X2KM_POWLOAD.OEFO

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It does not have any propagation routine.

It does not have any backdoor routine.

Arrival Details

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Propagation

This Trojan does not have any propagation routine.

Backdoor Routine

This Trojan does not have any backdoor routine.

Information Theft

This Trojan gathers the following data:

• User Name
• Computer Name
• System Type (32-bit or 64-bit)
• Process ID of malware

Other Details

This Trojan does the following:

• It uses the following Powershell to download and execute a malicious code:
  powershell.exe -exec bypass -Noninteractive -windowstyle hidden -e {base-64 encoded string}

It does not exploit any vulnerability.

NOTES:

This Trojan also connects to the URL http://{BLOCKED}.{BLOCKED}.14.193:80/connect to send the gathered information as well as to download and execute a malicious code. As of this writing, the said site is inaccessible.

Upon opening the Excel file, this Trojan displays the following image, possibly to trick the user into enabling macro content: