Home / malware

PDF

TrojanDownloader:Win32/Beebone.IH

First posted on 11 June 2013.
Source: Microsoft

Aliases :

TrojanDownloader:Win32/Beebone.IH is also known as W32/Autorun.worm.aaeh!gen (McAfee), Trojan.Win32.Jorik.Vobfus.guqg (Kaspersky).

Explanation :

TrojanDownloader:Win32/Beebone.IH is a trojan that silently downloads and installs other programs without consent. This could include the installation of additional malware or malware components to an affected computer. Installation TrojanDownloader:Win32/Beebone.IH creates the following files on an affected computer:

• %windir%\assembly\nativeimages_v4.0.30319_32\temp\a78-0\system.data.datasetextensions.dll
• %windir%\temp\scs10.tmp
• %windir%\temp\scs11.tmp
• %windir%\temp\scse.tmp
• %windir%\temp\scsf.tmp
• c:\documents and settings\administrator\0top.exe
• c:\documents and settings\administrator\1top.exe

Payload Contacts remote host TrojanDownloader:Win32/Beebone.IH may contact a remote host at domai.05dns.biz using port 8080. Commonly, malware may contact a remote host for the following purposes:

• To report a new infection to its author
• To receive configuration or other data
• To download and execute arbitrary files (including updates or additional malware)
• To receive instruction from a remote attacker
• To upload data taken from the affected computer

This malware description was produced and published using our automated analysis system's examination of file SHA1 d43de1b72a1b24a30fadce17c53d57d52645d9c1.

Last update 11 June 2013

 

TOP