W97M/Kukudro.C Trojan
W97M/Kukudro.C is a macro based Trojan dropper for Microsoft Word. The Trojan arrives as a .zip in an e-mail attachment that contains a Word document with random name or the attachment could just be a word document. When this word document is opened on a victim machine, the macro silently executes and extracts an executable file (mWChEU.exe). It then executes mWChEU.exe (we detect this as W32/Sality.X).The auto execution of Microsoft Word Macros is due to the exploit MS01-034 (discovered April 23, 2001, patched June 21, 2001). This is mostly present in out-of-date systems. Once installed, the trojan attempts to go one of several websites to download DLL files to take control of certain applications. Most antivirus programs are aware of this trojan so always use antivirus software and always be safe.
Related Posts