{
  "family": "otorunq",
  "sample_count": 1,
  "category": "trojan",
  "description": "<h3>Executive Summary</h3>\nOtorunq is a network worm and trojan that utilizes the legacy Windows `autorun.inf` feature for aggressive lateral movement and propagation. While AutoRun attacks have been heavily mitigated in modern Windows operating systems, Otorunq remains a threat in legacy environments, industrial control systems (ICS/SCADA), and through the infection of removable USB storage devices.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nOtorunq propagates almost exclusively via physical media. When an infected USB drive is plugged into a vulnerable Windows machine, the OS reads a hidden `autorun.inf` file created by the worm. This file instructs the OS to automatically execute the malware executable (often hidden or masquerading as a folder icon) without any user interaction.\n\nUpon execution, Otorunq focuses on spreading and establishing a backdoor:\n<ul>\n<li><strong>Drive Enumeration:</strong> The worm actively monitors the system for newly connected removable drives or mapped network shares.</li>\n<li><strong>Replication:</strong> When a new drive is detected, Otorunq silently copies its primary executable to the root of the drive and generates a new, malicious `autorun.inf` file pointing to the payload.</li>\n<li><strong>Payload Execution:</strong> While propagation is its primary function, Otorunq typically acts as a loader for secondary payloads. It will attempt to connect to a C2 server to download infostealers or backdoors, transforming the compromised host into a botnet node.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile easily blocked on fully patched Windows 10/11 systems, Otorunq poses a severe threat to air-gapped networks, legacy manufacturing floors, and healthcare environments where USB drives are frequently used to transfer data between older, unpatched systems.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Disable AutoRun/AutoPlay:</strong> The immediate, enterprise-wide remediation is to enforce a Group Policy Object (GPO) that completely disables AutoRun and AutoPlay functionality across all drives (removable, network, and CD/DVD).</li>\n<li><strong>USB Sanitation Station:</strong> Implement a mandatory policy where all external USB drives must be scanned and sanitized at a dedicated kiosk before being plugged into corporate workstations.</li>\n<li><strong>Endpoint Sweeps:</strong> Utilize AV/EDR to sweep endpoints for hidden executables and `autorun.inf` files residing in the root directories of all attached drives (`C:\\`, `D:\\`, etc.).</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Worm.Otorunq",
    "AutoRun.Otorunq",
    "Win32/Otorunq"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1091",
    "T1105",
    "T1059"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-01T17:44:33Z",
  "type": "Worm / AutoRun Spreader",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}