Trojan.XF.EMOTET.YJCFN
ALIASES:
Trojan-Downloader.XLM.Agent (IKARUS)
PLATFORM:
Windows
OVERALL RISK RATING:
DAMAGE POTENTIAL:
REPORTED INFECTION:
SYSTEM IMPACT RATING:
INFORMATION EXPOSURE:
Threat Type: Trojan
Destructiveness: No
Encrypted:
In the wild: Yes
OVERVIEW
This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
TECHNICAL DETAILS
File Size:
61,952 bytes
File Type:
XLS
Memory Resident:
No
Initial Samples Received Date:
15 Jun 2022
Arrival Details
This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
Installation
This Trojan adds the following processes:
- %System%\regsvr32.exe /S {Parent of default Excel save path}\hhwe1.ocx
- %System%\regsvr32.exe /S {Parent of default Excel save path}\hhwe2.ocx
- %System%\regsvr32.exe /S {Parent of default Excel save path}\hhwe3.ocx
- %System%\regsvr32.exe /S {Parent of default Excel save path}\hhwe4.ocx
(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)
Download Routine
This Trojan saves the files it downloads using the following names:
- {Parent of default Excel save path}\hhwe1.ocx
- {Parent of default Excel save path}\hhwe2.ocx
- {Parent of default Excel save path}\hhwe3.ocx
- {Parent of default Excel save path}\hhwe4.ocx
Other Details
This Trojan connects to the following possibly malicious URL:
- http://aacl.{BLOCKED}o.in/images/7CMc2NlOosD4pn6ljDw/
- http://{BLOCKED}nings.co.za/logs/KMa83/
- https://{BLOCKED}c.co.uk/wp-includes/DD2jwgazTKsp/