Categories: Trojan

Win32/TrojanDownloader.Autoit.OQL (file analysis)

The Win32/TrojanDownloader.Autoit.OQL is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/TrojanDownloader.Autoit.OQL virus can do?

A file was accessed within the Public folder.
Performs HTTP requests potentially not found in PCAP.
Authenticode signature is invalid
Uses Windows utilities to create a scheduled task
Loads Chromium browser extension from directory
Attempts to modify proxy settings
Touches a file containing cookies, possibly for information gathering
Uses suspicious command line tools or Windows utilities
Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Win32/TrojanDownloader.Autoit.OQL?


File Info:
name: A6020A4A840D08BDCBED.mlwpath: /opt/CAPEv2/storage/binaries/37c278b2ff5395a872a27ab3529b682ce8cab055c7c0d037b19ea7650438100bcrc32: F9EB009Dmd5: a6020a4a840d08bdcbedd4cf3e9ec642sha1: 578a811529a6b048eb56cfa2445f2ec60b1fc3dcsha256: 37c278b2ff5395a872a27ab3529b682ce8cab055c7c0d037b19ea7650438100bsha512: 8800bd947213e78e4ce5bf1a649617772d37dee5a979ab5898320a684343b162e6209e58db423c077a775e9ee4f34cd57975af3a6b0f09c222646b1849c168d8ssdeep: 12288:YCdOy3vVrKxR5CXbNjAOxK/j2n+4YG/6c1mFFja3mXgcjfRlgsUBgal7Y0Q:YCdxte/80jYLT3U1jfsWa5Y0Qtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1FA059D2273DDC370CB669173BF69B7016EBF78614630B85B2F880D7DA950161262DBA3sha3_384: a40e21423d383d555e2d549bf05efe595e8c02ade63efe6e167315d23f6a9779cb2be746eab07dcc628ed23575eeb318ep_bytes: e8b8d00000e97ffeffffcccccccccccctimestamp: 2018-10-10 06:43:15
Version Info:
Translation: 0x0809 0x04b0

Win32/TrojanDownloader.Autoit.OQL also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Scrop.b!c
MicroWorld-eScan	Trojan.GenericKD.33779100
FireEye	Trojan.GenericKD.33779100
ALYac	Trojan.GenericKD.33779100
Cylance	unsafe
Sangfor	Downloader.Win32.Scrop.Vlcq
K7AntiVirus	Trojan-Downloader ( 0053efd51 )
Alibaba	TrojanDropper:Win32/Scrop.286eeb38
K7GW	Trojan-Downloader ( 0053efd51 )
Cybereason	malicious.a840d0
BitDefenderTheta	AI:Packer.315C233317
Cyren	W32/AutoIt.VI.gen!Eldorado
Symantec	Trojan.Gen.MBT
Elastic	malicious (high confidence)
ESET-NOD32	Win32/TrojanDownloader.Autoit.OQL
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	Trojan-Dropper.Win32.Scrop.sjc
BitDefender	Trojan.GenericKD.33779100
NANO-Antivirus	Trojan.Win32.Scrop.fjezog
ViRobot	Trojan.Win32.Z.Scrop.864768
Avast	Win32:Trojan-gen
Tencent	Win32.Trojan-Dropper.Scrop.Fdhl
Emsisoft	Trojan.GenericKD.33779100 (B)
F-Secure	Heuristic.HEUR/AGEN.1319424
DrWeb	Trojan.KillProc.56712
VIPRE	Trojan.GenericKD.33779100
TrendMicro	TROJ_GEN.R002C0PF423
McAfee-GW-Edition	BehavesLike.Win32.DownloaderAutoIt.ch
Sophos	Mal/Generic-S
Ikarus	Trojan-Downloader.Win32.AutoIt
GData	Trojan.GenericKD.33779100
Avira	HEUR/AGEN.1319424
Antiy-AVL	Trojan[Downloader]/Autoit.Inetget.a
Xcitium	Malware@#34eawzlaeeb08
Arcabit	Trojan.Generic.D2036D9C
ZoneAlarm	Trojan-Dropper.Win32.Scrop.sjc
Microsoft	Trojan:Win32/Vigorf.A
Google	Detected
AhnLab-V3	Malware/Win32.Generic.C2757264
McAfee	RDN/Generic Downloader.x
MAX	malware (ai score=100)
VBA32	Trojan-Downloader.Autoit.gen
Malwarebytes	Malware.AI.3764467545
Panda	Trj/CI.A
TrendMicro-HouseCall	TROJ_GEN.R002C0PF423
SentinelOne	Static AI – Suspicious PE
Fortinet	W32/Scrop.SJC!tr
AVG	Win32:Trojan-gen
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (W)