The Asruex Trojan is a dangerous malware threat which is designed for Microsoft Windows computers. It can be acquired from various sources, every attack campaign can focus on one specific tactic. Usually virus infections like this one are made by interacting with an infected file — this can be either a macro-infected document or a hacker-made software installer. They are often made by taking the legitimate files from their official sources and modifying them with the necessary virus code. Other data can also be affected. All kinds of other data may be used as well — this includes malicious plugins for web browsers and etc. In other cases the hackers can use a direct attacks that will look for system vulnerabilities and weaknesses. If any are found then the Asruex Trojan will be installed.
This particular threat is known for being spread using a multitude of weaknesses. It is set against both end users and servers. After the infection has been made the Asruex Trojan can download other threats, launch multiple dangerous modules and install a cryptocurrency miner which will run a sequence of performance-demanding tasks.
|Type||Malware, Trojan, Miner|
|Short Description||A dangerous malware which can launch a miner and start a Trojan module.|
|Symptoms||The victims may notice performance issues and can get infected with other malware.|
|Distribution Method||Common distribution tactics and direct web attacks.|
|Detection Tool|| See If Your System Has Been Affected by Asruex Trojan |
Malware Removal Tool
|User Experience||Join Our Forum to Discuss Asruex Trojan.|
Asruex Trojan – How Did I Get It
The Asruex Trojan is a dangerous malware release which has been active since 2015 where the first version was released. Subsequent iterations are launched by different hacking groups and using tacics that are relevant to the chosen end targets at the time of the campaigns. The original distribution of the malware threat was done by sending out malware shortcut data which were sent to the targret users. When these files are opened by the victims a small-sized script (dropper) will download the rest of the Trojan and place it inside image files which are very hard to identify as malware. The end goal is to infect not only a single host, but the whole network.
The latest iteration of the Asruex Trojan has been uncovered in a global attack detected a few days ago. The hackers are using malicious PDF files as payload carriers of the threat. They are being used in phishing campaigns that can take various forms — both as hacker-made phishing sites or email messages that are sent to the users. They will impersonate services or companies and manipulate the recipients and visitors into downloading and running the prepared documents. Usually they include macros which are prompted to be run by the users. The hacker-created sites will be hosted on similar sounding domain names to the ones which are copied.
Furthermore the new versions of the Asruex Trojan make use of two specific vulnerabilities which the hackers attempt to exploit:
- CVE-2012-0158 — The ListView, ListView2, TreeView, and TreeView2 ActiveX controls in MSCOMCTL.OCX in the Common Controls in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Office 2003 Web Components SP3; SQL Server 2000 SP4, 2005 SP4, and 2008 SP2, SP3, and R2; BizTalk Server 2002 SP1; Commerce Server 2002 SP4, 2007 SP2, and 2009 Gold and R2; Visual FoxPro 8.0 SP1 and 9.0 SP2; and Visual Basic 6.0 Runtime allow remote attackers to execute arbitrary code via a crafted (a) web site, (b) Office document, or (c) .rtf file that triggers “system state” corruption, as exploited in the wild in April 2012, aka “MSCOMCTL.OCX RCE Vulnerability.
- CVE-2010-2883 — Stack-based buffer overflow in CoolType.dll in Adobe Reader and Acrobat 9.x before 9.4, and 8.x before 8.2.5 on Windows and Mac OS X, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a PDF document with a long field in a Smart INdependent Glyphlets (SING) table in a TTF font, as exploited in the wild in September 2010. NOTE: some of these details are obtained from third party information.
For the purpose of infecting as many victim hosts as possible in forthcoming camapigns the hackers may use other tactics as well. Common ones include the inclusion of the installation code in payload carriers or being part of a more complex attack campaign.
Asruex Trojan – What Does It Do
As soon as the relevant Asruex Trojan infection is made the built-in sequence will be run.One of the first actions that are run is the thorough and extensive information gathering which includes the following data: running processes, module versions, file names and disk name strings. All of this is done in order to check whether or not the virus is running inside a debug environment or virtual machine. This security bypass check will make the virus run only if there is no such service installed on the computer.
It will proceed by searching for available network shares and installing itself on other devices on the network if possible, note that this can be done with attached removable storage devices as well. Malware of this type attempt to install backdoor modules allowing the hackers to take over control of the hosts, steal data and spy on the victims.
How to Remove Asruex Trojan
In order to fully remove Asruex from your computer system, we recommend that you follow the removal instructions underneath this article. If the first two manual removal steps do not seem to work and you still see Asruex or programs, related to it, we suggest what most security experts advise – to download and run a scan of your comptuer with a reputable anti-malware program. Downloading this software will not only save you some time, but will remove all of Asruex files and programs related to it and will protect your computer against such intrusive apps and malware in the future.