Trojan.XF.EMOTET.DN
June 13, 2022
ALIASES:
Trojan-Downloader.XLM.Agent (IKARUS)
PLATFORM:
Windows
OVERALL RISK RATING:
DAMAGE POTENTIAL:
DISTRIBUTION POTENTIAL:
REPORTED INFECTION:
INFORMATION EXPOSURE:
Threat Type: Trojan
Destructiveness: No
Encrypted:
In the wild: Yes
OVERVIEW
This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
TECHNICAL DETAILS
File Size: 61,952 bytes
File Type: XLS
Memory Resident: No
Initial Samples Received Date: 13 Jun 2022
Arrival Details
This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
Installation
This Trojan adds the following processes:
- %System%\regsvr32.exe /S {Parent of default Excel save path}\scd1.ocx
- %System%\regsvr32.exe /S {Parent of default Excel save path}\scd2.ocx
- %System%\regsvr32.exe /S {Parent of default Excel save path}\scd3.ocx
- %System%\regsvr32.exe /S {Parent of default Excel save path}\scd4.ocx
(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)
Download Routine
This Trojan saves the files it downloads using the following names:
- {Parent of default Excel save path}\scd1.ocx
- {Parent of default Excel save path}\scd2.ocx
- {Parent of default Excel save path}\scd3.ocx
- {Parent of default Excel save path}\scd4.ocx
Other Details
This Trojan connects to the following possibly malicious URL:
- http://{BLOCKED}thing.com/cgi-bin/xsKuBKuQYhYz/
- https://{BLOCKED}ll.vn/wp-content/k9tSTiW1CosKYJOjxd/
- http://{BLOCKED}.{BLOCKED}.217.250/application/OP4L7MV21hbub4/
- http://{BLOCKED}tner.fr/language/mTbIHL2P12uJ3MJlL/