TrojanDownloader:W97M/Bartallex.A

Installation

This threat is a malicious macro that can be embedded in a Microsoft Word file. When you open the malicious file, Microsoft Word should show you a security notification to ask whether you want to enable macros. If you enable macros, this threat will run.

We have seen this threat spread in a Word file that is attached to spam emails as a .doc file. See the spam email samples below:

The attached file has a random name, for example:

• invoice_723961.doc
• legal_complaint.doc
• logmein_coupon.doc
• receipt_3458934.doc

Payload

Downloads other malware

The infected .doc file contains a malicious macro script that, when opened, can download and run other malware onto your PC.

The malware uses social engineering tactics to try to get you to enable macro scripting when you view the document, as macro scripts are usually disabled by default in Microsoft Office.

We have seen the malware uses the following fake warning in an attempt to get you to enable macros:

If macros are enabled, the malicious Visual Basic Application (VBA) macro runs when the attachment is opened. It immediately downloads other malware from a remote server. We have seen it download malware from the following servers:

• 91.<removed>.131.49/upd/install.exe
• 91.<removed>.131.49/upd2/install.exe
• st<removed>.eu/wp-content/plugins/wp_add/god.exe

The downloaded file is usually saved and run from %TEMP% using a random file name, for example  %TEMP%\4444.exe. 

We have seen this threat download the following malware:

• TrojanDownloader:Win32/Chanitor.A - malware that can install Backdoor:Win32/Vawtrak.F
• TrojanSpy:Win32/Ursnif.gen!R - a trojan family that tries to steal your sensitive information

We have also seen this threat download a clean PNG image file and saves it with a random file name, for example %TEMP%\savepic.su\5123965.png.

Analysis by Rex Plantado