TROJ_BAYROB.VTL

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It does not have any propagation routine.

It does not have any backdoor routine.

As of this writing, the said sites are inaccessible.

It does not have any information-stealing capability.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following copies of itself into the affected system and executes them:

• %System Root%\{random string1}\{random string2}.exe
• %System Root%\{random string1}\{random string3}.exe
• %System Root%\{random string1}\{random string4}.exe <- Deleted afterwards

(Note: %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.)

It drops the following files:

• %System Root%\{random string1}\{random string5}
• %Windows%\{random string1\{random string5}
• %System Root%\{random string1}\{random string6}
• %System Root%\{random string1}\{random string7}

(Note: %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.. %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.)

It creates the following folders:

• %System Root%\{random string1}
• %Windows%\{random string1}

(Note: %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.. %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.)

It displays the following fake error messages:

Autostart Technique

This Trojan adds and runs the following services:

• Service Name: Upgrade Parental Adaptive Registrar
  Display Name: Upgrade Parental Adaptive Registrar
  Start Type: SERVICE_AUTO_START
  Binary Pathname: %System Root%\{random string1}\{random string2}.exe

(Note: %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.)

Other System Modifications

This Trojan modifies the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
services\TrustedInstaller
Start = "2"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
services\TrustedInstaller
Start = "3"

Propagation

This Trojan does not have any propagation routine.

Backdoor Routine

This Trojan does not have any backdoor routine.

Download Routine

This Trojan accesses the following websites to download files:

• http://{hostname}.net/index.php

As of this writing, the said sites are inaccessible.

Information Theft

This Trojan does not have any information-stealing capability.

NOTES:

The {hostname} is generated through concatenating two strings from the following list:

• journey
• destroy
• against
• night
• within
• effort
• street
• better
• husband
• little
• doubt
• decide
• suffer
• through
• trade
• gather
• ridden
• chair
• large
• record
• forget
• would
• flier
• quiet
• belong
• those
• captain
• electric
• increase
• remember
• bread
• season
• degree
• answer
• think
• chief
• order
• leader
• rather
• strange
• forward
• glass
• present
• college
• require
• heaven
• morning
• history
• difficult
• pleasant
• often
• middle
• heavy
• various
• amount
• thick
• heard
• necessary
• alone
• twelve
• gentle
• return
• weather
• class
• movement
• building
• fresh
• gentleman
• fellow
• broken
• summer
• thought
• outside
• evening
• experience
• already
• double
• result
• crowd
• water
• store
• doctor
• follow
• begin
• prepare
• strength
• woman
• party
• might
• pretty
• member
• known
• desire
• still
• smoke
• fight
• expect
• person
• severa
• simple
• figure
• picture
• winter
• finish
• because
• machine
• laugh
• mother
• though
• cigarette
• subject
• leave
• sudden
• whether
• mountain
• perhaps
• children
• either
• sweet
• several
• foreign
• right
• possible
• window
• family
• english
• probably
• material
• shore
• welcome
• dollar
• proud
• should
• industry
• opinion
• contain
• character
• nature
• board
• enough
• supply
• settle
• office
• device
• beyond
• silver
• forever
• valley
• matter
• school
• together
• question
• flower
• bring
• special
• demand
• father
• hunger
• built
• storm
• written
• around
• realize
• complete
• short
• became
• promise
• basket
• ladder
• needle
• enter
• govern
• distance
• language
• arrive
• before
• being
• sister
• bottom
• labor
• spent
• while
• control
• therefore
• minute
• listen
• corner
• shout
• apple
• training
• carry
• thrown
• length
• laughter
• indeed
• consider
• almost
• attempt
• orderly
• neighbor
• clear
• smell
• include
• safety
• chance
• market
• twenty
• beauty
• clean
• ready
• course
• people
• understand
• succeed
• behind
• produce
• stream
• nation
• bottle
• please
• dried
• round
• angry
• likely
• notice
• fancy
• during
• friend
• reason
• square
• value
• spread
• general
• early
• north
• future
• meeting
• report
• understood
• garden
• paint
• brown
• women
• daughter
• broad
• between
• butter
• student
• nothing
• soldier
• divide
• condition
• fifteen
• glossary
• article
• worth
• except
• further
• bicycle
• become
• strong
• found
• president
• success
• wagon
• until
• kitchen
• shoulder
• continue
• airplane
• wonder
• guard
• advance
• station
• goodbye
• object
• measure
• choose
• afraid
• period
• escape
• space
• problem
• yellow
• wheat
• single
• always
• difference
• bridge
• cover
• whose
• company
• trouble
• spring
• caught
• banker
• without
• above
• probable
• finger
• master
• straight
• discover
• fence
• stranger
• third
• fortieth
• childhood
• dinner
• although
• circle
• however
• animal
• travel
• modern
• close
• anger
• charge
• forest
• every
• branch
• separate
• receive
• clothes
• borrow
• toward
• electricity
• million
• honor
• catch
• system
• public
• number
• heart
• strike
• mayor
• manner
• century
• business
• power
• mister
• method
• service
• direct
• instead
• surprise
• bright
• letter
• nearly
• speak
• shake
• write
• believe
• health
• quarter
• distant
• train
• pleasure
• delight
• white
• neither
• eearly
• trust
• dress
• position
• perfect
• partial
• battle
• another
• famous
• appear
• country
• suppose
• action
• river
• brought
• explain
• beside
• inside
• different
• happen
• niece
• share
• oclock