Readme.exe

By LoneStar in Malware

Readme.exe is a malicious executable file and a key component of a mass-mailing Apost worm. When the file of the W32.Apost@mm is executed, it displays a message box with the one big button named 'Open' and 'Urgent' as caption. After a user clicks the 'Open' button, W32.Apost@mm displays a fake error message: 'WinZip SelfExtractor: Warning' and 'CRC error: 234#21'. Then W32.Apost@mm checks if it is already installed in a PC system. W32.Apost@mm looks for the Readme.exe file in Windows folder and creates it doesn't exist. Readme.exe then modifies the registry; it adds 'macrosoft' subkey to the current user's application autostartup key: The 'macrosoft' subkey includes a full path for the file of the W32.Apost@mm.

W32.Apost@mm also replicates as Readme.exe to install directories of all drives that are available for writing (local and network drives where the current user has write access). Finally, Readme.exe connects to Microsoft Outlook, gets the user's mail server login and password and copies itself by sending an infected message to all email addresses found in Outlook's address book. W32.Apost@mm's file is attached to an infected message as Readme.exe file. W32.Apost@mm will infect a remote computer only when a recepient runs the malicious attachment. Infected messages are deleted after they are sent. It is recommended to delete Readme.exe immediately upon detection to prevent infection of the W32.Apost@mm.

File System Details

Readme.exe may create the following file(s):

Expand All | Collapse All

#	File Name	Detections Detections: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
1.	c:\readme.exe
Name: c:\readme.exe Type: Executable File
2.	%ProgramFiles%\dwimn\readme.exe
Name: %ProgramFiles%\dwimn\readme.exe Type: Executable File
3.	%ProgramFiles%\monrs\readme.exe
Name: %ProgramFiles%\monrs\readme.exe Type: Executable File
4.	%ProgramFiles%\versekulo\src.dll
Name: %ProgramFiles%\versekulo\src.dll Type: Dynamic link library
5.	%Programs%\startup\massacre.exe
Name: %Programs%\startup\massacre.exe Type: Executable File
6.	%Temp%\ir_ext_temp_0\autoplay\docs\readme.exe
Name: %Temp%\ir_ext_temp_0\autoplay\docs\readme.exe Type: Executable File
7.	%Temp%\skmw\readme.exe
Name: %Temp%\skmw\readme.exe Type: Executable File
8.	%System%\cdd\readme.exe
Name: %System%\cdd\readme.exe Type: Executable File
9.	%Windir%\ampatuan.exe
Name: %Windir%\ampatuan.exe Type: Executable File
10.	%Windir%\k.exe
Name: %Windir%\k.exe Type: Executable File
11.	%Windir%\p2p.exe
Name: %Windir%\p2p.exe Type: Executable File
12.	%Windir%\regangen.exe
Name: %Windir%\regangen.exe Type: Executable File
13.	c:\kernel32.exe
Name: c:\kernel32.exe Type: Executable File
14.	%ProgramFiles%\cinvig\readme.exe
Name: %ProgramFiles%\cinvig\readme.exe Type: Executable File
15.	%ProgramFiles%\microsoft update\readme.exe
Name: %ProgramFiles%\microsoft update\readme.exe Type: Executable File
16.	%ProgramFiles%\versekulo\readme.exe
Name: %ProgramFiles%\versekulo\readme.exe Type: Executable File
17.	%ProgramFiles%\wssin\readme.exe
Name: %ProgramFiles%\wssin\readme.exe Type: Executable File
18.	%CommonPrograms%\startup\readme.exe
Name: %CommonPrograms%\startup\readme.exe Type: Executable File
19.	%Temp%\readme.exe
Name: %Temp%\readme.exe Type: Executable File
20.	%System%\angen.exe
Name: %System%\angen.exe Type: Executable File
21.	%System%\serial.exe
Name: %System%\serial.exe Type: Executable File
22.	%Windir%\freegames2008.exe
Name: %Windir%\freegames2008.exe Type: Executable File
23.	%Windir%\mswinxpa_sp3upd.exe
Name: %Windir%\mswinxpa_sp3upd.exe Type: Executable File
24.	%Windir%\readme.exe
Name: %Windir%\readme.exe Type: Executable File
25.	%Windir%\winamp.exe
Name: %Windir%\winamp.exe Type: Executable File
26.	c:\67readme.exe
Name: c:\67readme.exe Type: Executable File
27.	%UserProfile%\readme.exe
Name: %UserProfile%\readme.exe Type: Executable File
28.	%ProgramFiles%\kernel32.exe
Name: %ProgramFiles%\kernel32.exe Type: Executable File
29.	%ProgramFiles%\skmw\readme.exe
Name: %ProgramFiles%\skmw\readme.exe Type: Executable File
30.	%ProgramFiles%\versekulo\verse.exe
Name: %ProgramFiles%\versekulo\verse.exe Type: Executable File
31.	%CommonPrograms%\startup\office_viewer.exe
Name: %CommonPrograms%\startup\office_viewer.exe Type: Executable File
32.	%Temp%\ixp000.tmp\readme.exe
Name: %Temp%\ixp000.tmp\readme.exe Type: Executable File
33.	%System%\ampatuan.exe
Name: %System%\ampatuan.exe Type: Executable File
34.	%System%\readme.exe
Name: %System%\readme.exe Type: Executable File
35.	%Windir%\er.exe
Name: %Windir%\er.exe Type: Executable File
36.	%Windir%\message_helpme.exe
Name: %Windir%\message_helpme.exe Type: Executable File
37.	%Windir%\pussy_massacre.exe
Name: %Windir%\pussy_massacre.exe Type: Executable File
38.	%Windir%\virus_remover.exe
Name: %Windir%\virus_remover.exe Type: Executable File

Registry Details

Readme.exe may create the following registry entry or registry entries:

HKEY..\..\..\..{RegistryKeys}

"macrosoft":="C:\Windows\readme.exe"

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

Enigma Software Group Prevails Over Malwarebytes at the Ninth Circuit

Search

Change Region

Readme.exe

File System Details

Registry Details

Submit Comment

Trending

Rzfu Ransomware

'YouPorn' Email Scam

Rzkd Ransomware

Most Viewed

Is Lookmovie.io Safe?

How To Fix 'Printer Driver is Unavailable' Error

Discord Shows Black Screen when Sharing Screen