Analysis by: Christopher Daniel So
 PLATFORM:

Windows 2000, XP, Server 2003

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:

  • Threat Type: Trojan

  • Destructiveness: No

  • Encrypted:

  • In the wild: Yes

  OVERVIEW

This Trojan may be dropped by other malware.

It executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.

  TECHNICAL DETAILS

File Size: 75,264 bytes
File Type: DLL
File Compression: Aspack
Memory Resident: Yes
Initial Samples Received Date: 01 Sep 2010
Payload: Downloads files

Arrival Details

This Trojan may be dropped by the following malware:

  • TROJ_DROPPER.OPL

Download Routine

This Trojan accesses the following websites to download files:

  • http://{BLOCKED}f8t.com/r1b/rod/lin.asp
  • http://{BLOCKED}f8t.com/r1b/ttr/lin.asp
  • http://{BLOCKED}f8t.com/r1b/ryh/lin.asp
  • http://{BLOCKED}f8t.com/r1b/fsy/lin.asp
  • http://{BLOCKED}f8t.com/r1b/hbs/lin.asp
  • http://{BLOCKED}f8t.com/r1b/rnf/lin.asp
  • http://{BLOCKED}f8t.com/r1b/rfg/lin.asp
  • http://{BLOCKED}f8t.com/r1b/rwz/lin.asp
  • http://{BLOCKED}f8t.com/r1b/rty/lin.asp
  • http://{BLOCKED}f8t.com/r1b/rjt/lin.asp

It then executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.

  SOLUTION

Minimum Scan Engine: 8.900

Step 1

For Windows XP and Windows Server 2003 users, before doing any scans, please make sure you disable System Restore to allow full scanning of your computer.

Step 2

Scan your computer with your Trend Micro product and note files detected as TROJ_DROPPER.OPM

Step 3

Restart in Safe Mode

[ Learn More ]


Did this description help? Tell us how we did.