Summary

Bomka is a remotely controlled trojan. It reads instructions from certain websites and can download and run files on an infected computer.

Additional Details

Bomka is usually spammed in e-mails inside a dropper that may also contain a decoy and an additional downloader component. Usually a joke program or a small game is used as a decoy.

When a user runs the attached dropper, Bomka gets installed on a computer. At the same time a decoy program is launched so a user would not suspect an infection. Bomka's file is a DLL (Dynamic Link Library) that is started as a system component. In some cases Bomka's file is named KABOOM.DLL.

Being active, the trojan connects to several websites (the list is hardcoded in the trojan's body) and reads instructions from there. These instructions may include a backup site name, a sleep delay and a request to download and run a certain file from Internet.

In some cases another DLL is dropped together with Bomka. It is usually named MSX.DLL and is started at the same time as Bomka's DLL. This is a trojan downloader that downloads and runs an executable file (usually named IETOOL.EXE) from the same website that controls Bomka. The downloaded file is a trojan dropper that updates both Bomka and downloader components.

The latest Bomka droppers (NSIS packages) that are being spammed around only contain the MSX.DLL component that downloads another dropper. That dropper (also NSIS package) then drops the main Bomka component KABOOM.DLL onto a hard drive.

We think that Bomka is used as a distribution channel for some software, possibly adware or even malware. However we have no reports that something has been downloaded to infected computers so far.

Write-up: Alexey Podrezov

Technical Details: Alexey Podrezov, February 3, 2006

Description Updated: Alexey Podrezov, February 17, 2006

F-Secure Corporation