Trojan.Lodear.C

Trojan.Lodear.C is a Trojan horse that attempts to download remote files.

Once executed, the Trojan copies itself as %System%\hloader_exe.exe

• Next, it creates the following registry entries so that the Trojan runs every time Windows starts: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"auto__hloader__key" = "%System%\hloader_exe.exe"
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\"auto__hloader__key" = "%System%\hloader_exe.exe"

The Trojan then creates the following .dll file (5646 bytes) and injects it into the EXPLORER.EXE process:
%System%\hleader_dll.dll

The .dll file attempts to contact the following Web sites through TCP port 80 using Internet Explorer and downloads a remote file:

• [http://]1st-new-orleans-hotels.com/[REMOVED]
• [http://]202.44.52.38/[REMOVED]
• [http://]209.126.128.203/[REMOVED]
• [http://]25kadr.org/[REMOVED]
• [http://]65.108.195.73/[REMOVED]
• [http://]757555.ru/[REMOVED]
• [http://]80.146.233.41/[REMOVED]
• [http://]abtechsafety.com/[REMOVED]
• [http://]abtechsafety.com/[REMOVED]
• [http://]acentrum.pl/[REMOVED]
• [http://]adavenue.net/[REMOVED]
• [http://]adoptionscanada.ca/[REMOVED]
• [http://]adventecgroup.com/[REMOVED]
• [http://]africa-tours.de/[REMOVED]
• [http://]agenciaspublicidadinternet.com/[REMOVED]
• [http://]ahava.cafe24.com/[REMOVED]
• [http://]aibsnlea.org/[REMOVED]
• [http://]aikidan.com/[REMOVED]
• [http://]ala-bg.net/[REMOVED]
• [http://]alevibirligi.ch/[REMOVED]
• [http://]alfaclassic.sk/[REMOVED]
• [http://]allanconi.it/[REMOVED]
• [http://]allinfo.com.au/[REMOVED]
• [http://]americasenergyco.com/[REMOVED]
• [http://]amerykaameryka.com/[REMOVED]
• [http://]amistra.com/[REMOVED]
• [http://]analisisyconsultoria.com/[REMOVED]
• [http://]av2026.comex.ru/[REMOVED]
• [http://]calamarco.com/[REMOVED]
• [http://]ccooaytomadrid.org/[REMOVED]
• [http://]charlies-truckerpage.de/[REMOVED]
• [http://]drinkwater.ru/[REMOVED]
• [http://]eleceltek.com/[REMOVED]
• [http://]furdoszoba.info/[REMOVED]
• [http://]home.1000km.ru/[REMOVED]
• [http://]kepter.kz/[REMOVED]
• [http://]lifejacks.de/[REMOVED]
• [http://]mijusungdo.net/[REMOVED]
• [http://]oklens.co.jp/[REMOVED]
• [http://]phrmg.org/[REMOVED]
• [http://]s89.tku.edu.tw/[REMOVED]
• [http://]sacafterdark.net/[REMOVED]
• [http://]sarancha.ru/[REMOVED]
• [http://]template.nease.net/[REMOVED]
• [http://]tkdami.net/[REMOVED]
• [http://]virt33.kei.pl/[REMOVED]
• [http://]wunderlampe.com/[REMOVED]
• [http://]www.8ingatlan.hu/[REMOVED]
• [http://]www.a2zhostings.com/[REMOVED]
• [http://]www.abavitis.hu/[REMOVED]
• [http://]www.adamant-np.ru/[REMOVED]
• [http://]www.agroturystyka.artneo.pl/[REMOVED]
• [http://]www.americarising.com/[REMOVED]
• [http://]www.aro-tec.com/[REMOVED]
• [http://]www.barth.serwery.pl/[REMOVED]
• [http://]www.bmswijndepot.com/[REMOVED]
• [http://]www.etwas-mode.de/[REMOVED]
• [http://]www.leap.co.il/[REMOVED]
• [http://]www.OTT-INSIDE.de/[REMOVED]
• [http://]www.rewardst.com/[REMOVED]
• [http://]www.stanislawkowalczyk.netstrefa.com/[REMOVED]
• [http://]www.timecontrol.com.pl/[REMOVED]
• [http://]www.ubu.pl/[REMOVED]

The Trojan creates the following folder where it can save downlaoded files:
%Windir%\exefld

The Trojan appears to have been spammed to users via an email which contained a .zip file attachment. The .zip file contains a copy of the Trojan with one of the following file names:

• 5.exe
• 1.exe

Summary