W2KM_BARTALEX.ET

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

Arrival Details

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

NOTES:

Once the malicious document is opened, it executes a macro to drop the following files:

Windows Version 5.5 or below:

• %Temp%\adobeacd-updatexp.vbs
• %Temp%\adobeacd-update.bat

Above Windows Version 5.5:

• %User Temp%\adobeacd-update.vbs
• %User Temp%\adobeacd-update.ps1
• %User Temp%\adobeacd-update.bat

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.. %Temp% is the Windows Temporary folder, which is usually C:\Windows\Temp.)

The files adobeacd-updatexp.vbs and adobeacd-update.ps1 access the following links to download files:

• http://{BLOCKED}.{BLOCKED}.131.63/ca/file.exe
• http://{BLOCKED}c.su/5213603.png

It saves the file using the following filename:

• %Temp%\444.EXE - version 5.5 or below
• %User Temp%\444.eXE - above version 5.5

It then executes the downloaded file. As a result, malicious routines of the downloaded file are exhibited on the affected system.

The file adobeacd-update.bat makes sure that the downloaded file is executed and deletes all dropped files after execution.