Get on-the-go access to the latest insights featured on our Trustworthy Computing blogs.
We recently came across an interesting threat that we detect as TrojanDownloader:Win32/Nemim.gen!A.
This particular malware is a trojan downloader, and is capable of deleting its downloaded component files in a way that makes them essentially unrecoverable. This prevents the files from being isolated and analysed. Thus, during analysis of the downloader, we may not easily find any downloaded component files on the system; even when using file recovery tools, we may see somewhat suspicious deleted file names but we may be unable to recover the correct content of the file.
Most URLs that this trojan attempts to connect to for downloading are currently unavailable, but we got lucky and were able to find some of its components to investigate further.
Below are the component files that we found that this malware downloads and executes, the ones that will eventually be deleted by the malware itself:
As you may know, most downloaders are just a medium to deliver the main malware after which they will not be needed on the system anymore, but this downloader is a bit different in the way that it is the medium and also the main component.
Sometimes, when we don't have any evidence of what an individual downloads, we cannot be sure what the result of infection will be. Occasionally we can't replicate the downloader if the URLs are unavailable, so it can be difficult to know how to mitigate the threat. In the case of this downloader, however, we've observed it downloading a password stealer. As such, if you're infected with TrojanDownloader:Win32/Nemim.gen!A, we recommend you change all account passwords after you've cleaned your system, as it's likely you've also encountered PWS:Win32/Nemim.A.
We also recommend, as always, to keep your security products updated with the latest definitions to avoid infection. A complete antivirus solution such as Microsoft Security Essentials detects and removes all the threats mentioned in this blog. Jonathan San Jose MMPC Melbourne