Trojan.PS1.EMANSREPO.A

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

As of this writing, the said sites are inaccessible.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan adds the following processes:

• cmd /c "%User Temp%\PythonTemp\run.bat"

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It creates the following folders:

• %User Temp%\PythonTemp

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Other System Modifications

This Trojan deletes the following folders:

• %User Temp%\PythonTemp

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Process Termination

This Trojan terminates the following processes if found running in the affected system's memory:

• python

Download Routine

This Trojan connects to the following website(s) to download and execute a malicious file:

• http://{BLOCKED}.{BLOCKED}.{BLOCKED}.185/preoffice.zip

It saves the files it downloads using the following names:

• %User Temp%\PythonTemp\office.zip

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

As of this writing, the said sites are inaccessible.

Other Details

This Trojan does the following:

• It checks if the directory %User Temp%\PythonTemp already exists.
  • If not, it will do the following:
    • Create the said directory.
    • Connect to http://{BLOCKED}.{BLOCKED}.{BLOCKED}.185/preoffice.zip to download a malicious zip file.
    • Unzip the downloaded file to %User Temp%\PythonTemp.
    • Execute %User Temp%\PythonTemp\run.bat.
    • Terminate processes with the name "python".
    • Delete the directory %User Temp%\PythonTemp.
    • If all said routines are successful, it deletes itself
  • If it exists, it terminates itself.