Trojan.JS.ENVARSTAGE.A

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan adds the following folders:

• %AppDataLocal%\Microsoft\Windows\v1286

(Note: %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It drops the following copies of itself into the affected system:

• %AppDataLocal%\Microsoft\Windows\v1286\v9057.js

(Note: %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following processes:

• forfiles.exe /p %System% /m charmap.exe /c "cmd /v:on /d /c echo !NQ14LveaZqoIoLc!|powershell.exe -w h -nop -NoNi -"
• cmd /v:on /d /c echo !NQ14LveaZqoIoLc!|powershell.exe -w h -nop -NoNi -
• powershell.exe -w h -nop -NoNi -

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Environment
UserInitMprLogonScript = "%System%\wscript.exe" "%AppDataLocal%\Microsoft\Windows\v1286\v9057.js"

Other System Modifications

This Trojan modifies the following registry entries:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Windows
Load = "%AppDataLocal%\Microsoft\Windows\v4836\v6905.{extension}" → enable the automatic execution of a file it downloads

Download Routine

This Trojan connects to the following URL(s) to download its component file(s):

• https://{BLOCKED}octorindia.com/bin.exe

The successfully downloaded component file will be dropped in the following location and sets that copy as hidden:

• %AppDataLocal%\Microsoft\Windows\v4836\v6905.{extension}

(Note: %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)