Virus

W32/Agent.NAB!tr

Analysis

Copies itself to:

undefinedSYSTEMundefined\adirss.exe

Adds the following registry:

key: HKLM\Software\Microsoft\Windows\CurrentVersion\Run
value: sysinter
data: undefinedSYSTEMundefined\adirss.exe

Calls the following command to bypass the Windows firewall:

netsh firewall set allowedprogram "undefinedSYSTEMundefined\adirss.exe" enable

Creates an SMTP server and listens to the localhost port 25.

Recommended Action

FortiGate Systems

Check the main screen using the web interface for your FortiGate unit to ensure that the latest AV/NIDS database has been downloaded and installed on your system - if required, enable the "Allow Push Update" option.

Detection Availability

FortiClient
Extreme
FortiMail
Extreme
FortiSandbox
Extreme
FortiWeb
Extreme
Web Application Firewall
Extreme
FortiIsolator
Extreme
FortiDeceptor
Extreme
FortiEDR