W2KM_BARTALEX.XYUJ

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

Arrival Details

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

Installation

This Trojan drops the following files:

• %User Temp%\{random number}.bat
• %User Temp%\{random number}.vbs
• %User Temp%\{random number}.ps1 - for Windows Vista and above only

(Note: %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Download Routine

This Trojan accesses the following websites to download files:

• https://www.{BLOCKED}x.com/s/i4wqt4hzz09qh46/jj_0.exe?dl=1
• http://{BLOCKED}c.su/5751812.jpg

It saves the files it downloads using the following names:

• %User Temp%\8.exe

(Note: %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Other Details

This Trojan connects to the following possibly malicious URL:

• http://{BLOCKED}residency.com/modules/mod_araticlhess/78672738612836.txt
• http://{BLOCKED}ostainedglassdesignresturation.com/wp-content/themes/ecobiz/ecobiz/css/styles/brown/78672738612836.txt
• http://{BLOCKED}ostainedglassdesignresturation.com/wp-content/themes/ecobiz/ecobiz/css/styles/brown/fafa.txt