MSIL/Wauchos.AF!tr

description-logoAnalysis


  • It drops a copy of itself to the All Users' Profile folder using a randomized name.

  • The following registry modifications are applied:
    • HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
      • [RandomRegistryValue] = undefinedAllUsersProfileundefined\[RandomFileName].exe
        This registry entry enables its dropped copy to be automatically executed.

  • It has been observed to perform DNS queries on the following names:
    • dd{Removed}10.ru
    • dn{Removed}2.ru

  • This malware disguises itself by using a JPEG icon.

recommended-action-logoRecommended Action

  • Make sure that your FortiGate/FortiClient system is using the latest AV database.
  • Quarantine/delete files that are detected and replace infected files with clean backup copies.

Telemetry logoTelemetry

Detection Availability

FortiClient
Extreme
FortiMail
Extreme
FortiSandbox
Extreme
FortiWeb
Extreme
Web Application Firewall
Extreme
FortiIsolator
Extreme
FortiDeceptor
Extreme
FortiEDR

Version Updates

Date Version Detail
2022-10-31 90.07413
2022-10-03 90.06554
2022-06-21 90.03462
2022-01-04 89.08396
2021-11-30 89.07343
2021-06-15 86.00934
2020-01-21 74.70000 Sig Updated