Trojan.Win32.Waldek

Trojan.Win32.Waldek is a multifunctional Trojan with a modular architecture. Also known as Gootkit and XswKit. The main logic of the Trojan is written in JavaScript (JS) and is run in the context of Node.js, which allows running JS code outside of a browser. The Trojan itself, which is large (approximately 5 MB) due to the built-in JS interpreter, is downloaded by a smaller loader Trojan-Downloader.Win32.Gootkit distributed via the Angler EK exploit pack.

Functionality of the Trojan is aimed at stealing banking information and depends on which modules are installed:

• spyware module – used for remote control and observation (such as taking screenshots, getting a list of running processes, stopping a process, starting VNC access, and performing web injects)
• fs module – used for accessing the file system
• cmdterm module – used for running batch commands

Top 10 countries with most attacked users (% of total attacks)

* Percentage among all unique Kaspersky users worldwide attacked by this malware