Octopus Trojan

A new harmful malicious application has been added to the list of malicious software spread actively by cyber criminals these days. Octopus Trojan is the name malware researchers have given to it. As numerous tests run by specialists have shown, this infection is far from being a typical Trojan. This malicious application differs from other threats that have been put by specialists under the Trojan category in the sense that it targets Central Asian diplomatic organizations primarily. In other words, it is not very likely that ordinary users will ever encounter it. Of course, they cannot be careless and/or keep their PCs unprotected because cyber criminals behind it might start distributing this infection with the intention of infecting ordinary computer users one day as well. What else makes Octopus Trojan quite a unique piece of malware is that this Trojan infection might be associated with DustSquad, which is known to be a cyber espionage actor. Diplomatic organizations who detect Octopus Trojan on their computers must remove this threat immediately because this threat might enable cyber criminals to access victims’ computers remotely, which is definitely no fun. Needless to say, if there are any ordinary computer users who have encountered Octopus Trojan, they must eliminate it immediately as well.

Even though it is usually not that easy to detect the Trojan infection on the system, there are some signs showing that this threat is active on the system. Speaking about Octopus Trojan, it can be detected easily with the help of an antimalware scanner. Alternatively, users who suspect they may be infected with Octopus Trojan can check the Startup folder (%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup). If a new file named Java.exe can be located in this folder, Octopus Trojan must be active on the system and needs to be removed as soon as possible. It is a sin to keep such a serious threat active on the system because it might cause a lot of trouble, including problems linked to security and privacy. Once Octopus Trojan is launched, it gives the actors behind malware an opportunity to perform various operations without the victim’s knowledge. For example, it might be used to delete files/important information, apply various changes on the affected system and alter default settings, copy files/data, and, finally, download additional files and possibly malicious applications from the web or its C&C server. Generally speaking, once cyber criminals behind Octopus Trojan gain remote access to the affected computer, they might start spying on the victim, steal sensitive information, and install malware. Of course, these are only a few possible malicious activities cyber criminals may perform.

Threat actors are constantly looking for new ways to infect computers with malware and then employ it to perform certain malicious activities like stealing personal information from users. To malware researchers’ surprise, Octopus Trojan is not distributed using the good old distribution methods too. As has been observed by malware researchers, this Trojan infection is distributed as a new version of Telegram, a popular and legitimate online messenger that ensures communication anonymity. Usually, it travels as a .zip archive, as research has shown. It takes time for victims to realize that the file they have downloaded is not associated with Telegram in any way, so cyber criminals usually manage to steal some sensitive information from the victim’s computer before malware is detected and removed by the victim. Organizations, companies, and individual users cannot let themselves exist without a reputable antimalware tool installed on their computers today. There are hundreds of harmful infections that are waiting for a perfect opportunity to slither onto their computers unnoticed and help cyber criminals to achieve their goals.

Octopus Trojan can be removed from the affected computer either manually or automatically. Without a doubt, deleting threats with an antimalware scanner is always easier than erasing them manually. If you still opt for the manual removal, you will need to erase the original folder containing malicious components and some other components it creates once it is launched. You must delete them all so that this Trojan infection could not repair itself and start working on your system again like nothing happened.

Delete Octopus Trojan

1. Check %USERPROFILE%\Desktop, %USERPROFILE%\Downloads, %APPDATA%, or another folder you keep your downloads in.
2. Locate the folder containing the following files:

• CsvHelper.dll
• settings.json
• Telegram Messenger.exe
• TelegramApi.dll

3. Delete the folder with all the files completely.
4. Access %APPDATA%.
5. Remove .profiles.ini.
6. Delete Java.exe from the Startup folder in %APPDATA% (%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup).
7. Empty Trash.
8. Scan your system with a diagnostic antimalware scanner to make sure your system is clean.