Malware Analysis Infected file found on a usb drive

[Al-Faqir]

Hello! I have attached a firend's usb drive and Bullguard completed the scan detecting 7 infected files. There's one suspicious file named "t" undetected by Bullguard I have uploaded the file to VirusTotal.

 

[Al-Faqir]

Files have been executed automatically (not by me). 3 files

Bullguard detected them BB

Zemana scan result

 

[Deleted Member 3a5v73x]

I wouldn't call that guy a friend anymore.

Turn off Autoplay for attached devices.

https://www.howtogeek.com/236241/how-to-enable-disable-and-customize-autoplay-in-windows-10/

 

[Al-Faqir]

I wouldn't call that guy a friend anymore.

The infected files are pretty new! I wonder where he got them from. He's running Avira on his system btw

 

[Al-Faqir]

Anyway, how did the files run automatically?

 

[Al-Faqir]

Hitman scan result


Kaspersky Virus Desk

 

[ForgottenSeer 69673]

This is one nice feature of Appguard. It detects autoruns from external drives and stops them from running.

 

[Al-Faqir]

The 3 files are available on Malcode database.

 

[ForgottenSeer 69673]

The 3 files are available on Malcode database.

I see them there but have never used malcode before. How does one get the files?

Thanks

 

[Al-Faqir]

I see them there but have never used malcode before. How does one get the files?

Thanks

It is not advisable to download the files as they are infected! Anyway, you download the file by downloading the link which usually an IP. Download at your own risk

 

[ForgottenSeer 69673]

It is not advisable to download the files as they are infected! Anyway, you download the file by downloading the link which usually an IP. Download at your own risk

Is an account needed? clicking on the IP link does nothing.

EDIT: OK I see now, I copy and paste the link in browser and right away, Malwarebytes web filter blocked the first one. Will try the other two.

 

[Al-Faqir]

Is an account needed? clicking on the IP link does nothing.

No account needed! Just copy the IP address and paste it in the address bar! Please the files are infected, proceed with caution

 

[ForgottenSeer 69673]

No account needed! Just copy the IP address and paste it in the address bar! Please the files are infected, proceed with caution

Yes I edited my post but also want to add both SmartScreen and MB block it at same time.

 

[Al-Faqir]

SHP failed miserably detecting these three pieces of malware. It was unable to terminate the hollow process nor clean the malware remains. Reverted to an earlier state of system.