Home / malware

PDF

Trojan.Mambashim

First posted on 24 July 2015.
Source: Symantec

Aliases :

There are no other names known for Trojan.Mambashim.

Explanation :

Once executed, the Trojan copies itself to the following location:
%AllUsersProfile%\Application Data\[ADJECTIVE][ONE BLANK SPACE][NOUN OR VERB]\[ADJECTIVE][ONE BLANK SPACE][NOUN OR VERB].exe
The Trojan also creates the following files:
%SystemDrive%\Documents and Settings\All Users\Application Data\[ADJECTIVE][ONE BLANK SPACE][NOUN OR VERB]\[ADJECTIVE][ONE BLANK SPACE][NOUN OR VERB].dll%Temp%\[RANDOM CHARACTERS].dll
It then creates the following folder:
%SystemDrive%\Documents and Settings\All Users\Application Data\Application Data\[ADJECTIVE][ONE BLANK SPACE][NOUN OR VERB]\[TEN RANDOM CHARACTERS]
Note:
[NOUN OR VERB] may be a word taken from the following list:
abilityabroadabuseaccessaccidentaccountactactionactiveactivityactoradadditionaddressadministrationadultadvanceadvantageadvertisingadviceaffairaffectafternoonageagencyagentagreementairairlineairportalarmalcoholalternativeambitionamountanalysisanalystangerangleanimalannualansweranxietyanybodyanythinganywhereapartmentappealappearanceappleapplicationappointmentareaargumentarmarmyarrivalartarticleasideaskaspectassignmentassistassistanceassistantassociateassociationassumptionatmosphereattackattemptattentionattitudeaudienceauthoraverageawardawarenessbabybackbackgroundbadbagbakebalanceballbandbankbarbasebaseballbasisbasketbatbathbathroombattlebeachbearbeatbeautifulbedbedroombeerbeginningbeingbellbeltbenchbendbenefitbetbeyondbicyclebidbigbikebillbirdbirthbirthdaybitbitebitterblackblameblankblindblockbloodblowblueboardboatbodybonebonusbookbootborderbossbotherbottlebottombowlboxboyboyfriendbrainbranchbravebreadbreakbreakfastbreastbreathbrickbridgebriefbrilliantbroadbrotherbrownbrushbuddybudgetbugbuildingbunchburnbusbusinessbuttonbuybuyercabinetcablecakecalendarcallcalmcameracampcampaigncancancelcancercandidatecandlecandycapcapitalcarcardcarecareercarpetcarrycasecashcatcatchcategorycausecelebrationcellchainchairchallengechampionchampionshipchancechangechannelchaptercharacterchargecharitychartcheckcheekchemicalchemistrychestchickenchildchildhoodchipchocolatechoicechurchcigarettecityclaimclassclassicclassroomclerkclickclientclimateclockclosetclothescloudclubcluecoachcoastcoatcodecoffeecoldcollarcollectioncollegecombinationcombinecomfortcomfortablecommandcommentcommercialcommissioncommitteecommoncommunicationcommunitycompanycomparisoncompetitioncomplaintcomplexcomputerconcentrateconceptconcernconcertconclusionconditionconferenceconfidenceconflictconfusionconnectionconsequenceconsiderationconsistconstantconstructioncontactcontestcontextcontractcontributioncontrolconversationconvertcookcookiecopycornercostcountcountercountrycountycouplecouragecoursecourtcousincovercowcrackcraftcrashcrazycreamcreativecreditcrewcriticismcrosscryculturecupcurrencycurrentcurvecustomercutcycledaddamagedancedaredarkdatadatabasedatedaughterdaydeaddealdealerdeardeathdebatedebtdecisiondeepdefinitiondegreedelaydeliverydemanddepartmentdeparturedependentdepositdepressiondepthdescriptiondesigndesignerdesiredeskdetaildevelopmentdevicedevildiamonddietdifferencedifficultydigdimensiondinnerdirectiondirectordirtdisasterdisciplinediscountdiscussiondiseasedishdiskdisplaydistancedistributiondistrictdividedoctordocumentdogdoordotdoubledoubtdraftdragdramadrawdrawerdrawingdreamdressdrinkdrivedriverdropdrunkduedumpdustdutyeareartheaseeasteateconomicseconomyedgeeditoreducationeffecteffectiveefficiencyefforteggelectionelevatoremergencyemotionemphasisemployemployeeemployeremploymentendenergyengineengineerengineeringentertainmententhusiasmentranceentryenvironmentequalequipmentequivalenterrorescapeessayestablishmentestateestimateeveningeventevidenceexamexaminationexampleexchangeexcitementexcuseexerciseexitexperienceexpertexplanationexpressionextensionextentexternalextremeeyefacefactfactorfailfailurefallfamiliarfamilyfanfarmfarmerfatfatherfaultfearfeaturefeefeedfeedbackfeelfeelingfemalefewfieldfightfigurefilefillfilmfinalfinancefindingfingerfinishfirefishfishingfixflightfloorflowflowerflyfocusfoldfollowingfoodfootfootballforceforeverformformalfortunefoundationframefreedomfriendfriendshipfrontfruitfuelfunfunctionfuneralfunnyfuturegaingamegapgaragegarbagegardengasgategathergeargenegeneralgiftgirlgirlfriendgivegladglassglovegogoalgodgoldgolfgoodgovernmentgrabgradegrandgrandfathergrandmothergrassgreatgreengrocerygroundgroupgrowthguaranteeguardguessguestguidanceguideguitarguyhabithairhalfhallhandhandlehangharmhathateheadhealthhearingheartheatheavyheighthellhellohelphidehighhighlighthighwayhirehistorianhistoryhitholdholeholidayhomehomeworkhoneyhookhopehorrorhorsehospitalhosthotelhourhousehousinghumanhunthurryhurthusbandiceideaidealifillegalimageimaginationimpactimplementimportanceimpressimpressionimprovementincidentincomeincreaseindependenceindependentindicationindividualindustryinevitableinflationinfluenceinformationinitialinitiativeinjuryinsectinsideinspectioninspectorinstanceinstructioninsuranceintentioninteractioninterestinternalinternationalinternetinterviewintroductioninvestmentinviteironislandissueititemjacketjobjoinjointjokejudgejudgmentjuicejumpjuniorjurykeepkeykickkidkillkindkingkisskitchenkneeknifeknowledgelablackladderladylakelandlandscapelanguagelaughlawlawyerlaylayerleadleaderleadershipleadingleagueleatherleavelectureleglengthlessonletletterlevellibrarylielifeliftlightlimitlinelinkliplistlistenliteraturelivingloadloanlocallocationlockloglonglooklosslovelowlucklunchmachinemagazinemailmainmaintenancemajormakemalemallmanmanagementmanagermannermanufacturermanymapmarchmarkmarketmarketingmarriagemastermatchmatematerialmathmattermaximummaybemealmeaningmeasurementmeatmediamedicinemediummeetmeetingmembermembershipmemorymentionmenumessmessagemetalmethodmiddlemidnightmightmilkmindmineminimumminorminutemirrormissmissionmistakemixmixturemobilemodemodelmommomentmoneymonitormonthmoodmorningmortgagemostmothermotormountainmousemouthmovemoviemudmusclemusicnailnamenastynationnationalnativenaturalnatureneatnecessarynecknegativenegotiationnervenetnetworknewsnewspapernightnobodynoisenormalnorthnosenotenothingnoticenovelnumbernurseobjectobjectiveobligationoccasionofferofficeofficerofficialoiloneopeningoperationopinionopportunityoppositeoptionorangeorderordinaryorganizationoriginalotheroutcomeoutsideovenownerpacepackpackagepagepainpaintpaintingpairpanicpaperparentparkparkingpartparticularpartnerpartypasspassagepassengerpassionpastpathpatiencepatientpatternpausepaypaymentpeacepeakpenpenaltypensionpercentageperceptionperformanceperiodpermissionpermitpersonpersonalpersonalityperspectivephasephilosophyphonephotophrasephysicalphysicspianopickpicturepiepiecepinpipepitchpizzaplaceplanplaneplantplasticplateplatformplayplayerpleasureplentypoempoetpoetrypointpolicepolicypoliticspollutionpoolpoppopulationpositionpositivepossessionpossibilitypossiblepostpotpotatopotentialpoundpowerpracticepreferencepreparationpresencepresentpresentationpresidentpresspressurepricepridepriestprimaryprincipleprintpriorpriorityprivateprizeproblemprocedureprocessproduceproductprofessionprofessionalprofessorprofileprofitprogramprogressprojectpromisepromotionpromptproofpropertyproposalprotectionpsychologypublicpullpunchpurchasepurplepurposepushputqualityquantityquarterqueenquestionquietquitquoteraceradiorainraiserangerateratiorawreachreactionreadreadingrealityreasonreceptionreciperecognitionrecommendationrecordrecordingrecoverredreferencereflectionrefrigeratorrefuseregionregisterregretregularrelationrelationshiprelativereleasereliefremoteremoverentrepairrepeatreplacementreplyreportrepresentativerepublicreputationrequestrequirementresearchreserveresidentresistresolutionresolveresortresourcerespectrespondresponseresponsibilityrestrestaurantresultreturnrevealrevenuereviewrevolutionrewardricerichrideringripriseriskriverroadrockrolerollroofroomroperoughroundroutinerowroyalrubruinrulerunrushsadsafesafetysailsaladsalarysalesaltsamplesandsandwichsatisfactionsavesavingsscalescenescheduleschemeschoolsciencescorescratchscreenscrewscriptseasearchseasonseatsecondsecretsecretarysectionsectorsecurityselectionselfsellseniorsensesensitivesentenceseriesserveservicesessionsetsettingsexshakeshameshapeshareshesheltershiftshineshipshirtshockshoeshootshopshoppingshotshouldershowshowersicksidesignsignalsignaturesignificancesillysilversimplesingsingersinglesinksirsistersitesituationsizeskillskinskirtskysleepsliceslideslipsmellsmilesmokesnowsocietysocksoftsoftwaresoilsolidsolutionsomewheresonsongsortsoundsoupsourcesouthspacesparespeakerspecialspecialistspecificspeechspeedspellspendspiritspiritualspitesplitsportspotsprayspreadspringsquarestablestaffstagestandstandardstarstartstatestatementstationstatusstaysteakstealstepstickstillstockstomachstopstoragestorestormstorystrainstrangerstrategystreetstrengthstressstretchstrikestringstripstrokestructurestrugglestudentstudiostudystuffstupidstylesubjectsubstancesuccesssucksugarsuggestionsuitsummersunsupermarketsupportsurgerysurprisesurroundsurveysuspectsweetswimswimmingswingswitchsympathysystemtabletackletaletalktanktaptargettasktastetaxteateachteacherteachingteamteartechnologytelephonetelevisiontelltemperaturetemporarytennistensiontermtesttextthanksthemetheorythingthoughtthroattickettietilltimetiptitletodaytoetomorrowtonetonguetonighttooltoothtoptopictotaltouchtoughtourtouristtoweltowertowntracktradetraditiontraffictraintrainertrainingtransitiontransportationtrashtraveltreattreetricktriptroubletrucktrusttruthtrytuneturntwisttwotypeuncleunderstandingunionuniqueunituniversityupperupstairsuseuserusualvacationvaluablevaluevariationvarietyvastvegetablevehicleversionvideoviewvillagevirusvisitvisualvoicevolumewaitwakewalkwallwarwarningwashwatchwaterwavewayweaknesswealthwearweatherwebweddingweekweekendweightweirdwelcomewestwesternwheelwhereaswhilewhitewholewifewillwinwindwindowwinewingwinnerwinterwishwitnesswomanwonderwoodwordworkworkerworkingworldworryworthwrapwriterwritingyardyearyellowyesterdayyouyoungyouthzone
[ADJECTIVE] may be a word taken from the following list:
abruptacidicadorableadventurousaggressiveagitatedalertaloofamiableamusedannoyedantsyanxiousappallingappetizingapprehensivearrogantashamedastonishingattractiveaveragebattybeefybewilderedbitingbitterblandblushingboredbravebrightbroadbulkyburlycharmingcheekycheerfulchubbycleanclearcloudycluelessclumsycolorfulcolossalcombativecomfortablecondemnedcondescendingconfusedcontemplativeconvincingconvolutedcooperativecornycostlycourageouscrabbycreepycrookedcruelcumbersomecurvedcynicaldangerousdashingdecayeddeceitfuldeepdefeateddefiantdeliciousdelightfuldepraveddepresseddespicabledetermineddilapidateddiminutivedisgusteddistinctdistraughtdistresseddisturbeddizzydrabdraineddulleagerecstaticelatedelegantemaciatedembarrassedenchantingencouragingenergeticenormousenthusiasticenviousexasperatedexcitedexhilaratedextensiveexuberantfancyfantasticfiercefilthyflatfloppyflutteringfoolishfranticfreshfriendlyfrightenedfrothyfrustratingfunnyfuzzygaudygentleghastlygiddygiganticglamorousgleaminggloriousgorgeousgracefulgreasygrievinggrittygrotesquegrubbygrumpyhandsomehappyharebrainedhealthyhelpfulhelplesshighhollowhomelyhorrifichugehungryhurticyidealimmenseimpressionableintriguedirateirritableitchyjealousjitteryjollyjoyousfilthyflatfloppyflutteringfoolishfranticfreshfriendlyfrightenedfrothyfrustratingfunnyfuzzygaudygentleghastlygiddygiganticglamorousgleaminggloriousgorgeousgracefulgreasygrievinggrittygrotesquegrubbygrumpyhandsomehappyharebrainedhealthyhelpfulhelplesshighhollowhomelyhorrifichugehungryhurticyidealimmenseimpressionableintriguedirateirritableitchyjealousjitteryjollyjoyousjuicyjumpykindlackadaisicallargelazylethallittlelivelylividlonelylooselovelyluckyludicrousmachomagnificentmammothmaniacalmassivemelancholymeltedminiatureminutemistakenmistymoodymortifiedmotionlessmuddymysteriousnarrownastynaughtynervousnonchalantnonsensicalnutritiousnuttyobedientobliviousobnoxiousoddold-fashionedoutrageouspanickyperfectperplexedpetitepettyplainpleasantpoisedpompouspreciouspricklyproudpungentpunyquaintquizzicalrattyreassuredrelievedrepulsiveresponsiveriperobustrottenrotundroughroundsaltysarcasticscantscaryscatteredscrawnyselfishshaggyshakyshallowsharpshinyshortsilkysillyskinnyslimyslipperysmallsmarmysmilingsmoggysmoothsmugsoggysolidsoresoursparklingspicysplendidspotlesssquarestalesteadysteepresponsivestickystormystoutstraightstrangestrongstunningsubstantialsuccessfulsucculentsuperficialsuperiorswankysweettarttastyteenytendertenseterribletestythankfulthickthoughtfulthoughtlesstighttimelytrickytritetroubledtwitterpatedunevenunsightlyupsetuptightvastvexedvictoriousvirtuousvivaciousvividwackywearywhimsicalwhoppingwickedwittywobblywonderfulworriedyummyzanyzealouszippy
Next, the Trojan connects to one or more of the following command-and-control (C&C) servers:
findville.xyzlevelstate.xyzmodelshared.xyznamehelper.xyzparserword.xyzpositivejob.xyzproviderstore.xyzproviderzip.xyzthismode.xyzversionwind.xyz
The Trojan may then download potentially malicious files onto the compromised computer.

Last update 24 July 2015

 

TOP