Trojan.LNK.EMOTET.YJCD2
Windows
Threat Type: Trojan
Destructiveness: No
Encrypted:
In the wild: Yes
OVERVIEW
This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
TECHNICAL DETAILS
2,550 bytes
LNK
No
28 Apr 2022
Arrival Details
This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
Installation
This Trojan drops the following files:
- %User Temp%\rzsPrHsBem.ps1
(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)
It adds the following processes:
- %System%\cmd.exe /v:on /c {filename}.lnk||goto&p^o^w^e^r^s^h^e^l^l.e^x^e -c "&{[System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String('{encoded base 64}')) > "%User Temp%\rzsPrHsBem.ps1"; powershell -executionpolicy bypass -file "%User Temp%\rzsPrHsBem.ps1"; Remove-Item -Force "%User Temp%\rzsPrHsBem.ps1"
- powershell.exe -c "&{[System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String('{encoded base 64}')) > "%User Temp%\rzsPrHsBem.ps1"
- %System%\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy bypass -file %User Temp%\rzsPrHsBem.ps1
(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)
Other System Modifications
This Trojan deletes the following files:
- %User Temp%\rzsPrHsBem.ps1
(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)
Download Routine
This Trojan saves the files it downloads using the following names:
- %User Temp%\pFXxlnhRVh.pRK
(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)
Other Details
This Trojan connects to the following possibly malicious URL:
- http://{BLOCKED}technologies.com.pk/apitest/1r8uV/
- http://{BLOCKED}u.vn/components/gMXyb7/
- https://www.{BLOCKED}teldiligencias.com.mx/api/ga/
- http://www.{BLOCKED}te.cmru.ac.th/web53photo/anKeOTOIYXxzOtlIS9D/
- http://{BLOCKED}rup.dk/modlogan/DAbeNM/
- http://{BLOCKED}e.me/wp-content/DTN/