Bredolab.gen.o

This page shows details and results of our analysis on the malware Bredolab.gen.o

Download Current DAT: 6614

Threat Detail

Malware Type: Trojan

Malware Sub-type: Password Stealer

Discovery Date: 2010-01-18

Next Steps:

Overview
Characteristics
Symptoms
Method of Infection
Removal

Overview

This is a new variant which arrives in a ZIP/RAR file purporting to be from Facebook telling recipients to reset their Facebook Passwords.

This trojan is capable of stealing passwords and downloading other malware on infected systems.

Minimum DAT

5923 (2010-03-17)

Updated DAT

6146 (2010-10-24)

Minimum Engine

5.4.00

File Length

Varies

Description Added

2010-01-18

Description Modified

2010-03-21

Malware Proliferation

Characteristics

-- Update March 22, 2010 --
The risk assessment of this threat has been updated to Low-Profiled due to media attention at: http://www.theregister.co.uk/2010/03/18/facebook_password_reset/

This trojan arrives as an attachment inside a RAR/ZIP file which has been spammed out. It purports to be from Facebbook as shown in the example below:

The ZIP/RAR archive contains the trojan file and when executed will attempt to inject itself into svchost.exe processes.

The Trojan then connects to the following domain to download other malware:

http://fun[removed].ru

The malware that is downloaded and related files may vary from one variant to another.

This trojan drops a DLL component which our current DATS already detect as 'Spy-Agent.br.dll' with the current DATS.

The location of where this DLL component is dropped is:

%Temp%\6.tmp
%System%\nnfj.tqo

%Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).

%System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

The following registry key is also created so that the trojan runs after each login by the user:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon "Shell" =Explorer.exe rundll32.exe nnfj.tqo nhemkk

Symptoms

* The Trojan is running in the process list.
* Presence of files and registry entries mentioned
* Network activities

Method of Infection

Trojans are not viruses, and as such do not contain any method to replicate by themselves. However they may be downloaded by other viruses and/or Trojans to be installed on the user's system. Alternatively they may be installed by visiting a malicious web page (either by clicking on a link, or by the website hosting a scripted exploit which installs the malwares).

Removal

All Users:
Use specified engine and DAT files for detection and removal.

Additional Windows ME/XP removal considerations