How does Ceprolad Trojan Horse get imitated on a VM accessed only through VPN

Question

I recently received an alert from Microsoft that 'An active 'Ceprolad' malware in a command line was prevented from executing'

How did this come about and what are the best methods of preventing this occurrence in the future?

Note: I have recently installed a license server via LMTools on the VM, during connection troubleshooting I opened a ports relating to this application. These ports were recommended by the developers of the applications. Would this be an issue?

Answer 1

 

Hi @Matt Riddle

I will breakdown the question so that I can provide clarity.

1. What is Win32/Ceprolad?: -Behavior:Win32/Ceprolad.A is a malware identified by Microsoft Windows Security. It targets the core system of Windows to execute a series of commands. The malware gathers data such as system settings, Windows version, and network configuration, which is then sent to a remote attacker for analysis.
2. How did this come about? - This often infects a computer when malicious malware is run on it. Given the changing techniques of dissemination, the origin of this trojan may vary.  Based on your scenario; This may have been because of embedded software or the open port and who/what has access.

Additional information: How malware can infect your PC - Microsoft Support

Next Steps

1. Run a full scan to ensure any remnants of the threat are eliminated.
2. What to do to prevent this in the future. Some programs will also install other software that Microsoft detects as potentially unwanted software e.g. toolbars ensure to opt out of these.

More Information can be found at:

Trojan:Win32/Ceprolad.A threat description - Microsoft Security Intelligence

 If you find the answer above helpful, please Accept the answer to help anyone in the community who might have a similar question to quickly find the solution.