TROJ_DLDR.HB

This malware is involved in the cyber attacks that targeted specific users in South Korea during March of 2013. It enters systems through a spammed mail purporting to come from a major banking organization. It downloads and runs malware on affected systems, which may result in malicious routines being exhibited.

To get a one-glance comprehensive view of the behavior of this Trojan, refer to the Threat Diagram shown below.

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Dropping Routine

This Trojan drops the following files:

• %System%\inhtm.htm

(Note: %System% is the Windows system folder, which is usually C:\Windows\System32.)

Download Routine

This Trojan accesses the following websites to download files:

• http://{BLOCKED}ges.adobe.com/www.adobe.com/ubi/template/identity/adobe/screen/gnav.css (saved as %System%\gscreem.exe)
• http://{BLOCKED}85.com/uploads/fb9c6013f1b269b74c8cd139471b96fc/feng.jpg (saved as %System%\hzcompl.dll)
• http://s1.{BLOCKED}n.net/editor/services/hanmailex/5.11.54/js/editorall.js (saved as %System%\logda.dat)
• http://cardimage.{BLOCKED}ncard.com/img/email/general/btn_carduse.giff (saved as %System%\cutecat.gif)
• hxxp://www.{BLOCKED}lower.net/board/images/start_car.gif (saved as %System%\{random file name}.dll) ) - detected as WORM_STTKR.A
• http://{BLOCKED}daum.net/hanmailex-static/alarm/Notifier.swf (saved as %System%\hinredfh.exe)
• http://{BLOCKED}g.nate.com/mail/img/button/btn_mycomputer.gif (saved as %System%\sotd.dll)
• http://www.{BLOCKED}a.com/public/home_new/images/s/baidu.gif (saved as %System%\logdamain.dat)
• http://www.{BLOCKED}oxylists.net/img/google.bmp (saved as %System%\tefrcft.gif)

NOTES:

This Trojan opens the dropped file %System%\inhtm.htm.