BAT_XPTDL.A

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Download Routine

This Trojan connects to the following URL(s) to download its component file(s):

• https://www.dropbox.com/s/{BLOCKED}sxow5h9ei/CenterPoint.exe?dl=1

It saves the files it downloads using the following names:

• %Windows%\Microsoft.NET\Framework\{Version}\CenterPoint.exe

(Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.)

NOTES:

This malware checks the following versions of .NET folder:

• %Windows%\Microsoft.NET\Framework\v2.0.50727\
• %Windows%\Microsoft.NET\Framework\v3.0\
• %Windows%\Microsoft.NET\Framework\v3.5\
• %Windows%\Microsoft.NET\Framework\v4.0.30319\

It uses bitsadmin.exe to download the malware from URL to its destination path. The downloaded file is installed using UtilInstall.exe where the downloaded malware is dropped.

It starts the service of the installed malware for the first time.