JS_NISEILY.AB

This Trojan may be dropped by other malware.

It executes then deletes itself afterward.

It executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.

Arrival Details

This Trojan may be dropped by the following malware:

• LNK_NISEILY.AB

Installation

This Trojan drops the following non-malicious file:

• %User Temp%\0829.rtf.lnk - shortcut to %User Temp%\0829.rtf

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

It executes then deletes itself afterward.

Download Routine

This Trojan connects to the following URL(s) to download its component file(s):

• http://downfile2.{BLOCKED}arecenter.com/virtual/news/0829.rtf - non-malicious
• http://downfile2.{BLOCKED}arecenter.com/virtual/news/mm.exe - detected as BKDR_KORPLG.ILP

It saves the files it downloads using the following names:

• %User Temp%\0829.rtf - decoy document (non-malicious)
• %User Temp%\iexplore.exe - detected as BKDR_KORPLG.ILP

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

It then executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.

NOTES:

This malware connects to the following URL http://{BLOCKED}.{BLOCKED}.49.18/img?k=316serena123456aaaac&v=1 to load a malicious page. However, as of this writing, the said site is inaccessible.