My Bitdefender
  • 0 Shopping Cart

SHARE
THIS ON

Facebook Twitter Google Plus

Trojan.Downloader.Bredolab.CW

MEDIUM
LOW
aprox 23Kb
(Trojan.Bredolab, TrojanDownloader:Win32/Waledac.C, Trojan:W32/Agent.NFY)

Symptoms

    A computer has been infected with Trojan.Downloader.Bredolab.CW if
* a process with random number name  (e.g. 88359235.exe) appears in task manager;
* warnings that the computer is "infected with dangerous viruses" are shown constantly.

Removal instructions:

Please let BitDefender disinfect your files.

Analyzed By

Daniel RADU, Senior Virus Researcher

Technical Description:

         Trojan.Downloader.Bredolab.CW is a standard downloader of rogue malware. It is distributed in a packed form, protected by custom packers with anti-emulator and anti-debugging tricks to avoid detection by antivirus scanners. The structure and code of these packers are constantly changing to evade signatures.

         Once executed it tries to download two files from different addresses
* http://195.xxx.xxx.36/pr/pic/fixer_sdgareh_h.exe
* http://83.xxx.xxx.160/pr/pic/fixer_sdgareh_h.exe
* http://195.xxx.xxx.36/pr/pic/sys.exe
* http://83.xxx.xxx.160/pr/pic/sys.exe

         Each file is downloaded in %system32%\Temp\ folder with a random name and executed from there:
* _ex-[Random Number].exe