W32/Waski.F!tr

Analysis

W32/Waski.F!tr is a generic detection for a type of trojan that uses a custom packer. Since this is a generic detection, malware that are detected as W32/Waski.F!tr may have varying behavior.
Below are examples of some of these behavior:

• Drops the following file:
  
  • undefinedTempundefined\[Varies].exe (e.g., orrhb.exe) : This is a copy of the original malware with appended overlay. The filename is hardcoded into the malware sample.


• It tries to access the following URL:
  
  • http://94.23.{Removed}.202


• It attempts to download files from the following URLs:
  
  • http://frucht{Removed}.com/design/cw400.zip
  • http://macroges{Removed}.com/latam/cw400.zip
  • http://alopha{Removed}.com/css/48s2.zip
  • http://dis{Removed}.com//Scripts/88u2.zip

Recommended Action

• Make sure that your FortiGate/FortiClient system is using the latest AV database.
• Quarantine/delete files that are detected and replace infected files with clean backup copies.