Trojan.Win64.CVE20190880.A

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It does not have any propagation routine.

It does not have any backdoor routine.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following files:

• {malware directory}\log.log → logs routine

Propagation

This Trojan does not have any propagation routine.

Backdoor Routine

This Trojan does not have any backdoor routine.

Rootkit Capabilities

This Trojan does not have rootkit capabilities.

NOTES:

This Trojan does the following:

• If %User Temp%\union1.dll exists:
  • It loads and copies %User Temp%\union1.dll into the following:
    • %System%\comhost.dll
  • It deletes the following file:
    • %User Temp%\union1.dll
  • It logs the following text in log.log:
    • "Level High --> Path"

If %User Temp%\union1.dll does NOT have the substring "Low":

• It loads and copies %User Temp%\union1.dll into the following:
  • %AppDataLocal%\comhost.dll
• It logs the following text in log.log:
  • "Level Medium --> Path"

It takes advantage of the following exploit(s):

• If %User Temp%\union1.dll has the substring "Low":
  • CVE-2019-0880 | Microsoft splwow64 Elevation of Privilege Vulnerability
    • It logs the following text in log.log:
      • "Low Medium"