W32/QQHelper.KX!tr.dldr

Analysis

The malware drops the following files:

undefinedSystemDirundefined\-10895.exe
run.exe
file run.exe is dropped in the current folder where the original sample is executed.

The malware applies the following registry modifications

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\
undefinedSystemDirundefined\-10895.exe = "undefinedSystemDirundefined\-10895.exe:*:Enabled:"

It has an approximate size of 66560 to 132096 bytes, since there are many known slight variants in the wild, and they are usually compressed using UPX.

Recommended Action

FortiGate systems:

• check the main screen using the web interface to ensure the latest AV/NIDS database has been downloaded and installed -- if required, enable the " Allow Push Update" option
  

FortiClient systems:

• Quarantine/Delete infected files detected and replace infected files with clean backup copies