TrojanDownloader:Win32/Bedobot.B

TrojanDownloader:Win32/Bedobot.B is a trojan that downloads and executes malware from a remote server.

Installation

TrojanDownloader:Win32/Bedobot.B may be installed by other malware, or downloaded from the Internet. When run, it activates its trojan download payload.

Payload

Downloads arbitrary files

TrojanDownloader:Win32/Bedobot.B attempts to download additional files from a remote server.

In the wild, we have observed the trojan attempting to connect to the below addresses to download and execute files:

• 173.192.96.70/?I=D
• 173.192.96.94/?I=D
• 65.182.108.115/?I=D

At the time of writing, these URLs were not available.

Sends captured data to remote hosts

The trojan also capable of gathering email addresses by traversing the <documents and settings> directory, and parse files with the following file extensions:

• .dbx
• .wab
• .mbx
• .mai
• .eml
• .tbb
• .mbox

In the wild, the trojan attempts to send the gathered information by connecting to the below HTTP addresses:

• 173.192.96.70/?I=1
• 173.192.96.94/?I=1
• 65.182.108.115/?I=1

Analysis by Jonathan San Jose