Virus:TR/Dldr.Banload.aoo.62
Date discovered:27/11/2006
Type:Trojan
Subtype:Downloader
In the wild:No
Reported Infections:Low
Distribution Potential:Low
Damage Potential:Low to medium
Static file:Yes
File size:207.360 Bytes
MD5 checksum:6ff39a81cf318ca465a1460349bfd2a6
VDF version:6.36.00.146
IVDF version:6.36.00.163 - Wednesday, October 25, 2006

 General Method of propagation:
   • No own spreading routine


Aliases:
   •  Mcafee: PWS-Banker.dldr
   •  Kaspersky: Trojan-Downloader.Win32.Banload.aoo
   •  Grisoft: Downloader.Generic2.UIW
   •  Eset: Win32/TrojanDownloader.Banload.AOO


Platforms / OS:
   • Windows 95
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003


Side effects:
   • Downloads a file
   • Registry modification

 Files It copies itself to the following location:
   • %SYSDIR%\wzip32.exe




It tries to download some files:

– The location is the following:
   • http://www.yourmaclife.com/forum/includes/**********
It is saved on the local hard drive under: %TEMPDIR%\$$$.temp Furthermore this file gets executed after it was fully downloaded. This file may contain further download locations and might serve as source for new threats.

– The locations are the following:
   • http://www.kosova.ch/share/files/132/**********
   • http://www.bulk-upload.com/files/19/**********
At the time of writing this file was not online for further investigation.

 Registry The following registry key is added in order to run the process after reboot:

– [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   • "WinZip"="\"%SYSDIR%\wzip32.exe\""



It registers a browser helper object (BHO) by adding the following key:

– [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\
   Browser Helper Objects\{FCADDC14-BD46-408A-9842-CDBE1C6D37EB}]


The following registry keys are added:

– [HKCU\Software\Microsoft\Internet Explorer\Download]
   • "CheckExeSignatures"="no"
   • "RunInvalidSignatures"=dword:00000001

– [HKCR\CLSID\{FCADDC14-BD46-408A-9842-CDBE1C6D37EB}]
   • @=""

– [HKCR\CLSID\{FCADDC14-BD46-408A-9842-CDBE1C6D37EB}\InprocServer32]
   • @="%SYSDIR%\mpeg4dec0.dll"
   • "ThreadingModel"="Apartment"

 File details Programming language:
 The malware program was written in Delphi.


Runtime packer:
In order to aggravate detection and reduce size of the file it is packed with the following runtime packer:
   • PC Shrinker

Description inserted by Monica Ghitun on Tuesday, November 28, 2006
Description updated by Monica Ghitun on Tuesday, November 28, 2006

Back . . . .