Categories: Malware

About “AutoIt:MalOb-HB [Trj]” infection

The AutoIt:MalOb-HB [Trj] is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What AutoIt:MalOb-HB [Trj] virus can do?

Uses Windows utilities for basic functionality
CAPE extracted potentially suspicious content
Drops a binary and executes it
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
A ping command was executed with the -n argument possibly to delay analysis
Behavioural detection: Injection (Process Hollowing)
Behavioural detection: Injection (inter-process)
Creates a copy of itself
Deletes executed files from disk
Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine AutoIt:MalOb-HB [Trj]?


File Info:
name: 10EF4CDD1E881D43E8E5.mlwpath: /opt/CAPEv2/storage/binaries/01a3d53f3fc7a9d7aabcdda66fda954bb1206e7e275ea549ff554d4b840a9499crc32: E8E6E92Cmd5: 10ef4cdd1e881d43e8e5c318a6e856c5sha1: 525b2d6bad37c92243359db07029daa6f96c97aesha256: 01a3d53f3fc7a9d7aabcdda66fda954bb1206e7e275ea549ff554d4b840a9499sha512: 23b8dc861d4df6a38bcbbfd2b46edcea2f020a5ddc281586a49f53e8b71e88398eb95a700ee79546dc6c34c132303aece450536955d066cf155e55094caa6879ssdeep: 24576:1tb20pkaCqT5TBWgNQ7agzkIL79vo/F4APcUguJE+6A:mVg5tQ7agR7ho/FGRM5type: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1D845CF1363DD8361C7B26273BA25B701BEBF782506A5F56B2FD80D3DE920122521E673sha3_384: 705a5f5fb45f335e888e5769f30c553ec693f23d43d834ddc1236b3e5dc5cb992ad6a16c006204b30b8af1b07dda9c5fep_bytes: e86ace0000e97ffeffffcccc57568b74timestamp: 2015-02-11 14:56:00
Version Info:
Translation: 0x0809 0x04b0

AutoIt:MalOb-HB [Trj] also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Dapato.b!c
MicroWorld-eScan	AIT:Trojan.Autoit.CDG
FireEye	Generic.mg.10ef4cdd1e881d43
Skyhigh	BehavesLike.Win32.TrojanAitInject.tc
McAfee	GenericR-DPJ!10EF4CDD1E88
Cylance	unsafe
Sangfor	Trojan.Win32.Save.a
Alibaba	Trojan:Win32/Starter.ali2000005
Cybereason	malicious.bad37c
Arcabit	AIT:Trojan.Autoit.CDG [many]
BitDefenderTheta	AI:Packer.D232202B15
Symantec	Trojan.Gen.MBT
ESET-NOD32	multiple detections
Cynet	Malicious (score: 100)
APEX	Malicious
ClamAV	Win.Trojan.Autoit-6931471-0
Kaspersky	Trojan-Dropper.Win32.Dapato.ewyx
BitDefender	AIT:Trojan.Autoit.CDG
NANO-Antivirus	Trojan.Win32.Dapato.dnzxej
Avast	AutoIt:MalOb-HB [Trj]
Tencent	Win32.Trojan-Dropper.Dapato.Lzfl
Emsisoft	AIT:Trojan.Autoit.CDG (B)
F-Secure	Heuristic.HEUR/AGEN.1319170
DrWeb	Trojan.DownLoader13.25328
VIPRE	AIT:Trojan.Autoit.CDG
Sophos	Mal/Generic-S
Ikarus	Trojan.Win32.Injector
Webroot	W32.Trojan.GenKD
Avira	HEUR/AGEN.1319170
Kingsoft	malware.kb.a.954
Xcitium	Malware@#1xrjjgu2zjb15
Microsoft	Trojan:Win32/Scrarev.C
ZoneAlarm	Trojan-Dropper.Win32.Dapato.ewyx
GData	AIT:Trojan.Autoit.CDG (2x)
Google	Detected
VBA32	Trojan.Autoit.Paket
ALYac	AIT:Trojan.Autoit.CDG
MAX	malware (ai score=100)
Malwarebytes	Generic.Malware/Suspicious
Panda	Trj/CI.A
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
AVG	AutoIt:MalOb-HB [Trj]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (W)