VirusW32/RBot.HP!worm
Analysis
This threat is packed with a file size of 169,984. It binds with TCP port 10009 to function as a remote access Trojan.
Loading At Windows Startup
If this virus is run, it will register itself to run at each Windows startup -
HKEY_CURRENT_USER\SOFTWARE\Microsoft\OLE\
"System Uptime Server" = Sysentry.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
"System Uptime Server" = Sysentry.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\
"System Uptime Server" = Sysentry.exe
While this threat is running in memory, it is referenced by the Mutex "bleher4".
Recommended Action
Check the main screen using the web interface for your FortiGate unit to ensure that the latest AV/NIDS database has been downloaded and installed on your system - if required, enable the "Allow Push Update" option
Telemetry
Detection Availability
| FortiClient | |
|---|---|
| Extreme | |
| FortiMail | |
| Extreme | |
| FortiSandbox | |
| Extreme | |
| FortiWeb | |
| Extreme | |
| Web Application Firewall | |
| Extreme | |
| FortiIsolator | |
| Extreme | |
| FortiDeceptor | |
| Extreme | |
| FortiEDR |