Trojan.XF.EMOTET.YXCFN
ALIASES:
Trojan-Downloader.XLM.Agent (IKARUS)
PLATFORM:
Windows
OVERALL RISK RATING:
DAMAGE POTENTIAL:
DISTRIBUTION POTENTIAL:
REPORTED INFECTION:
INFORMATION EXPOSURE:
Threat Type: Trojan
Destructiveness: No
Encrypted:
In the wild: Yes
OVERVIEW
This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
TECHNICAL DETAILS
File Size:
61,952 bytes
File Type:
XLS
Memory Resident:
No
Initial Samples Received Date:
14 Jun 2022
Arrival Details
This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
Installation
This Trojan adds the following processes:
- %System%\regsvr32.exe /S {Parent of default Excel save path}\hhwe1.ocx
- %System%\regsvr32.exe /S {Parent of default Excel save path}\hhwe2.ocx
- %System%\regsvr32.exe /S {Parent of default Excel save path}\hhwe3.ocx
- %System%\regsvr32.exe /S {Parent of default Excel save path}\hhwe4.ocx
(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)
Download Routine
This Trojan saves the files it downloads using the following names:
- {Parent of default Excel save path}\hhwe1.ocx
- {Parent of default Excel save path}\hhwe2.ocx
- {Parent of default Excel save path}\hhwe3.ocx
- {Parent of default Excel save path}\hhwe4.ocx
Other Details
This Trojan connects to the following possibly malicious URL:
- https://{BLOCKED}i.id/m/qLCZWt/
- http://{BLOCKED}t.nl/8HOicoBufQNbjbM/
- https://{BLOCKED}ercollegiate.com.pk/wp-admin/q69DZX4kKZ6ssRQ/