W2KM_LOCKY.DLDVFD
TrojanDownloader:O97M/Donoff (Microsoft); W97M.Downloader (Symantec);
Windows
![](/vinfo/imgFiles/legend.jpg)
Threat Type: Trojan
Destructiveness: No
Encrypted:
In the wild: Yes
OVERVIEW
This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users.
It executes downloaded files whose malicious routines are exhibited by the affected system.
TECHNICAL DETAILS
33, 388 bytes
DOC
15 Aug 2016
Arrival Details
This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users.
Download Routine
This Trojan saves the files it downloads using the following names:
- %AppDataLocal%\Temphjgkuyts
- %User Temp%\ferdoxs.exe
(Note: %AppDataLocal% is the Application Data folder found in Local Settings, where it is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)
It executes downloaded files :
- %User Temp%\ferdoxs.exe
(Note: %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)
whose malicious routines are exhibited by the affected system.Other Details
This Trojan connects to the following possibly malicious URL:
- http://www.{BLOCKED}ather.com/HJ6bhGHV