsoft\Internet Explorer\Main
   • "Window Title"="Lam dc gi khi gio la con so 0 ..."

– HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel
   • "Homepage"=dword:00000001

The following registry keys are changed:

– HKCU\Software\yahoo\pager\View\YMSGR_Launchcast
   New value:
   • "content url"="http://chendang.net/nguyen/"

– HKCU\Software\yahoo\pager\View\YMSGR_buzz
   New value:
   • "content url"="http://chendang.net/nguyen/"

– HKCU\Software\Microsoft\Internet Explorer\Main
   New value:
   • "Start Page"="http://chendang.net/nguyen/"

Messenger It is spreading via Messenger. The characteristics are described below:

– Yahoo Messenger

To:
All entries in the contact list.

Message
The sent message looks like one of the following:

   • Ai muon diet virut thi` vao day, ba` kon du`ng co' click vao nhung site khac nhe ... http://chendang.net/**********

   • Bay gio` bu`n wa' chang biet lam gi` , gui? ta.ng ba kon trang nay vao choi... http://chendang.net/**********

   • Cha` cha` !!! Ai ma` bi con virus thi` vao day ma` diet no diiiiii ... http://chendang.net/**********

   • Con gai nha ai ma` xinh the ko biet nua~ , dep ghe vao day di ... http://chendang.net/**********

   • Dem nay ko co em , dem dai bong nhien day hon huhu :((... http://chendang.net/**********

   • Gio phai lam gi tiep theo day pa kon giup tui voi ... http://chendang.net/**********

   • Me kiep ghet nhat la thang nao` ma` choi con virut do' , ai bi vao day xoa no nhe'... http://chendang.net/**********

   • Nha'm chen dang an ti`nh nay ma lo`ng nguoi nao co hay !!! Van biet yeu thuong la` tro` dua` ma` minh van me say ;))... http://chendang.net/**********

   • Tha nguoi dung noi se yeu minh toi mai thoi thi gio day toi se vui hon. Gio nguoi lac loi buoc chan ve noi xa xoi, cay dang chi rieng minh toi... http://chendang.net/**********

   • Toi di lang thang lan trong bong toi buot gia, ve dau khi da mat em roi? Ve dau khi bao nhieu mo mong gio da vo tan... Ve dau toi biet di ve dau? http://chendang.net/**********

At the time of analysis the file was not online anymore.

The received messages may look like the following:

File details Programming language:
The malware program was written in MS Visual C++.

Runtime packer:
In order to aggravate detection and reduce size of the file it is packed with the following runtime packer:
• UPX

See a brief description here.

Description inserted by Ionut Slaveanu on Thu, 28 Sep 2006 11:10 (GMT+1)
Description updated by Andrei Ivanes on Mon, 27 Nov 2006 15:55 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back