Trojan.Python.KILLAV.YPCBO
Windows
Threat Type: Trojan
Destructiveness: No
Encrypted:
In the wild: Yes
OVERVIEW
Downloaded from the Internet
This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
TECHNICAL DETAILS
14,846 bytes
PY
Yes
Connects to URLs/IPs
Arrival Details
This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
Installation
This Trojan drops the following files:
- {Malware Path}\example.log → Used for logging
Information Theft
This Trojan accepts the following parameters:
- 1 {path of file containing list of hosts}
- It stores a list of available machines via SMB in the following file:
- {Malware Path}\result_with_working_files.txt
- 2 {path of file containing list of hosts} {path of file containing list of AV name}
- It logs the running AV processes found from the AV listed in the config file.
- 3 {path of file containing list of hosts} {path of AV killer file} {Additional arguments used as commandline arguments for the AV Killer process}
- It sends and executes the killer AV file via SMB
- 4 {path of file containing list of hosts} {path of file containing list of AV name}
- It sends and executes the following bat file to disable the cloud capabilities of the AV.
- specific_cloud_switch_off.bat
- It sends and execute the following bat files to uninstall AV products listed in the config file:
- get_uninstall_key_{String1}_{String2}.bat → Used to Query the specified AV name saves as {String1}.txt
- uninstall_by_key_{String 2}.bat → used to uninstall AV products via msiexec
- where String 1 can be : AV name
- where String 2 can be : Machine name
- Downloads {String1}.txt for the gathered key
Other Details
This Trojan does the following:
- It tries to connect to obtained IP addresses via SMB port 445.
SOLUTION
9.800
17.384.07
15 Feb 2022
17.385.00
16 Feb 2022
Step 1
Before doing any scans, Windows 7, Windows 8, Windows 8.1, and Windows 10 users must disable System Restore to allow full scanning of their computers.
Step 2
Note that not all files, folders, and registry keys and entries are installed on your computer during this malware's/spyware's/grayware's execution. This may be due to incomplete installation or other operating system conditions. If you do not find the same files/folders/registry information, please proceed to the next step.
Step 3
Search and delete this file
- {Malware Path}\example.log
- {String1}.txt
Step 4
Scan your computer with your Trend Micro product to delete files detected as Trojan.Python.KILLAV.YPCBO. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check the following Trend Micro Support pages for more information:
Did this description help? Tell us how we did.