BANLOAD

BANLOAD malware variants arrive on the systems as files dropped by other malware or as files downloaded unknowingly by users when visiting malicious sites. When executed, these connect to malicious URLs to download other malware on already infected systems which leads to further infection. BANLOAD variants are known to download BANKER malware variants.

In 2010, cybercriminals took advantage of the Haiti earthquake as a spam lure. The spammed messages written in Portuguses tricked users into clicking a link that supposedly contains photos of the earthquake. This led to a malicious website that downloads TROJ_BANLOAD.JAE.

Cybercriminals also copied the site of Ministerio do Trabalho e Emprego, or the Ministry of Labor and Employment in Brazil to spread TROJ_BANLOAD.JMO. When executed, it gathers email addresses and downloads BANKER variants.

Installation

This Trojan drops the following copies of itself into the affected system:

• %System%\incognito.exe
• %Program Files%\Common Files\Files.exe
• %System%\aqlb.hjo
• %Windows%\system\{malware file name}.exe

(Note: %System% is the Windows system folder, which is usually C:\Windows\System32.. %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000, Server 2003, and XP (32-bit), Vista (32-bit), and 7 (32-bit), or C:\Program Files (x86) in Windows XP (64-bit), Vista (64-bit), and 7 (64-bit).. %Windows% is the Windows folder, which is usually C:\Windows.)

It drops the following files:

• %Windows%\Envia.txt
• %User Profile%\fxconfig.bat
• %Current%\{malware name}-up.txt
• %Program Files%\Common Files\Microsoft Shared\Web Folders\MSONSEXT409.dll

(Note: %Windows% is the Windows folder, which is usually C:\Windows.. %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.. %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000, Server 2003, and XP (32-bit), Vista (32-bit), and 7 (32-bit), or C:\Program Files (x86) in Windows XP (64-bit), Vista (64-bit), and 7 (64-bit).)

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
{random string} = "{malware path and file name}.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Active Setup\Installed Components\ {ADEEAF15-7FE8-DEDD-3FFF-4DF56EBB1DFB}
StubPath = "{malware path and file name}.exe"

It modifies the following registry entry(ies) to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
Shell = "Explorer.exe rundll32.exe {malware file name) lhoweid"

(Note: The default value data of the said registry entry is Explorer.exe.)

Other Details

This Trojan connects to the following possibly malicious URL:

• http://{BLOCKED}ana-walker.com/site/msdos.exe
• http://www.{BLOCKED}rg.br/v2/env/msdos.exe
• http://www.{BLOCKED}kanan.net//espace_pro/msdos.exe
• http://www.{BLOCKED}eton.ru/por/setup64.exe
• http://{BLOCKED}chomes.in/images/images.rar
• http://{BLOCKED}olhado.com.br/js/images.rar
• http://{BLOCKED}l-levata.com/js/images.rar
• http://{BLOCKED}.com/js/images.rar
• http://{BLOCKED}x-arq.com/js/images.rar
• http://{BLOCKED}igoseamigos2010.kit.net/images.rar
• http://{BLOCKED}lacionandoamigos.kit.net/images.rar
• http://{BLOCKED}lpemacla.kit.net/images.rar
• http://{BLOCKED}nanet2006.kit.net/images.rar
• http://{BLOCKED}usamonteloavalanche.kit.net/images.rar
• http://{BLOCKED}igossysters.kit.net/images.rar
• http://{BLOCKED}perbonus.kit.net/images.rar
• http://{BLOCKED}amigos2010.kit.net/images.r
• http://www.{BLOCKED}nvirtual.com/index.php
• http://www.{BLOCKED}a.net/image/top_02.gif
• http://{BLOCKED}.{BLOCKED}.0.28/img/imag1.gif
• http://{BLOCKED}x.mogsoft.de/gallery2dir/themes/ice/compactone.exe
• http://{BLOCKED}x.mogsoft.de/gallery2dir/themes/ice/compress.exe