Trojan.PS1.ERROR.A

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Download Routine

This Trojan connects to the following website(s) to download and execute a malicious file:

• https://{BLOCKED}pboxusercontent.com/scl/fi/vx23391zdxqu3qirc5z7g/241002-2024-GA-10-v2.pdf?rlkey=ih6seocq7csa4iab3md4m9m08&st=6sj4yyzp&dl=0
• https://{BLOCKED}pboxusercontent.com/scl/fi/gs58u6qvvxorzttv09yvt/kxsxhx-x.txt?rlkey=v86pd7i2njm7u0pfutl0knu68&st=zy1w6n67&dl=0
• https://{BLOCKED}pboxusercontent.com/scl/fi/sumch8o12a4ko7wqqtrgo/kxsxhx-f.txt?rlkey=i8yto5xg3unffs9wawhytu1v4&st=yj9eqlep&dl=0

It saves the files it downloads using the following names:

• %Application Data%\chrome.ps1
• %Application Data%\temp.ps1
• %Application Data%\system_first.ps1

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Other Details

This Trojan adds the following scheduled tasks:

• Name: ChromeUpdateTaskMachine
  Trigger: Starts 5 minutes from execution → after triggered, repeat every 30 minutes indefinitely
  Action: Start a program → PowerShell.exe' -Argument '-WindowStyle Hidden -nop -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command "& {$abc = Join-Path ($env:AppData) \"chrome.ps1\"; & $abc;}"';