TrojanDownloader:Win32/Banload.ACJ

TrojanDownloader:Win32/Banload.ACJ is a member of Win32/Banload - a family of trojans that downloads other malware. Banload is usually used to download and install members of the Win32/Banker and Win32/Bancos families onto affected computers.

Installation

Upon execution, TrojanDownloader:Win32/Banload.ACJ attempts to download the following files:

• c:\wintx32\pjct1.cpl
• c:\wintx32\pjct2.cpl
• c:\wintx32\pjct3.cpl
• c:\wintx32\pjct4.exe
• c:\wintx32\pjcta.cpl

It also makes the following changes to the registry in order to automatically execute the arbitrary files at each Windows start:

In subkey: HKCU\Software\Microsoft\Windows\Currentversion\Run
Sets value: "pjct1"
With data: "c:\wintx32\pjct1.cpl"

Sets value: "pjct2"
With data: "c:\wintx32\pjct2.cpl"

Sets value: "pjct3"
With data: "c:\wintx32\pjct3.cpl"

Sets value: "pjct4"
With data: "c:\wintx32\pjct4.exe"

Sets value: "pjcta"
With data: "c:\wintx32\pjcta.cpl"

Payload

Downloads and executes arbitrary files

TrojanDownloader:Win32/Banload.ACJ connects to the following websites and attempts to download files, often detected as members of the Win32/Bancos family:

• hxxp://<remote server>/pjct1.jpg - saved as c:\wintx32\pjct1.cpl
• hxxp://<remote server>/pjct2.jpg - saved as c:\wintx32\pjct2.cpl
• hxxp://<remote server>/pjct3.jpg - saved as c:\wintx32\pjct3.cpl
• hxxp://<remote server>/pjct4.jpg - saved as c:\wintx32\pjct4.exe
• hxxp://<remote server>/pjcta.jpg - saved as c:\wintx32\pjcta.cpl

It then loads these files by running the following commands:

• RunDLL32.exe Shell32.DLL, Control_RunDLL c:\wintx32\pjct1.cpl
• RunDLL32.exe Shell32.DLL, Control_RunDLL c:\wintx32\pjct2.cpl
• RunDLL32.exe Shell32.DLL, Control_RunDLL c:\wintx32\pjct3.cpl
• RunDLL32.exe Shell32.DLL, Control_RunDLL c:\wintx32\pjcta.cpl

Contacts remote hosts

TrojanDownloader:Win32/Banload.ACJ collects and sends information about the computer, such as computer name, and reports it back to the following remote server:

• hxxp://<remote server>infect/inf1/?chave=xchave&url=

Analysis by Zarestel Ferrer