W32/GenKryptik.AWXD!tr

Analysis

W32/GenKryptik.AWXD!tr is a generic detection for a trojan. Since this is a generic detection, malware that are detected as W32/GenKryptik.AWXD!tr may have varying behaviour.
Below are examples of some of these behaviours:

• This malware drops the following files:
  
  • undefinedAppDataundefined\subfolder\filename.exe : This file is detected as W32/GenKryptik.AWXD!tr.
  • undefinedAppDataundefined\sysfile\core.exe : This file is detected as W32/GenKryptik.AWXD!tr.
  • undefinedAppDataundefined\install\host.exe : This file is a copy of the original malware itself.
  • undefinedTempundefined\[Random].bat : This file is detected as BAT/Small.NAN!tr.
  • undefinedAppDataundefined\pid.txt : This text file contains the Process ID for the malware executed.
  • undefinedAppDataundefined\pidloc.txt : This text file contains the exact path for the malware.


• The malware attempts to connect to the following sites:
  
  • fastcommi{Removed}.com
  • mai{Removed}.kanhseai.com
  • pornhous{Removed}.mobi/main.php
  • mickeyjone{Removed}.ddns.net


• This malware may attempt to determine the host's external IP address by connecting to checkip.dyndns.org.


• The following registry modifications are applied:
  
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\Currentversion\Run
    
    • Netwire = undefinedAppDataundefined\install\host.exe
    This automatically executes the dropped file every time the infected user logs on.
    


• The malware may try to inject to some host system process.


• The original copy of the malware may be deleted after execution.

Recommended Action

• Make sure that your FortiGate/FortiClient system is using the latest AV database.
• Quarantine/delete files that are detected and replace infected files with clean backup copies.