TROJ_ARTIEF.KJC

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

It executes the dropped file(s). As a result, malicious routines of the dropped files are exhibited on the affected system.

Arrival Details

This Trojan arrives as an attachment to the following email messages spammed by other malware/grayware or malicious users:

Installation

This Trojan drops and executes the following files:

• %User Temp%\SVCH0ST.exe - detected as BKDR_SACTO.FAM

It drops the following non-malicious file:

• %User Temp%\Word.doc

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

Dropping Routine

This Trojan takes advantage of the following software vulnerabilities to drop malicious files:

• MSCOMCTL.OCX RCE Vulnerability (CVE-2012-0158)

It executes the dropped file(s). As a result, malicious routines of the dropped files are exhibited on the affected system.

Other Details

More information on this vulnerability can be found below:

• CVE-2012-0158

NOTES:

This Trojan drops the following shortcut pointing to its dropped file (BKDR_SACTO.FAM) in the User Startup folder to enable its automatic execution at every system startup:

• %User Startup%\msn.lnk

This Trojan opens its dropped non-malicious .DOC file %User Temp%\Word.doc as a decoy to trick user that they are opening a legitimate document.