TROJ_BANLOAD.PBD

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following component file(s):

• %Windows%\Tasks\FileO.job - moves the downloaded file bitsadmin.exe to system32 folder
• %Windows%\Tasks\Adobe Update.job - automatically runs the malware every system startup

(Note: %Windows% is the Windows folder, which is usually C:\Windows.)

Download Routine

This Trojan accesses the following websites to download files:

• http://{BLOCKED}rneiro1.{BLOCKED}agemdesites.ws/cisco/Cisco.dll
• http://{BLOCKED}rneiro1.{BLOCKED}agemdesites.ws/cisco/manifest.json.exe
• http://{BLOCKED}neiro1.{BLOCKED}dagemdesites.ws/cisco/easy.dll
• http://{BLOCKED}neiro1.{BLOCKED}agemdesites.ws/cisco/icon.png
• http://{BLOCKED}neiro1.{BLOCKED}agemdesites.ws/cisco/bitsadmin.exe

It saves the files it downloads using the following names:

• %Application Data%\Microsoft\Google\bitsadmin.exe
• %Application Data%\Microsoft\Google\Cisco.dll
• %Application Data%\Microsoft\Google\icon.png
• %Application Data%\Microsoft\Google\easy.dll
• %Application Data%\Microsoft\Google\manifest.json

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

It then executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.

NOTES:

However, as of this writing, the files to be downloaded are not available in the server

It connects to the following URL to report system information:

• http://{BLOCKED}neiro1.{BLOCKED}dagemdesites.ws/cisco.asp?TypeDownload=Disable&FileName={malware filename}&ProductName={OS version}&UserName={user name}&MachineName={computer name}&Mac={MAC address}&Version={version}&Volume={volume information}&BitsAdmin={number}