Trojan.Mdropper.AC
Trojan.Mdropper.AC is a malware loader/dropper that Microsoft previously identified as exploiting CVE-2009-0238, a Microsoft Excel remote code execution vulnerability, in real-world attacks. The vulnerability is triggered when a victim opens a specially crafted Excel file containing a malformed object, leading to memory corruption and arbitrary code execution with the privileges of the affected user. Supporting content states that Trojan.Mdropper.AC was first observed exploiting this flaw in February 2009 and was used to deliver additional malware in follow-on attacks. The associated vulnerability affected multiple Microsoft Office and Excel products, including Excel 2000 SP3, 2002 SP3, 2003 SP3, 2007 SP1, Excel Viewer 2003 Gold and SP3, the Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1, and Excel in Microsoft Office 2004 and 2008 for Mac. No specific threat actor, targeted industry, or standalone indicators of compromise for Trojan.Mdropper.AC are provided in the content.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
CISA confirmed shortly after Microsoft rolled out 165 patches on April 14 that CVE-2009-0238 (9.3), first published on February 24, 2009, was being abused in active attacks. It added the bug to its Known Exploited Vulnerability (KEV) catalog. We know that it's a remote code execution (RCE) issue that attackers can trigger by convincing victims to open a specially crafted Excel document that "includes a malformed object." | Microsoft notified the community and issued a fix for CVE-2009-0238 when it was first discovered being exploited by Trojan.Mdropper.AC, a loader used to deliver other malware in follow-on attacks.
Techniques & procedures
3 distinct techniques documented for this family, organized by ATT&CK tactic.
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A malware sample/family referenced as exploiting CVE-2009-0238 via specially crafted Excel files to achieve remote code execution on affected systems.
A loader used to deliver other malware in follow-on attacks.
A loader used to deliver other malware in follow-on attacks.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.