TrojanDownloader:QT/Waick.B

TrojanDownloader:QT/Waick.B is an approximately 3.6 Mb Quick Time media file which, when opened by Quick Timer player, attempts to social-engineer users in to downloading and executing malicious files from remote sites.

TrojanDownlaoder:QT/Waick.B may be encountered as a file attachment to an email message or be distributed through newsgroups, peer-to-peer (P2P) networks, or file sharing services such as Rapidshare, eMule or Bit Torrent.

When opened by QuickTime media player, the player is instructed to open a webpage from a remote site such as "play.me<snipped>ler.com". The webpage masquerades as a valid codec installer service and instructs a user to download and run a malicious application named "access.exe". Simultaneously, the QuickTime player displays "Please install Media Song Player" which is aimed to make it even more enticing for users to download and execute the executable, as in the following example:

 

 

At the time of this writing, the executable is detected as Trojan:Win32/BHO.LO.

It is interesting to note that the opened webpage advertises a Windows Media Player codec, it is possible that the same page was used for social engineering schemes involving Windows Media Player files.