Trojan.Win32.SHELLCODE.AM

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Ejecuta determinados comandos que recibe de forma remota desde un usuario malicioso. De esta forma pone en gran peligro el equipo afectado y la información del mismo.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Rutina de puerta trasera

Ejecuta los comandos siguientes desde un usuario remoto malicioso:

• May execute files with the following extension when received:
  • .exe
  • .vbs
  • .ps1
    • format: "powershell -WindowsStyle Hidden -ep bypass -file "
  • .bat
  • .cmd
• The next routine is arbitrary and depends on the executed file behavior. However, as of this writing, no additional file was received from the C&C.