VBS_BANLOAD.YWNOC
ALIASES:
TrojanDownloader:VBS/Banload.BF (Microsoft), VBS.Downloader.Trojan (Symantec), VBS/TrojanDownloader.Agent.NXR (ESET)
PLATFORM:
Windows
OVERALL RISK RATING:
DAMAGE POTENTIAL:
DISTRIBUTION POTENTIAL:
REPORTED INFECTION:
INFORMATION EXPOSURE:
Threat Type: Trojan
Destructiveness: No
Encrypted:
In the wild: Yes
OVERVIEW
This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users.
TECHNICAL DETAILS
File Size:
1,942 bytes
File Type:
VBS
Initial Samples Received Date:
18 Feb 2016
Arrival Details
This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users.
Download Routine
This Trojan saves the files it downloads using the following names:
- C:\ProgramData\d{random}\proxyfirewall.zip
Other Details
This Trojan connects to the following possibly malicious URL:
- http://script.{BLOCKED}iosjoaodoleite.com/proxyfirewall.zip
It does the following:
- It extracts and executes proxyfirewall.exe from proxyfirewall.zip. The extracted file is placed in the same folder as proxyfirewall.zip