Avira Virus Lab

Worm/Katar.A.11

  • Name
    Worm/Katar.A.11
  • Date discovered
    Feb 7, 2016
  • Type
    Malware
  • Impact
    High 
  • Reported Infections
    Low 
  • Operating System
    Windows
  • VDF version
    7.11.78.190 (2013-05-15 15:24)

Stay safe from all these threats with Avira Free Antivirus.

Avira Free Antivirus Download Free

The term 'WORM' denotes a worm that is able to spread itself, for instance, over the Internet (using email, peer-to-peer networks, or IRC networks, etc.).

The file can be used by rogue users or malware to lower security settings.

This piece of malware is able to steal sensitive information.

Operating System: Microsoft Windows.

  • VDF
    7.11.78.190 (2013-05-15 15:24)
  • Aliases
    Avast: Win32:AutoRun-CLF
    AVG: Luhe.Fiha.A
    ClamAV: Trojan.Peed-474
    Dr. Web: Trojan.MulDrop3.2966
    F-PROT: W32/Autorun.TX (exact, damaged)
    McAfee: W32/Autorun.worm.bcb
    Trend Micro: TROJ_SPNR.03J013
    Microsoft: Trojan:Win32/Bulta!rfn
    G Data: Worm.Generic.355075
    Kaspersky Lab: Worm.Win32.AutoIt.aei
    Bitdefender: Worm.Generic.355075
    ESET: Win32/AutoRun.Autoit.BJ worm
  • Files
    The following files are deleted:
    • %DISKDRIVE%\KHATRA.exe
    • %SYSDIR%\KHATRA.exe
    • %WINDIR%\Xplorer.exe
    • %WINDIR%\system\gHost.exe
    • %WINDIR%\KHATARNAKH.exe
    • %TEMPDIR%\aut1.tmp
    • %TEMPDIR%\aut2.tmp
    • %TEMPDIR%\bikini02.scr
    • %TEMPDIR%\%USERNAME%.scr
    • %TEMPDIR%\Nature.scr
    • %TEMPDIR%\fhset267.exe
    • %TEMPDIR%\dmario.exe
    • %TEMPDIR%\kavSetup.exe
    • %TEMPDIR%\download.exe
    • %TEMPDIR%\Hacker.exe
    • %TEMPDIR%\clean.exe
    • %TEMPDIR%\slideshow.exe
    The following copies of itself are created:
    • %DISKDRIVE%\KHATRA.exe
    • %SYSDIR%\KHATRA.exe
    • %WINDIR%\Xplorer.exe
    • %WINDIR%\system\gHost.exe
    • %WINDIR%\KHATARNAKH.exe
    • %USERPROFILE%\Local Settings\Application Data\Microsoft\CD Burning\KHATRA.exe
    • %USERPROFILE%\Local Settings\Application Data\Microsoft\CD Burning\%USERNAME%.exe
    • %USERPROFILE%\Local Settings\Application Data\Microsoft\CD Burning\New Folder(3).exe
    • %USERPROFILE%\My Documents\My Music\My Music.exe
    • %USERPROFILE%\My Documents\My Music.exe
    • %USERPROFILE%\My Documents\My Pictures\My Pictures.exe
    • %USERPROFILE%\My Documents\My Pictures.exe
    • %TEMPDIR%\bikini02.scr
    • %TEMPDIR%\%USERNAME%.scr
    • %TEMPDIR%\Nature.scr
    • %TEMPDIR%\fhset267.exe
    • %TEMPDIR%\dmario.exe
    • %TEMPDIR%\kavSetup.exe
    • %TEMPDIR%\download.exe
    • %TEMPDIR%\Hacker.exe
    • %TEMPDIR%\clean.exe
    • %TEMPDIR%\slideshow.exe
    The following files are created:
    • %DISKDRIVE%\Documents and Settings\All Users\Start Menu\Programs\Startup\(Empty).LNK
    • %WINDIR%\inf\Autoplay.inF
    • %WINDIR%\Tasks\At1.job
    • %WINDIR%\Tasks\At2.job
    • %USERPROFILE%\Local Settings\Application Data\Microsoft\CD Burning\AUTORUN.inF
    • %TEMPDIR%\aut1.tmp
    • %TEMPDIR%\aut2.tmp
    The following files are changed:
    • %DISKDRIVE%\Documents and Settings\All Users\Start Menu\Programs\Startup\(Empty).LNK
    • %WINDIR%\inf\Autoplay.inF
    • %SYSDIR%\wbem\Logs\wbemess.log
    • %WINDIR%\Prefetch\REGSVR32.EXE-25EEFE2F.pf
    • %SYSDIR%\wbem\Logs\wbemcore.log
    • %WINDIR%\Prefetch\IMAPI.EXE-0BF740A4.pf
    • %SYSDIR%\CatRoot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb
    • %WINDIR%\Prefetch\WMIADAP.EXE-2DF425B2.pf
    • %SYSDIR%\CatRoot2\edb.chk
    The following files are renamed:
    • %DISKDRIVE%\Documents and Settings\All Users\Start Menu\Programs\Startup\desktop.ini
    • %USERPROFILE%\Start Menu\Programs\Startup\desktop.ini
    • %USERPROFILE%\Start Menu\Programs\Startup\rpcapd.lnk
    • %TEMPDIR%\kma49549.tmp
    • %TEMPDIR%\kma30541.tmp
    • %TEMPDIR%\kma31189.tmp
    • %TEMPDIR%\kma41155.tmp
    • %TEMPDIR%\kma24660.tmp
    • %TEMPDIR%\kma49309.tmp
    • %TEMPDIR%\kma35098.tmp
    • %TEMPDIR%\kma53906.tmp
    • %TEMPDIR%\kma39924.tmp
    • %TEMPDIR%\kma16403.tmp
  • Registry
    The following registry entries are added:
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon ("Taskman": "%SYSDIR%\KHATRA.exe")
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ("Xplorer": ""%WINDIR%\Xplorer.exe" /Windows"; "VMware User Process": "%SYSDIR%\KHATRA.exe")
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run ("G_Host": ""%WINDIR%\System\gHost.exe" /Reproduce")
    • HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows ("Load": "%SYSDIR%\KHATRA.exe")
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System ("DisableRegistryTools": dword:00000001)
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer ("NoControlPanel": dword:00000001; "NoDriveTypeAutoRun": dword:000000ff)
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL ("CheckedValue": dword:00000000)
    • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main ("Window Title": "Internet Exploiter")
    • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Schedule ("AtTaskMaxHours": dword:00000000)
    • HKEY_CURRENT_USER\Software\Nico Mak Computing\WinZip\caution ("NoUnsafeTypeCautionForSCR": "1"; "NoUnsafeTypeCautionForEXE": "1")
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon ("Taskman": "%SYSDIR%\KHATRA.exe")
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run ("G_Host": ""%WINDIR%\System\gHost.exe" /Reproduce")
    • HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows ("Load": "%SYSDIR%\KHATRA.exe")
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System ("DisableRegistryTools": dword:00000001)
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer ("NoControlPanel": dword:00000001; "NoDriveTypeAutoRun": dword:000000ff)
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL ("CheckedValue": dword:00000000)
    • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main ("Window Title": "Internet Exploiter")
    • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Schedule ("AtTaskMaxHours": dword:00000000)
    • HKEY_CURRENT_USER\Software\Nico Mak Computing\WinZip\caution ("NoUnsafeTypeCautionForSCR": "1"; "NoUnsafeTypeCautionForEXE": "1")
    • HKEY_LOCAL_MACHINE\SOFTWARE\KHATRA\Startup_List ("FileZilla Server Interface": ""%PROGRAM FILES%\FileZilla Server\FileZilla Server Interface.exe""; "VMware Tools": ""%PROGRAM FILES%\VMware\VMware Tools\VMwareTray.exe""; "VMware User Process": ""%PROGRAM FILES%\VMware\VMware Tools\vmtoolsd.exe" -n vmusr"; "Adobe Reader Speed Launcher": ""%PROGRAM FILES%\Adobe\Reader 9.0\Reader\Reader_sl.exe""; "Adobe ARM": ""%PROGRAM FILES%\Common Files\Adobe\ARM\1.0\AdobeARM.exe""; "SunJavaUpdateSched": ""%PROGRAM FILES%\Common Files\Java\Java Update\jusched.exe""; "Xplorer": ""%WINDIR%\Xplorer.exe" /Windows")
    • HKEY_LOCAL_MACHINE\SOFTWARE\KHATRA\Startup_List ("FileZilla Server Interface": ""%PROGRAM FILES%\FileZilla Server\FileZilla Server Interface.exe""; "VMware Tools": ""%PROGRAM FILES%\VMware\VMware Tools\VMwareTray.exe""; "VMware User Process": ""%PROGRAM FILES%\VMware\VMware Tools\vmtoolsd.exe" -n vmusr"; "Adobe Reader Speed Launcher": ""%PROGRAM FILES%\Adobe\Reader 9.0\Reader\Reader_sl.exe""; "Adobe ARM": ""%PROGRAM FILES%\Common Files\Adobe\ARM\1.0\AdobeARM.exe""; "SunJavaUpdateSched": ""%PROGRAM FILES%\Common Files\Java\Java Update\jusched.exe""; "Xplorer": ""%WINDIR%\Xplorer.exe" /Windows")
    • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ServiceCurrent (@: dword:0000000f)
    • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_IMAPISERVICE\0000\Control ("ActiveService": "ImapiService")
    • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Epoch ("Epoch": dword:0000001e)
    The following registry entries are changed:
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced ("Hidden": dword:00000000)
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ("Xplorer": ""%WINDIR%\Xplorer.exe" /Windows"; "VMware User Process": "%SYSDIR%\KHATRA.exe"; "VMware Tools": "%WINDIR%\Xplorer.exe")
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced ("Hidden": dword:00000000)
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher ("TracesProcessed": dword:00000027; "TracesSuccessful": dword:0000000e; "LastTraceFailure": dword:00000004)
    • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Schedule ("NextAtJobId": dword:00000003)
    • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\wscsvc ("Start": dword:00000004)
    • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ProtectedStorage ("Start": dword:00000004)
    • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\upnphost ("Start": dword:00000002)
    • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\mnmsrvc ("Start": dword:00000002)
    • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RDSessMgr ("Start": dword:00000002)
    • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NtmsSvc ("Start": dword:00000002)
    • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TermService ("Start": dword:00000002)
    • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TlntSvr ("Start": dword:00000002)

Help make the web safer by sending us suspicious files/URLs to analyze

Submit your file/URL or Go to support.avira.com

Why submit a suspicious file?

If you encountered a suspicious file or website that’s not in our database, we’ll analyze it and determine whether it’s harmful. Our findings are then pushed out to our millions of users with their next virus database update. If you have Avira, you’ll get that update too. Don’t have Avira? Get it on our homepage.