TrojanDownloader:Win32/Beenut.A

TrojanDownloader:Win32/Beenut.A is a trojan that downloads files from various URLs to the host computer and then runs the downloaded files. TrojanDownloader:Win32/Beenut.A uses HTTP over TCP port 80 for the file transfer.

 

Some variants of TrojanDownloader:Win32/Beenut.A copy themselves to the host computer. For example, the trojan may create a copy of itself in the system folder with a name such as "7552504d.exe", and may create a copy with the same name in folder C:\Documents and Settings\<user name>\Local Settings\Application Data. A variant that creates local copies of itself in this manner typically modifies the registry in order to run automatically each time Windows starts. For example, using the aforementioned file names, the following registry modifications may be made: 

 

The size of the TrojanDownloader:Win32/Beenut.A file varies and strings in the file may be encrypted in an attempt to thwart scanner detection.