TROJ_UPATRE.YYMV

This malware was used in a spam campaign that uses Dropbox as a social engineering lure in order for users to click the related links.

To get a one-glance comprehensive view of the behavior of this Trojan, refer to the Threat Diagram shown below.

This Trojan arrives as an attachment to email messages mass-mailed by other malware/grayware or malicious users.

It executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.

It deletes itself after execution.

Arrival Details

This Trojan arrives as an attachment to email messages mass-mailed by other malware/grayware or malicious users.

Installation

This Trojan drops the following copies of itself into the affected system and executes them:

• %User Temp%\pdfmarks.exe

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, and 8.)

Download Routine

This Trojan connects to the following website(s) to download and execute a malicious file:

• https://{BLOCKED}ping-myrtle-beach.com/wp-content/uploads/2014/05/2805UKdw.dkt

It saves the files it downloads using the following names:

• %User Temp%\yaccpdf.exe - detected as TSPY_ZBOT.YYMV

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, and 8.)

It then executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.

Other Details

This Trojan deletes itself after execution.