TROJ_ARTIEF.MC

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

It executes the dropped file(s). As a result, malicious routines of the dropped files are exhibited on the affected system.

Arrival Details

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

Installation

This Trojan drops the following non-malicious file:

• %User Temp%\document.doc

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)

Dropping Routine

This Trojan drops the following files:

• %User Temp%\svchost.exe - detected as BKDR_RILER.MC

It takes advantage of the following software vulnerabilities to drop malicious files:

• RTF Stack Buffer Overflow Vulnerability (CVE-2010-3333)
• (MS10-087) Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (2423930)

It executes the dropped file(s). As a result, malicious routines of the dropped files are exhibited on the affected system.

NOTES:
Upon execution, it opens its dropped non-malicious DOC file, %User Temp%\document.doc, in order to hide its malicious routines from the user.