TROJ_WMSHELL.A

This malware is involved in the DRIDEX malspam campaign that was spotted in early November 2014. It purports itself as a word document with malicious macro code that then downloads DRIDEX onto the affected system. Users affected by this malware may find their online banking accounts compromised.

To get a one-glance comprehensive view of the behavior of this Trojan, refer to the Threat Diagram shown below.

This Trojan arrives as an attachment to email messages mass-mailed by other malware/grayware or malicious users.

It executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.

Arrival Details

This Trojan arrives as an attachment to email messages mass-mailed by other malware/grayware or malicious users.

Download Routine

This Trojan accesses the following websites to download files:

• http://{BLOCKED}ehurt.com.pl/js/bin.exe

It saves the files it downloads using the following names:

• %User Temp%\calc1.exe - detected as TSPY_DRIDEX.WQJ

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, and 8.)

It then executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.