Home Malware Programs Trojans TROJ_DROPPER.IK

TROJ_DROPPER.IK

Posted: July 17, 2013

Threat Metric

Threat Level: 9/10
Infected PCs: 3,019
First Seen: July 17, 2013
Last Seen: March 25, 2023
OS(es) Affected: Windows

TROJ_DROPPER.IK is a Trojan that is a part of the targeted attacks, which hit Asian and European government agencies. Chinese media organizations are also targeted by this malware attack. TROJ_DROPPER.IK is distributed via a spam email, which claims to come from the Chinese Ministry of National Defense, although it seems to have been sent from a Gmail account and does not use a Chinese name. The document added to the fake email includes a malicious attachment, which exploits a vulnerability (CVE-2012-0158) in Microsoft Office (all versions from Office 2003 to Office 2010 are affected) that was patched more than a year ago. The exploit is used to download a backdoor Trojan onto the infected computer system, which steals login credentials for websites and email accounts from Internet Explorer and Microsoft Outlook. It also opens a fake legal document to make the victimized recipient believe that nothing malicious happened. The stolen information is uploaded to two IP addresses, both of which are located in Hong Kong. The unsolicited email message was sent to 16 officials, which represent European countries alone. The subject of the bogus email and the attached document is of interest to the targets.

Loading...