W32/MyTob.GB@mm

description-logoAnalysis

  • Drops the following file:
    • undefinedSystemundefined\External.exe
  • Adds the following registry:
    • key: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • value: External Dependencies
    • data: External.exe
  • Email Propagation:
    • Email format:

      • Subject:
      • Email Account Suspension
        
      • Body:
      • Dear [Email Account Domain] Member, 
        
        We have temporarily suspended your email account [UserEmailAddress]. 
        
        This might be due to either of the following reasons: 
        
        1. A recent change in your personal information (i.e. change of address).
        2. Submiting invalid information during the initial sign up process.
        3. An innability to accurately verify your selected option of subscription due to an internal error within our processors.
        See the details to reactivate your [email account domain] account. 
        
        Sincerely,The [Domain] Support Team 
        
        +++ Attachment: No Virus (Clean)
        +++  Antivirus - www.[email account domain]
        
      • Attachment: account-details.zip
  • Attempts to terminate the firewall and other security applications, including antivirus monitors.
  • recommended-action-logoRecommended Action

      FortiGate Systems
    • Check the main screen using the web interface for your FortiGate unit to ensure that the latest AV/NIDS database has been downloaded and installed on your system - if required, enable the "Allow Push Update" option.

    Telemetry logoTelemetry

    Detection Availability

    FortiClient
    Extreme
    FortiMail
    Extreme
    FortiSandbox
    Extreme
    FortiWeb
    Extreme
    Web Application Firewall
    Extreme
    FortiIsolator
    Extreme
    FortiDeceptor
    Extreme
    FortiEDR