TROJ_VBINDER.KL
Win32/VB.OTU trojan, Win32/VB.OTU trojan (Eset), VirTool:Win32/Vbinder.BU (Microsoft)
Windows 2000, Windows Server 2003, Windows XP (32-bit, 64-bit), Windows Vista (32-bit, 64-bit), Windows 7 (32-bit, 64-bit)
Threat Type: Trojan
Destructiveness: No
Encrypted:
In the wild: Yes
OVERVIEW
This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
TECHNICAL DETAILS
34,366,642 bytes
EXE
11 Dec 2013
Arrival Details
This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
Installation
This Trojan drops the following files:
- %Application Data%\onload.exe
- %Application Data%\sdsetup.exe
- %Application Data%\yahootoolbarsetup
- %User Temp%\is-{random}.tmp\gtapi.dll
- %User Temp%\is-{random}.tmp\GTBHelper.dll
- %User Temp%\is-{random}.tmp\helper.dll
- %User Temp%\is-{random}.tmp\iMonitor.exe
- %User Temp%\is-{random}.tmp\InnoHelpers.dll
- %User Temp%\is-{random}.tmp\isxdl.dll
- %User Temp%\is-{random}.tmp\PCTLicHelper.dll
- %User Temp%\is-{random}.tmp\PCTLicReset.dll
- %User Temp%\is-{random}.tmp\PCTWSC.dll
- %User Temp%\is-{random}.tmp\SecurityUtil.dll
- %User Temp%\is-{random}.tmp\_isetup
- %User Temp%\is-{random}.tmp\_isetup\_shfoldr.dll
- %User Temp%\Setup Log {yyyy}-{mm}-{dd}#001.txt
(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)
It creates the following folders:
- %User Temp%\conf
- %All User's Profile%\Application Data\TEMP
(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)
Other System Modifications
This Trojan adds the following registry keys:
HKEY_LOCAL_MACHINE\SOFTWARE\Licenses
HKEY_LOCAL_MACHINE\SOFTWARE\PCTools