Trojan.BAT.FORKBOMB.A

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It does not have any propagation routine.

It does not have any backdoor routine.

It does not have any information-stealing capability.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan adds the following processes:

• %System%\cmd.exe /S /D /c "{malware filename}" → spawned repeatedly

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

Propagation

This Trojan does not have any propagation routine.

Backdoor Routine

This Trojan does not have any backdoor routine.

Rootkit Capabilities

This Trojan does not have rootkit capabilities.

Information Theft

This Trojan does not have any information-stealing capability.

Other Details

This Trojan does the following:

• It resolves and executes its own script path and causing denial of service by recursively spawning processes.
• Each spawned instance repeats the process, causing exponential process growth (2^n), which results to the affected system to become unresponsive.
• It exhausts the following system resources within seconds of execution:
  • CPU
  • Memory
  • Process Handles

It does not exploit any vulnerability.