Autorunerent

Overview

Worm:Win32/Autorunerent is a classic worm designed to aggressively self-propagate across systems by exploiting the Windows `autorun.inf` feature on removable media (USB drives, external hard drives, and mapped network drives). Its primary objective is rapid, untargeted proliferation, often acting as a delivery mechanism for secondary payloads like infostealers or serving as a rudimentary botnet component (`T1091`).

Understanding Autorunerent (USB Worms)
To an end-user, the infection might be entirely invisible, or they might notice unexpected files appearing on their USB flash drives. For an enterprise network, Autorunerent is highly problematic because it bypasses traditional perimeter defenses (firewalls, email filters) entirely. It leverages physical media to cross 'air-gapped' networks and spread rapidly from workstation to workstation.

Execution and Propagation Mechanics
The infection cycle begins when a compromised USB drive is inserted into a Windows machine. Historically, Windows would automatically execute the instructions within the `autorun.inf` file, immediately launching the hidden worm executable. Once active in memory, the worm establishes persistence (often via Registry Run keys) and monitors the system for new drives. When a clean USB drive is inserted, Autorunerent copies its executable onto the drive, sets its file attributes to 'Hidden' and 'System', and creates a new, malicious `autorun.inf` file pointing to itself (`T1091`). To trick users on systems where Autorun is disabled, it often creates a Windows Shortcut (`.lnk`) file with a folder icon that executes the malware when clicked (`T1566.002`).

Indicators of Compromise & Impact
The primary impact is the rapid spread of the infection and the potential delivery of secondary payloads. Host-based IoCs include the presence of `autorun.inf` files on removable media referencing unknown executables, unexpected `.lnk` files on USB drives, and EDR alerts for executables launching directly from the root directory of a removable drive. Network IoCs depend on the secondary payload, often involving HTTP beacons to C2 servers.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1566.002: Inspect email links for known malicious domains and use link-rewriting services for time-of-click analysis.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_AUTORUNERENT {
    meta:
        description = "Detects Autorunerent (advanced_threat)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "autorunerent" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Autorunerent Activity
id: 71eaec0fed13bd630063554b080bbda6
status: experimental
description: Detects generic indicators of the autorunerent malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*autorunerent*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Ensure that the Windows 'Autorun' and 'Autoplay' features are strictly disabled via Group Policy across the entire enterprise.
2. Use enterprise EDR to scan all connected removable drives and network shares for malicious `autorun.inf` and associated hidden executables.
3. Implement Endpoint Device Control policies to restrict or completely block the use of unapproved USB mass storage devices.
4. Format infected USB drives rather than attempting manual file deletion, to ensure all hidden components are removed.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not blindly click on 'folder' icons on a USB drive without ensuring Windows is set to display file extensions, as they may be malicious `.lnk` files.
2. Avoid plugging a potentially infected USB drive into a clean, networked machine for analysis without using a dedicated, isolated sandbox.

References & External Analysis

• Search "autorunerent" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: advanced_threat)

Explore other malware families in the same category:

• Stufffull
• Spytech
• Lightlogger
• Logicielsespions
• Deepscan

Machine-readable

Get this profile as JSON: https://jordan123234-malware-families-explorer.static.hf.space/api/autorunerent.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.