W32/Wauchos.A!tr.dldr

Analysis

• Upon execution, it drops the following copy of itself:
  
  • undefinedAllUsersProfileundefined\svchost.exe


• The malware creates the following registry to automatically execute itself during system startup:
  
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    
    • SunJavaUpdateSched = "undefinedAllUsersProfileundefined\svchost.exe"


• The malware was observed to listen to port 8000.


• It disguises itself as a program related to a printer application from Seiko Epson.

Recommended Action

FortiGate Systems

• Check the main screen using the web interface for your FortiGate unit to ensure that the latest AV/NIDS database has been downloaded and installed on your system - if required, enable the "Allow Push Update" option.

• Quarantine/delete files that are detected and replace infected files with clean backup copies.