Win32/Oficla

Installation

• UPS_document_Nr28451.zip 
• DHL_document_Nr39153.zip
• Western_Union_documento_Nr7821.zip

Payload

• Win32/Hiloti - a family of trojans that downloads and executes arbitrary files, and moderates an affected user's online experience.
• Win32/FakeScanti -a family of trojans that claims to scan for malware and display fake warnings of “malicious programs and viruses”. They then inform the user that they need to pay money to register the software in order to remove these non-existent threats.
• Win32/Cutwail - a family of trojans which downloads and executes arbitrary files. Downloaded files may be executed from disk or injected directly into other processes. Whilst the functionality of the files that are downloaded is variable, Cutwail usually downloads a Trojan which is able to send spam. Cutwail also employs a rootkit and other defensive techniques to avoid detection and removal.
• Win32/Zbot - a family of trojans that steals passwords and allows unauthorized access and control of an affected computer.
• Win32/Alureon - a family of data-stealing trojans. These trojans allow an attacker to intercept incoming and outgoing Internet traffic in order to gather confidential information such as user names, passwords, and credit card data. The Win32/Alureon trojan may also allow an attacker to transmit malicious data to the infected computer. The trojan may modify DNS settings on the host computer to enable the attacker to perform these tasks. Therefore it may be necessary to reconfigure DNS settings after the trojan is removed from the computer.
• Win32/FakeRean -a family of trojans that claims to scan for malware and display fake warnings of “malicious programs and viruses”. They then inform the user that they need to pay money to register the software in order to remove these non-existent threats.
• Win32/Sefnit - a family of trojans that moderates an affected user's online experience.
• Win32/Bamital - a family of trojans that modifies web search queries and display advertisements