AutoRun.AVRN is a Trojan. A Trojan is a program that pretends to have a valid use, but in fact modifies the user's computer in malicious way. Trojans do not replicate or spread to other computers. AutoRun.AVRN is compressed using the executable packer and its file size is 12,288 bytes. It uses the network connection: - Connects to "u1d.smo7he.com" on port 1661 (TCP).
- Connects to IRC Server.
AutoRun.AVRN drops the following files on the hard drive: - C:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\Desktop.ini (62 bytes)
- C:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\SYS83.exe (12288 bytes)
It creates the following mutex to ensure only one instance is running: \xf6\xdc\xd6\x96\x90\xe1\xd7\xcc\xd3\xc0\xd7\x94\x96. It also attempts to acquire the "SeDebugPrivilege" privileges, monitors the list of running processes.
|
