Otorunq
Overview
Executive Summary
Otorunq is a network worm and trojan that utilizes the legacy Windows `autorun.inf` feature for aggressive lateral movement and propagation. While AutoRun attacks have been heavily mitigated in modern Windows operating systems, Otorunq remains a threat in legacy environments, industrial control systems (ICS/SCADA), and through the infection of removable USB storage devices.Infection Vector and Technical Capabilities
Otorunq propagates almost exclusively via physical media. When an infected USB drive is plugged into a vulnerable Windows machine, the OS reads a hidden `autorun.inf` file created by the worm. This file instructs the OS to automatically execute the malware executable (often hidden or masquerading as a folder icon) without any user interaction. Upon execution, Otorunq focuses on spreading and establishing a backdoor:- Drive Enumeration: The worm actively monitors the system for newly connected removable drives or mapped network shares.
- Replication: When a new drive is detected, Otorunq silently copies its primary executable to the root of the drive and generates a new, malicious `autorun.inf` file pointing to the payload.
- Payload Execution: While propagation is its primary function, Otorunq typically acts as a loader for secondary payloads. It will attempt to connect to a C2 server to download infostealers or backdoors, transforming the compromised host into a botnet node.
Threat Assessment
While easily blocked on fully patched Windows 10/11 systems, Otorunq poses a severe threat to air-gapped networks, legacy manufacturing floors, and healthcare environments where USB drives are frequently used to transfer data between older, unpatched systems.Incident Response and Remediation
- Disable AutoRun/AutoPlay: The immediate, enterprise-wide remediation is to enforce a Group Policy Object (GPO) that completely disables AutoRun and AutoPlay functionality across all drives (removable, network, and CD/DVD).
- USB Sanitation Station: Implement a mandatory policy where all external USB drives must be scanned and sanitized at a dedicated kiosk before being plugged into corporate workstations.
- Endpoint Sweeps: Utilize AV/EDR to sweep endpoints for hidden executables and `autorun.inf` files residing in the root directories of all attached drives (`C:\`, `D:\`, etc.).
Known aliases
Threat reports may refer to this family under multiple names:
MITRE ATT&CK Techniques
This family has been observed using the following ATT&CK techniques: T1091 T1105 T1059
Tactical Mitigations
Based on the techniques used by this family, consider the following defensive strategies:
- T1059: Restrict execution of scripting languages such as PowerShell, VBScript, or Python to authorized administrators. Enforce Script Block Logging.
- T1105: Implement network intrusion detection systems (NIDS) and host-based firewalls to block unauthorized inbound or outbound file transfers.
Generated Detections (Boilerplate)
These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.
YARA Rule
rule MALWARE_WIN_OTORUNQ {
meta:
description = "Detects Otorunq (trojan)"
author = "SystemHelpdesk Boilerplate Generator"
date = "2026-07-06"
strings:
$s1 = "otorunq" ascii wide nocase
$s2 = "worm.otorunq" ascii wide nocase
$s3 = "autorun.otorunq" ascii wide nocase
$s4 = "win32/otorunq" ascii wide nocase
condition:
uint16(0) == 0x5a4d and any of them
}Sigma Rule
title: Suspicious Otorunq Activity
id: 7ac5fdb3487dd7f54c1ac2b20dd0d18c
status: experimental
description: Detects generic indicators of the otorunq malware family.
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
CommandLine|contains:
- "*otorunq*"
- "*worm.otorunq*"
- "*autorun.otorunq*"
- "*win32/otorunq*"
condition: selection
level: mediumReferences & External Analysis
- Search "otorunq" on VirusTotal (External Analysis)
Frequently Asked Questions
How do I remove the Otorunq Trojan from Windows?
Manual removal of Otorunq is highly discouraged as it may leave persistence mechanisms intact. We recommend disconnecting the device from the internet and utilizing a professional incident response service or enterprise-grade EDR software to conduct a full forensic sweep.
Is Otorunq a virus or a Trojan?
Otorunq is classified as a Trojan. Unlike traditional viruses that infect files, modern malware like Otorunq typically operates as a standalone payload designed to compromise systems, steal data, or deploy secondary stage implants.
What are the main symptoms of a Otorunq infection?
Symptoms of Otorunq can include unexpected system slowness, unauthorized outbound network traffic to unknown IP addresses, disabled security software, and suspicious background processes running from AppData or Temp directories.
Related Families (Category: trojan)
Explore other malware families in the same category:
Protect Your Network Against Trojans
Want to prevent Otorunq and similar threats from compromising your organization? Read our comprehensive defensive guide: Banking Trojan Protection.
Machine-readable
Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/otorunq.json
Ecosystem & Interactive Environments
This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.