X2KM_DLOADER.JK

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

As of this writing, the said sites are inaccessible.

Arrival Details

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

Installation

This Trojan drops and executes the following files:

• %User Profile%\Downloads\awareness.doc ← downloader
• %User Profile%\Downloads\update.vbs ← executes awareness.doc
• %User Startup%\start.vbs ← executes VBS file

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.. %User Startup% is the current user's Startup folder, which is usually C:\Documents and Settings\{user}\Start Menu\Programs\Startup on Windows 2000 and XP, and C:\Documents and Settings\{User name}\Start Menu\Programs\Startup on Windows Vista, 7, and 8.)

It adds the following processes:

• rundll.exe

It injects codes into the following process(es):

• rundll.exe

Download Routine

This Trojan connects to the following URL(s) to download its component file(s):

• http://ec2-52-212-203-69.{BLOCKED}est-1.compute.{BLOCKED}aws.com/OUuC

As of this writing, the said sites are inaccessible.

NOTES:

This malware connects to the said remote site to download a shell code which it executes on the affected machine. The behavior of the malware may vary depending on the downloaded code.