Infection Channel: Downloaded from the Internet, Dropped by other malware, Spammed via email
This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It may be manually installed by a user.
It executes the dropped file(s). As a result, malicious routines of the dropped files are exhibited on the affected system.
File size: 318,184 bytes
File type: XLS
Memory resident: No
Initial samples received date: 15 Aug 2012
Payload: Drops files
Arrival Details
This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users.
It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
It may be manually installed by a user.
Installation
This Trojan drops the following component file(s):
- %User Temp%\October Conference Invitation letter.xls
(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)
It drops and executes the following files:
- %User Temp%\{random filename and extension} - detected as BKDR_WOLYX.TYT
(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)
Dropping Routine
This Trojan takes advantage of the following software vulnerabilities to drop malicious files:
- (CVE MS09-067) Vulnerabilities in Microsoft Office Excel Could Allow Remote Code Execution
It executes the dropped file(s). As a result, malicious routines of the dropped files are exhibited on the affected system.
Connect with us on
| | | |