PLATFORM:

Windows 2000, Windows XP, Windows Server 2003

 OVERALL RISK RATING:
 REPORTED INFECTION:
 SYSTEM IMPACT RATING:
 INFORMATION EXPOSURE:

  • Threat Type: Spyware

  • Destructiveness: No

  • Encrypted:

  • In the wild: Yes

  OVERVIEW

Infection Channel: Dropped by other malware, Downloaded from the Internet

BANLOAD malware variants arrive on the systems as files dropped by other malware or as files downloaded unknowingly by users when visiting malicious sites. When executed, these connect to malicious URLs to download other malware on already infected systems which leads to further infection. BANLOAD variants are known to download BANKER malware variants.

In 2010, cybercriminals took advantage of the Haiti earthquake as a spam lure. The spammed messages written in Portuguses tricked users into clicking a link that supposedly contains photos of the earthquake. This led to a malicious website that downloads TROJ_BANLOAD.JAE.

Cybercriminals also copied the site of Ministerio do Trabalho e Emprego, or the Ministry of Labor and Employment in Brazil to spread TROJ_BANLOAD.JMO. When executed, it gathers email addresses and downloads BANKER variants.

  TECHNICAL DETAILS

File Size: Varies
File Type: PE, EXE
Memory Resident: Yes
Initial Samples Received Date: 13 Sep 2007
Payload: Downloads files

Installation

This spyware drops the following copies of itself into the affected system:

  • %System%\aqlb.hjo
  • %Windows%\system\{malware file name}.exe
  • %System%\incognito.exe
  • %Program Files%\Common Files\Files.exe

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.. %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.. %Program Files% is the default Program Files folder, usually C:\Program Files.)

It drops the following files:

  • %Windows%\Envia.txt
  • %User Profile%\fxconfig.bat
  • %Current%\{malware name}-up.txt
  • %Program Files%\Common Files\Microsoft Shared\Web Folders\MSONSEXT409.dll

(Note: %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.. %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.. %Program Files% is the default Program Files folder, usually C:\Program Files.)

Autostart Technique

This spyware adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
{random string} = "{malware path and file name}.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Active Setup\Installed Components\ {ADEEAF15-7FE8-DEDD-3FFF-4DF56EBB1DFB}
StubPath = "{malware path and file name}.exe"

It modifies the following registry entry(ies) to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
Shell = "Explorer.exe rundll32.exe {malware file name) lhoweid"

(Note: The default value data of the said registry entry is Explorer.exe.)

Other Details

This spyware connects to the following possibly malicious URL:

  • http://www.{BLOCKED}nvirtual.com/index.php
  • http://www.{BLOCKED}a.net/image/top_02.gif
  • http://{BLOCKED}.{BLOCKED}.0.28/img/imag1.gif
  • http://{BLOCKED}x.mogsoft.de/gallery2dir/themes/ice/compactone.exe
  • http://{BLOCKED}x.mogsoft.de/gallery2dir/themes/ice/compress.exe
  • http://{BLOCKED}ana-walker.com/site/msdos.exe
  • http://www.{BLOCKED}rg.br/v2/env/msdos.exe
  • http://www.{BLOCKED}kanan.net//espace_pro/msdos.exe
  • http://www.{BLOCKED}eton.ru/por/setup64.exe
  • http://{BLOCKED}chomes.in/images/images.rar
  • http://{BLOCKED}olhado.com.br/js/images.rar
  • http://{BLOCKED}l-levata.com/js/images.rar
  • http://{BLOCKED}.com/js/images.rar
  • http://{BLOCKED}x-arq.com/js/images.rar
  • http://{BLOCKED}igoseamigos2010.kit.net/images.rar
  • http://{BLOCKED}lacionandoamigos.kit.net/images.rar
  • http://{BLOCKED}lpemacla.kit.net/images.rar
  • http://{BLOCKED}nanet2006.kit.net/images.rar
  • http://{BLOCKED}usamonteloavalanche.kit.net/images.rar
  • http://{BLOCKED}igossysters.kit.net/images.rar
  • http://{BLOCKED}perbonus.kit.net/images.rar
  • http://{BLOCKED}amigos2010.kit.net/images.r