Threat Database Trojan Downloader Gen:Variant.Downloader.167


By GoldSparrow in Trojan Downloader

Threat Scorecard

Threat Level: 90 % (High)
Infected Computers: 42
First Seen: May 29, 2014
Last Seen: June 12, 2022
OS(es) Affected: Windows

The Gen:Variant.Downloader.167 Trojan has caught the attention of PC security analysts, not least because Gen:Variant.Downloader.167 includes a bible quote in its attack. Gen:Variant.Downloader.167 is distributed using IM (Instant Messaging) platforms such as Yahoo and the Facebook chat. Malware analysts have detected Gen:Variant.Downloader.167 attacks throughout Europe in the last few weeks and, more recently, in the United States and Canada. Gen:Variant.Downloader.167 is disguised as an instant message from an online contact inviting the computer user to download an application to view certain pictures. This supposed application contains threatening code that compromises the victim's computer and attempts to spread to the victim's online contacts. Gen:Variant.Downloader.167 affects computers using the Windows operating system and uses instant messaging platforms to spread from one victim to another.

The Unique Characteristics of Gen:Variant.Downloader.167

One particularly unusual feature of Gen:Variant.Downloader.167 is that Gen:Variant.Downloader.167 uses verses from the bible as the decryption keys for Gen:Variant.Downloader.167's data. So far, Gen:Variant.Downloader.167 uses verses from the first epistle of Paul to the Corinthians, hiding its data between Bible verses and using an encryption algorithm. This is a curious feature that does not seem to be present in other threats, although it may not mean anything. PC security analysts believe that Gen:Variant.Downloader.167 is used to generating money from collected information and distribution of other threats.

How Third Parties may Profit from Gen:Variant.Downloader.167

The main goal of a Gen:Variant.Downloader.167 infection is to profit by gathering information that may be sold to a third party. Gen:Variant.Downloader.167 or threats associated with Gen:Variant.Downloader.167 may gather information such as online banking data or online passwords. This data is transmitted to a third party and then may be sold to ill-minded persons for use in online hoaxes and identity theft. These types of tactics pop up regularly on Facebook. In 2013, there was a widely distributed threat infection that also spread through Facebook using instant messages promising naked pictures to the victim's Facebook contacts. Computer users should be educated to spot these types of obvious deceiving tactics to avoid infecting their computers through threatening links spread using social engineering.


Most Viewed