W2KM_VLOAD.A

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

Arrival Details

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

NOTES:

Once the malicious document is opened, it executes a macro to drop the following files:

Windows Version 5.5 or below:

• %Temp%\adobeacd-update.vbs
• %Temp%\adobeacd-update.bat

Above Windows Version 5.5:

• %User Temp%\adobeacd-update.vbs
• %User Temp%\adobeacd-update.bat

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.. %Temp% is the Windows Temporary folder, which is usually C:\Windows\Temp.)

The file "adobeacd-update.vbs" accesses the following link to download a file:

• http://{BLOCKED}sjkals.zabix.net/444.exe

It saves the file using the following filename:

• %Temp%\444.exe - version 5.5 or below (detected as BKDR_VAWTRAK.DOKR)
• %User Temp%\444.exe - above version 5.5 (detected as BKDR_VAWTRAK.DOKR)

It then executes the downloaded file. As a result, malicious routines of the downloaded file are exhibited on the affected system.

The file "adobeacd-update.bat" makes sure that the downloaded file is executed and deletes all dropped files after execution.