Threat Description

Trojan-Downloader: W32/Oficla.AE

Details

Category: Malware
Type: Trojan-Downloader
Platform: W32
Aliases: Trojan-Downloader:W32/Oficla.AE, Gen:Variant.Bredo.4, Packed.Win32.Krap.an, TrojanDropper:Win32/Oficla (Microsoft), Win32/Oficla.GQ (Other) Mal/EncPk-NS (Sophos)

Summary


Trojan-Downloader:W32/Oficla.AE is distributed as an attachment to fake e-mail messages; once installed, the trojan-downloader connects to a remote server.



Removal


Automatic action

Once detected, the F-Secure security product will automatically disinfect the suspect file by either deleting it or renaming it.

More scanning & removal options

More information on scanning or removal options is available in the documentation for your F-Secure security product on the Downloads section of our Home - Global site.

You may also refer to the Knowledge Base on the F-Secure Community site for more information.

Contact Support

For further assistance, F-Secure customers can request support online via the Request support or the Chat forms on our Home - Global site.



Technical Details


Propagation

Oficla.AE is distributed as executable or zipped files attached to misleading e-mail messages. Some of the most common messages used to deliver this trojan involve fake offers for iTunes Gift certificates or for Amazon.com orders; other attachments are disguised as resumes.The text in the e-mail message entices the unsuspecting user to launch the attached file, which installs and executes the trojan.

Installation

Once the attached executable file is launched, the trojan creates the following files:

  • %Temp%\1.tmp
  • %System%\pgsb.lto

It also makes changes to the Windows Registry to ensure the installed copy is launched when the computer is started up.

Activity

Once installed on the computer, the trojan opens a connection to a remote server, from which it may download additional malicious programs.






SUBMIT A SAMPLE

Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Now

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

Learn More