Jorik Trojan — Description & Removal Guide

Jorik is a prolific trojan malware notorious for its skillful exploitation of phishing and social engineering. It thrives on deceptive downloads, email attachments, untrustworthy sources, scams, malvertising, and fake updates. Armed with capabilities like keylogging and media recording, Jorik poses a multifaceted threat to systems and data.

Jorik Trojan Overview

Jorik is formidable trojan-type malware that slithers into its victims’ machines with stealth and precision, ready to execute a series of malicious operations. Trojans, classified as high-risk threats, demand swift eradication from operating systems upon detection to thwart their nefarious intents. The key purpose of this malware is not clear, though detailed analysis of this trojan shows its downloader capabilities.

Jorik Trojan analysis on VirusTotal

Threat Analysis

Once inside a system, Jorik springs into action. First, it decrypts an embedded file, then deposits it into a temporary directory (C:/Users/%username%/Temp). This file serves as a key to establish a connection with the cybercriminals’ Command and Control (C&C) server. With this link, the trojan gains the power to get additional files from this server.

As I mentioned above, Jorik boasting the capability to download and install additional harmful components can trigger an array of infections, spanning from ransomware to trojans and cryptominers. However, these rogue programs have their boundaries – some only inject malicious code, others confine themselves to installing specific modules or infiltrating distinct breeds of malware.

Technical details

Activities in the infected system

File info

crc32: 41B49EC0md5: 98a39525e778e2dc12d61ac200fa08c5name: 98A39525E778E2DC12D61AC200FA08C5.mlwsha1: 2365a1f9446453b0dda4609777f2e6d586e5c54bsha256: 64497afa3609c20f9a33bdfd25cfbefb3385ae24f1f97e3609ba823d838964a1sha512: cb343bdab55a494b6a6887ebb0c71385cafa8ee1fbcec7ea27bbaa83517df69d157184f09397b3133f490430f75219a98d92143a62db9cc25cfb1d2fdc091d51ssdeep: 1536:cInb5/IyQjGP6yF2H74C6oL0c6l2kjnG3xxqtRZLO/A7fslpd3pUk4m44j444n4:cIV/Iy/PKz6lQfcRtGA7fsl73pUFtype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
LegalCopyright: Copyright (C) 2017, dfgirgeththFileVersion: 6.3.6.8ProductVersion: 6.3.6.8Translation: 0x0809 0x04b0

Alternative detection names

Despite its menacing capabilities, Jorik’s modus operandi remains unknown. The prevailing trend in malware infestations leans towards data theft. Certain programs excel in filching files and prying precious information from installed applications, leaving a trail of digital havoc in their wake. So possibly, this trojan may be a part of an infection chain that ends up with stealer or spyware.

The information targeted in infostealer campaigns typically encompasses a wide array of different data. This includes browsing history, Internet cookies, login credentials, personally identifiable information, as well as sensitive financial records. Aside from that, such malware is commonly capable of voice/video recording and keystroke logging.

How did I get infected with Jorik?

Jorik’s infiltration into your computer hinges on a web of cunning strategies, with its primary conduits being phishing and social engineering tactics. These sophisticated maneuvers serve as the foundation for malware proliferation, with the following array of distribution methods serving as the malicious orchestra’s instruments:

• Deceptive downloads. Jorik employs stealthy drive-by downloads, surreptitiously luring unsuspecting users into unwittingly downloading its treacherous payload.
• Email spam. Malicious attachments and insidious links, cunningly embedded within spam emails and messages, entice recipients to set the stage for Jorik’s intrusion.
• Deceptive websites as software sources. Unscrupulous domains and dubious download sources, ranging from freeware and third-party websites to Peer-to-Peer sharing networks, become fertile grounds for Jorik’s dissemination.
• Malicious advertising. Malvertising, the nefarious marriage of advertising and malware, serves as yet another avenue through which Jorik breaches digital defenses.
• Software cracks. Unlawful program activation tools, colloquially known as “cracks,” provide a gateway for Jorik to insinuate itself into unsuspecting systems.
• Forged software updates. Jorik cunningly disguises itself as a legitimate update, capitalizing on users’ trust in order to infiltrate and conquer.

Frequently Asked Questions (FAQ)