Trojan.W97M.THANOS.THABGBA

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

As of this writing, the said sites are inaccessible.

Arrival Details

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan adds the following processes:

• C:\wCmfmRe\dtwzrQf\GZTJoxx.exe

It creates the following folders:

• C:\wCmfmRe
• C:\wCmfmRe\dtwzrQf

Download Routine

This Trojan connects to the following website(s) to download and execute a malicious file:

• https://{BLOCKED}dtrac.xyz/3/bbc.exe

It saves the files it downloads using the following names:

• C:\wCmfmRe\dtwzrQf\GZTJoxx.exe

As of this writing, the said sites are inaccessible.

Other Details

This Trojan does the following:

• This Trojan is a password protected file.
  
• When a correct password is given, it displays the following to trick users into enabling the embedded malicious macro.