Trojan.Win32.Waldek

Detect Date 06/28/2016
Class Trojan
Platform Win32
Description

Trojan.Win32.Waldek is a multifunctional Trojan with a modular architecture. Also known as Gootkit and XswKit. The main logic of the Trojan is written in JavaScript (JS) and is run in the context of Node.js, which allows running JS code outside of a browser. The Trojan itself, which is large (approximately 5 MB) due to the built-in JS interpreter, is downloaded by a smaller loader Trojan-Downloader.Win32.Gootkit distributed via the Angler EK exploit pack.

Functionality of the Trojan is aimed at stealing banking information and depends on which modules are installed:

  • spyware module – used for remote control and observation (such as taking screenshots, getting a list of running processes, stopping a process, starting VNC access, and performing web injects)
  • fs module – used for accessing the file system
  • cmdterm module – used for running batch commands

Geographical distribution of attacks by the Trojan.Win32.Waldek family

waldek
Geographical distribution of attacks during the period from 28 June 2015 to 28 June 2016

Top 10 countries with most attacked users (% of total attacks)

Country % of users attacked worldwide*
1 India 16.90
2 Vietnam 14.05
3 Mexico 5.22
4 Indonesia 4.38
5 Algeria 4.35
6 Iran 3.88
7 Bangladesh 3.15
8 Turkey 2.97
9 Philippines 2.33
10 Malaysia 2.27

* Percentage among all unique Kaspersky users worldwide attacked by this malware