virus logo Virus

W32/Agent.AUH!tr

description-logoAnalysis

  • Deletes the original file after execution.

  • Copies itself to the Windows Temporary folder.

  • Creates a new file under the System folder.

  • Starts IEXPLORE.EXE using an established link with a remote server.

  • Adds the following registry:
    • key: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • value: startdrv
    • data: C:\undefinedWINDOWSundefined\Temp\startdrv.exe

    recommended-action-logoRecommended Action

      FortiGate Systems
    • Check the main screen using the web interface for your FortiGate unit to ensure that the latest AV/NIDS database has been downloaded and installed on your system - if required, enable the 'Allow Push Update' option.
      FortiClient Systems
    • Quarantine/delete files that are detected and replace infected files with clean backup copies.

    Telemetry logoTelemetry

    Detection Availability

    FortiGate
    Extreme
    FortiClient
    Extended
    FortiMail
    Extended
    FortiSandbox
    Extended
    FortiWeb
    Extended
    Web Application Firewall
    Extended
    FortiIsolator
    Extended
    FortiDeceptor
    Extended
    FortiEDR

    Version Updates

    Date Version Detail
    2020-06-02 77.87200 Sig Updated
    2020-03-12 75.91600 Sig Updated
    2020-03-12 75.90500 Sig Added
    2019-12-10 73.69300 Sig Updated
    2019-10-18 72.41100 Sig Added
    2019-08-27 71.17600 Sig Updated
    2019-07-14 69.97500 Sig Added
    2019-01-29 65.99600 Sig Updated
    2018-12-28 65.22800 Sig Added
    ID 280313
    Released Jul 27, 2007
    Description
    Updated    		 Jul 30, 2007
    Aliases Trojan.Win32.Agent.auh; W32/Downldr2.AOUA; Troj/Agent-FZG; Trojan.Kobcka.A
    Platform Profile Win32 file format / PE 32 bit