Home > Threat descriptions >

Worm:W32/Autorun.BHX

Classification

Category: Malware

Type: Worm

Aliases: Worm.Win32.AutoRun.bhx

Summary


Worm:W32/Autorun.BHX spreads by copying itself to removable drives and attempts to steal username and password information for several different online games.

Removal


Automatic action

Based on the settings of your F-Secure security product, it will either automatically delete, quarantine or rename the detected program or file, or ask you for a desired action.

Knowledge Base

Find the latest advice in our Community Knowledge Base.

About the product

See the manual for your F-Secure product on the Help Center.

Contact Support

Chat with or call an expert for help.

Submit a sample

Submit a file or URL for further analysis.

Technical Details


Worm:W32/Autorun.BHX attempts to spread by copying itself to removable drives as xadeiect.com.For more information on the Autorun infection method see our Worm:W32/Autorun family description.The primary payload for Autorun.BHX is to steal username and password information for online games.The following games are among the targeted:

  • Dekaron
  • MapleStory
  • Perfect World
  • Ragnarok Online
  • Seal Online
  • Yulgang
  • Zheng Tu Online
File System Changes

Creates these files:

  • %temp%\n2mmf2qu.dll
  • %windir%\system32\kavo.exe
  • %windir%\system32\kavo0.dll

Modified these files:

  • %temp%\6itt.sys
  • %windir%\system32\wincab.sys

Uses these temporary files:

  • %temp%\6itt.sys
  • %windir%\system32\wincab.sys
Network Connections

Attempts to download files from:

  • https://www.microsofttw.com/jj/[REMOVED].rar
Registry Modifications

Sets these values:

  • HKLM\System\CurrentControlSet\Services\athyd Type = 00000001 Start = 00000003 ErrorControl = 00000001 ImagePath = \??\C:\WINDOWS\system32\wincab.sys DisplayName = athyd by %windir%\system32\services.exe (PID:652)
  • HKLM\System\CurrentControlSet\Services\athyd\Security Security = \x01\x00\x14\x80\x90\x00\x00\x00\x9C\x00\x00\x00\x14\x00\x00\x00\x30\x00\x00\x00\x02\x00\x1C\x00\x01\x00\x00\x00\x02\x80\x14\x00\xFF\x01\x0F\x00\x01\x01\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x02\x00\x60\x00\x04\x00\x00\x00\x00\x00\x14\x00\xFD\x01\x02\x00\x01\x01\x00\x00\x00\x00\x00\x05\x12\x00\x00\x00\x00\x00\x18\x00\xFF\x01\x0F\x00\x01\x02\x00\x00\x00\x00\x00\x05\x20\x00\x00\x00\x20\x02\x00\x00\x00\x00\x14\x00\x8D\x01\x02\x00\x01\x01\x00\x00\x00\x00\x00\x05\x0B\x00\x00\x00\x00\x00\x18\x00\xFD\x01\x02\x00\x01\x02\x00\x00\x00\x00\x00\x05\x20\x00\x00\x00\x23\x02\x00\x00\x01\x01\x00\x00\x00\x00\x00\x05\x12\x00\x00\x00\x01\x01\x00\x00\x00\x00\x00\x05\x12\x00\x00\x00 by %windir%\system32\services.exe (PID:652)
  • HKCU\SoftWare\Microsoft\Windows\CurrentVersion\Run kava = C:\WINDOWS\system32\kavo.exe by %cwd%\sample.exe (PID:1548) [Launchpoint: Run]

Creates these keys:

  • HKLM\System\CurrentControlSet\Services\athyd by services.exe (PID: 652)
  • HKLM\System\CurrentControlSet\Services\athyd\Security by services.exe (PID: 652)
Stealth Features

Installs these hooks:

  • ntoskrnl.exe!NtOpenProcess SSDT hook to 0xf87f07d0 in %windir%\system32\wincab.sys Kernel process (PID: 0)
  • ntoskrnl.exe!NtEnumerateValueKey SSDT hook to 0xf87f09a2 in %windir%\system32\wincab.sys Kernel process (PID: 0)
  • ntoskrnl.exe!NtEnumerateKey SSDT hook to 0xf87f0aae in %windir%\system32\wincab.sys Kernel process (PID: 0)