Infection Channel: Via email
This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
File size: varies
File type: PDF
Memory resident: Yes
Initial samples received date: 13 Feb 2013
Payload: Downloads files
Arrival Details
This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users.
It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
Download Routine
This Trojan connects to the following website(s) to download and execute a malicious file:
- http://{BLOCKED}.{BLOCKED}.169.204/57b1bcef1c6bf783f98ccc1f684b7543/57b1bcef1c6bf783f98ccc1f684b7543/q.php?apzxy=1o:1f:1o:1m:31&jawnyeh=1g:1n:32:33:1n:1n:1n:2v:31:1o&khppmnx=1h&zbigrn=xntcs&fdiprc=coyhlfog
It takes advantage of the following software vulnerabilities to download possibly malicious files:
After successfully exploiting the said vulnerability, this malware connects to the following URLs to possibly download other malicious files:
- ip-217-137.{BLOCKED}ub.biz
It saves the files it downloads using the following names:
(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)
Connect with us on
| | | |