W32/Brepbot.A Trojan

 Information about the W32/Brepbot.A Trojan:

W32/Brepbot.A is a trojan. This trojan arrives as a spammed email message and it infects Windows systems.

The subject of the infected mail will be any of the following;

Osama Bin Laden Dead
Osama Found Hanged
Rape on Campus
Campus Life Article

The body of the infected mail will be any one of the following;

Hello,

Osama Bin Ladin was found hanged by two CNN journalists early Monday evening. As evidence they took several photos, some of which we have included here. As yet, this information has not hit the headlines due to Bush wanting confirmation of his identity but the journalists have released some early photos over the internet which can be found attached.

CNN

****************************
The Professional News Team
****************************

Hello,

We are planning to include you in the new campus magazine in an article
titled "Campus Life". Can you approve the photo and article for us
before we go to printing please?

If any details are wrong then we can amend before printing on Wednesday
the 1st of July so please get back to us as soon as possible. We have
attached the photo and article here.

Many Thanks & Best Regards,

Joseph Hope
Editor


*******************************************************************************
Please respond before July 1st to ensure we have time to edit!
*******************************************************************************

Hello,

During the early morning of May 25th 2006, a campus student was the
victim of a horrific sexual assault within the college grounds.
Eyewitnesses report a tall white man in grey pants running away from the
scene. Campus CCTV has caught this man on camera and are looking for
ways to identify him. If anyone recognises the attached picture could
they inform administraion immediatly.


Regards,

Robert Atkins
Campus Administration

The name of the infected attachment will be any one of the following;

article.zip
suspiciousphoto.zip
article+photos.zip
articlephotos.zip
suspectimage.zip
suspectphoto.zip
cctv-footage.zip
article_july_1823.zip
article_july_0077.zip
article_july_1734.zip
article_july_2417.zip
article_july_1726.zip
article_july_8048.zip
article_july_8092.zip
article_july_4409.zip
article_july_4988.zip
article_july_2614.zip
article_july_2865.zip
article_july_5503.zip
article_july_6301.zip
article_july_8477.zip
article_july_8491.zip
article_july_7817.zip
article_july_9935.zip
cctvstill.zip
photo+article.zip
photoandarticle.zip
photos.zip
CCTVstill.zip

The zip file contains an executable called Photo and Article.exe, Suicide note and article.exe, CCTVfootage.exe and some other exe.

Upon execution, the trojan copies itself as svchon32.exe in Windows System folder.

The trojan modifies registry at the following location to load itself during each startup.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

The backdoor component of the trojan connects to random ports and allows the remote user to upload, execute and delete files in the victim computer.

This trojan first appeared on June 15, 2006.

 Other names of W32/Brepbot.A Trojan:

This trojan is also known as BKDR_BREPBOT.A, Backdoor.Naninf.E.