TROJ_COBRA.WY
Win32.SuspectCrc (Ikarus), Trj/Dropper.JUW (Panda), Trojan.Win32.Generic.pak!cobra (Sunbelt), Gen:Variant.Graftor.40591 (Bitdefender)
Windows 2000, Windows XP, Windows Server 2003
![](/vinfo/imgFiles/legend.jpg)
Threat Type: Trojan
Destructiveness: No
Encrypted:
In the wild: Yes
OVERVIEW
This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
It executes the dropped file(s). As a result, malicious routines of the dropped files are exhibited on the affected system.
It connects to certain URLs. It may do this to remotely inform a malicious user of its installation. It may also do this to download possibly malicious files onto the computer, which puts the computer at a greater risk of infection by other threats.
TECHNICAL DETAILS
40,960 bytes
EXE
No
08 Oct 2012
Arrival Details
This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
Dropping Routine
This Trojan executes the dropped file(s). As a result, malicious routines of the dropped files are exhibited on the affected system.
Download Routine
This Trojan connects to the following malicious URLs:
- http://{BLOCKED}e.{BLOCKED}p.kr/test/test.txt
- http://{BLOCKED}e.{BLOCKED}eep.kr/121004/jach/Setup_jachget.exe
- http://{BLOCKED}e.{BLOCKED}eep.kr/121004/jach/VaccineForce_blue2.exe
It saves the files it downloads using the following names:
- %User Temp%\Setup_jachget.exe
- %User Temp%\VaccineForce_blue2.exe
(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)