Where to Buy Trend Micro Products

For Home

For Small Business

1-888-762-8736
(M-F 8:00am-5:00pm CST)

For Enterprise

1-877-218-7353
(M-F 8:00am-5:00pm CST)

Not in the United States?
Select the country/language of your choice:

Asia Pacific Region

Europe

The Americas

Not in the United States?
Select the country/language of your choice:

Asia/Pacific

Europe

America

Login

For Home

For Business

For Partners

Threat Encyclopedia

TROJ_BANLOAD


PLATFORM:

Windows 2000, Windows XP, Windows Server 2003

OVERALL RISK RATING:
DAMAGE POTENTIAL:
DISTRIBUTION POTENTIAL:
REPORTED INFECTION:

  • Threat Type:Trojan

  • Destructiveness:No

  • Encrypted:

  • In the wild: Yes

OVERVIEW

Infection Channel:

Dropped by other malware, Downloaded from the Internet


BANLOAD malware variants arrive on the systems as files dropped by other malware or as files downloaded unknowingly by users when visiting malicious sites. When executed, these connect to malicious URLs to download other malware on already infected systems which leads to further infection. BANLOAD variants are known to download BANKER malware variants.

In 2010, cybercriminals took advantage of the Haiti earthquake as a spam lure. The spammed messages written in Portuguses tricked users into clicking a link that supposedly contains photos of the earthquake. This led to a malicious website that downloads TROJ_BANLOAD.JAE.

Cybercriminals also copied the site of Ministerio do Trabalho e Emprego, or the Ministry of Labor and Employment in Brazil to spread TROJ_BANLOAD.JMO. When executed, it gathers email addresses and downloads BANKER variants.

TECHNICAL DETAILS

File Size:

Varies

File Type:

PE, EXE

Memory Resident:

Yes

Initial Samples Received Date:

13 Sep 2007

Payload:

Downloads files

Installation

This Trojan drops the following copies of itself into the affected system:

  • %System%\aqlb.hjo
  • %Windows%\system\{malware file name}.exe
  • %System%\incognito.exe
  • %Program Files%\Common Files\Files.exe

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.. %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.. %Program Files% is the default Program Files folder, usually C:\Program Files.)

It drops the following files:

  • %Windows%\Envia.txt
  • %User Profile%\fxconfig.bat
  • %Current%\{malware name}-up.txt
  • %Program Files%\Common Files\Microsoft Shared\Web Folders\MSONSEXT409.dll

(Note: %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.. %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.. %Program Files% is the default Program Files folder, usually C:\Program Files.)

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
{random string} = "{malware path and file name}.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Active Setup\Installed Components\ {ADEEAF15-7FE8-DEDD-3FFF-4DF56EBB1DFB}
StubPath = "{malware path and file name}.exe"

It modifies the following registry entry(ies) to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
Shell = "Explorer.exe rundll32.exe {malware file name) lhoweid"

(Note: The default value data of the said registry entry is Explorer.exe.)

Other Details

This Trojan connects to the following possibly malicious URL:

  • http://www.{BLOCKED}nvirtual.com/index.php
  • http://www.{BLOCKED}a.net/image/top_02.gif
  • http://{BLOCKED}.{BLOCKED}.0.28/img/imag1.gif
  • http://{BLOCKED}x.mogsoft.de/gallery2dir/themes/ice/compactone.exe
  • http://{BLOCKED}x.mogsoft.de/gallery2dir/themes/ice/compress.exe
  • http://{BLOCKED}ana-walker.com/site/msdos.exe
  • http://www.{BLOCKED}rg.br/v2/env/msdos.exe
  • http://www.{BLOCKED}kanan.net//espace_pro/msdos.exe
  • http://www.{BLOCKED}eton.ru/por/setup64.exe
  • http://{BLOCKED}chomes.in/images/images.rar
  • http://{BLOCKED}olhado.com.br/js/images.rar
  • http://{BLOCKED}l-levata.com/js/images.rar
  • http://{BLOCKED}.com/js/images.rar
  • http://{BLOCKED}x-arq.com/js/images.rar
  • http://{BLOCKED}igoseamigos2010.kit.net/images.rar
  • http://{BLOCKED}lacionandoamigos.kit.net/images.rar
  • http://{BLOCKED}lpemacla.kit.net/images.rar
  • http://{BLOCKED}nanet2006.kit.net/images.rar
  • http://{BLOCKED}usamonteloavalanche.kit.net/images.rar
  • http://{BLOCKED}igossysters.kit.net/images.rar
  • http://{BLOCKED}perbonus.kit.net/images.rar
  • http://{BLOCKED}amigos2010.kit.net/images.r

Featured Stories

Connect with us on