TROJ_COBRA.WY

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes the dropped file(s). As a result, malicious routines of the dropped files are exhibited on the affected system.

It connects to certain URLs. It may do this to remotely inform a malicious user of its installation. It may also do this to download possibly malicious files onto the computer, which puts the computer at a greater risk of infection by other threats.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Dropping Routine

This Trojan executes the dropped file(s). As a result, malicious routines of the dropped files are exhibited on the affected system.

Download Routine

This Trojan connects to the following malicious URLs:

• http://{BLOCKED}e.{BLOCKED}p.kr/test/test.txt
• http://{BLOCKED}e.{BLOCKED}eep.kr/121004/jach/Setup_jachget.exe
• http://{BLOCKED}e.{BLOCKED}eep.kr/121004/jach/VaccineForce_blue2.exe

It saves the files it downloads using the following names:

• %User Temp%\Setup_jachget.exe
• %User Temp%\VaccineForce_blue2.exe

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)