W2KM_BARTALEX.H

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

Arrival Details

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

NOTES:

Once the malicious document is opened, this malware executes a macro to drop the following files:

Windows version 5.5 or below:

• %Temp%\AdOBEACD-UPDATEXP.VBS
• %Temp%\AdOBEACD-UPDATE.bat

Above Windows version 5.5:

• %User Temp%\AdOBEACD-UPDATE.VBS
• %User Temp%\AdOBEACD-UPDATE.Ps1
• %User Temp%\AdOBEACD-UPDATE.bat

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7. %Temp% is the Windows Temporary folder, which is usually C:\Windows\Temp.)

The files AdOBEACD-UPDATEXP.VBS and AdOBEACD-UPDATE.Ps1 access the following links to download files:

• http://{BLOCKED}lcimon.com/plugins/system/file.exe
• http://{BLOCKED}epic.su/5105717.png - inaccessible

It saves the file using the following filename:

• %Temp%\444.EXE - version 5.5 or below (detected as TROJ_HANCITOR.AH)
• %User Temp%\444.eXE - above version 5.5 (detected as TROJ_HANCITOR.AH)

It then executes the downloaded file. As a result, malicious routines of the downloaded file are exhibited on the affected system. The file AdOBEACD-UPDATE.bat ensures that the downloaded file is executed and deletes all dropped files after execution.