TROJ_RBOT.FOP
VirTool:Win32/DelfInject.gen!BI(Microsoft)
Windows 2000, Windows Server 2003, Windows XP (32-bit, 64-bit), Windows Vista (32-bit, 64-bit), Windows 7 (32-bit, 64-bit)
Threat Type: Trojan
Destructiveness: No
Encrypted:
In the wild: Yes
OVERVIEW
This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
TECHNICAL DETAILS
658,944 bytes
Other
Yes
10 May 2013
Arrival Details
This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
Installation
This Trojan drops the following copies of itself into the affected system:
- %All Users Profile%\{random folder 1}\{random folder 2}\{random folder 3}\{random folder 4}\{random folder 5}\{random folder 6}\{random}.dat
(Note: %All Users Profile% is the All Users or Common profile folder, which is C:\Documents and Settings\All Users in Windows 2000, XP, and Server 2003, and C:\ProgramData in Windows Vista and 7.)
It creates the following folders:
- %All Users Profile%\{random folder 1}
- %All Users Profile%\{random folder 1}\{random folder 2}
- %All Users Profile%\{random folder 1}\{random folder 2}\{random folder 3}
- %All Users Profile%\{random folder 1}\{random folder 2}\{random folder 3}\{random folder 4}
- %All Users Profile%\{random folder 1}\{random folder 2}\{random folder 3}\{random folder 4}\{random folder 5}
- %All Users Profile%\{random folder 1}\{random folder 2}\{random folder 3}\{random folder 4}\{random folder 5}\{random folder 6}
(Note: %All Users Profile% is the All Users or Common profile folder, which is C:\Documents and Settings\All Users in Windows 2000, XP, and Server 2003, and C:\ProgramData in Windows Vista and 7.)
Other Details
This Trojan connects to the following possibly malicious URL:
- http://{BLOCKED}lo.co.cc
- http://server1.{BLOCKED}2369.codisk.com