PLATFORM:

Windows

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:
 SYSTEM IMPACT RATING:
 INFORMATION EXPOSURE:

  • Threat Type: Trojan

  • Destructiveness: No

  • Encrypted:

  • In the wild: Yes

  TECHNICAL DETAILS

File Size: 1,742,336 bytes
File Type: TAR
Memory Resident: Yes
Initial Samples Received Date: 20 Oct 2026

Arrival Details

  • This Trojan arrives as a tar archive with the following nested contents:
    • 4ol6kw2.rar → RAR archive inside the original tar
    • Goc-gov-tr-update-.JS → JScript member inside 4ol6kw2.rar
    • The contents above are detected under the same detection, Trojan.JS.DROPPER.T

Other Details

It does the following:

  • The tar and RAR are containers for the JScript. The JScript (Goc-gov-tr-update-.JS) when launched does the following:
    • Drops the following files:
      • %User Profile%\Documents\DHKFUGAVMDUPVTLO → obfuscated LUA script detected as Trojan.Win32.REMCOS.L
      • %User Profile%\Documents\OLTVPUDMVAGUFKHD.exe → a legitimate LuaJIT binary
    • Adds the following process:
      • "%System%\wscript.exe" "{malware path}\Goc-gov-tr-update-.JS" → initial execution of the obfuscated JavaScript loader
      • "%User Profile%\Documents\OLTVPUDMVAGUFKHD.exe" "%User Profile%\Documents\DHKFUGAVMDUPVTLO" → launches the LuaJIT executable to execute the obfuscated Lua script
      • "%System%\conhost.exe" 0xffffffff -ForceV1 → Console Window Host automatically attached by Windows for the CUI subsystem LuaJIT binary

  SOLUTION

Minimum Scan Engine: 9.800
FIRST VSAPI PATTERN FILE: 21.378.06
FIRST VSAPI PATTERN DATE: 14 Oct 2026

Step 1

Before doing any scans, Windows 7, Windows 8, Windows 8.1, and Windows 10 users must disable System Restore to allow full scanning of their computers.

Step 2

Search and delete these files

  • %User Profile%\Documents\DHKFUGAVMDUPVTLO
  • %User Profile%\Documents\OLTVPUDMVAGUFKHD.exe

Step 3

Scan your computer with your Trend Micro product to delete files detected as Trojan.JS.DROPPER.T.


Did this description help? Tell us how we did.