Trojan.X97M.EMOTET.UIOIBEOB
HEUR:Trojan.Script.Generic (KASPERSKY); TrojanDownloader:O97M/Emotet.RKC!MTB (MICROSOFT)
Windows
![](/vinfo/imgFiles/legend.jpg)
Threat Type: Trojan
Destructiveness: No
Encrypted:
In the wild: Yes
OVERVIEW
This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
However, as of this writing, the said sites are inaccessible.
TECHNICAL DETAILS
Arrival Details
This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
Installation
This Trojan adds the following processes:
- %System%\regsvr32.exe /S {Parent of default Excel save path}\wdusx1.ocx
- %System%\regsvr32.exe /S {Parent of default Excel save path}\wdusx2.ocx
- %System%\regsvr32.exe /S {Parent of default Excel save path}\wdusx3.ocx
(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)
Other Details
This Trojan connects to the following possibly malicious URL:
- http://{BLOCKED}.{BLOCKED}.{BLOCKED}.55/2021/z/
- http://{BLOCKED}.{BLOCKED}.{BLOCKED}.243/dealspot/SvebxVmFucz/
- https://{BLOCKED}me.gr/test/SSzbOkk633/
However, as of this writing, the said sites are inaccessible.