TROJ_DLOADER.OCO

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It modifies files, disabling programs and applications from properly running.

It deletes the initially executed copy of itself.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan creates the following folders:

• %System Root%\00008B67
• %System Root%\00009DF5

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

Other System Modifications

This Trojan modifies the following files:

• %System%\Drivers\Beep.sys

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

Dropping Routine

This Trojan drops the following files:

• %System Root%\00008B67\00009606
• %System Root%\del_exe.bat

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

Other Details

This Trojan connects to the following possibly malicious URL:

• http://www.{BLOCKED}a.net/prada.txt

It deletes the initially executed copy of itself

This report is generated via an automated analysis system.