Trojan.XF.FORMULOAD.UFUT
Publish Date: 09 de декабря de 2021
TrojanDownloader:O97M/Dridex.PMSK!MTB (MICROSOFT)
PLATFORM:
Windows
OVER ALL RISK RATING:
DAMAGE POTENTIAL::
DISTRIBUTION POTENTIAL::
REPORTED INFECTION:
INFORMATION EXPOSURE:
Low
Medium
High
Critical
Threat Type:
Trojan
Destructiveness:
No
Encrypted:
In the wild::
Yes
OVERVIEW
It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
TECHNICAL DETAILS
File size: 76,561 bytes
File type: XLS, Other
Memory resident: Yes
INITIAL SAMPLES RECEIVED DATE: 18 ноября 2021
Detalles de entrada
It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
Instalación
Infiltra los archivos siguientes:
- %ProgramData%\fjkdgjknfdgfjkdgjknfdg.rtf
- %ProgramData%\api-ms-win-crt-stdio-l1-1-0.mp4
Agrega los procesos siguientes:
- wmic.exe process call create 'mshta %ProgramData%\fjkdgjknfdgfjkdgjknfdg.rtf'
- wmic process call create "rundll32.exe %ProgramData%\api-ms-win-crt-stdio-l1-1-0.mp4 LZDone"
Otros detalles
It connects to the following possibly malicious URL:
- https://cdn.{BLOCKED}app.com/attachments/910212171147915317/910550967668310016/WxDPscgHItkfTniggerjewhitler.mp4
- https://cdn.{BLOCKED}app.com/attachments/910212171147915317/910550751456149534/JvqwnnQpTQVAyniggerjewhitler.mp4
- https://cdn.{BLOCKED}app.com/attachments/910212171147915317/910550529279655966/qcAWeDaQPniggerjewhitler.mp4