TROJ_BANLOAD.YZP

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following non-malicious file:

• %Application Data%\ID - contains URL of the remote server

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

Download Routine

This Trojan accesses the following websites to download files:

• http://{BLOCKED}.{BLOCKED}.66.54/pretom7/ptx{num}.html

It saves the files it downloads using the following names:

• %Application Data%\{Machine Name}.jpg - TSPY_BANKER.YZP

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

It then executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.

NOTES:

It connects to the following URL to log infection to malware server:

• http://{BLOCKED}.{BLOCKED}.66.54/pretom7/infx/s1/conta.php?chave=bola&url={Filename and size of the downloaded file} {Language} {Country}