A dropper Trojan that contains malicious or potentially unwanted software, which it 'drops' and installs on the affected system.
Based on the settings of your F-Secure security product, it will either automatically delete, quarantine or rename the detected program or file, or ask you for a desired action.
Find the latest advice in our Community Knowledge Base.
See the manual for your F-Secure product on the Help Center.
Submit a file or URL for further analysis.
Binanen.A creates a dummy iexplore.exe process, and runs its malicious activity by silently dropping the following file:
It also copies itself to:
And, creates the following registry keys:
Once the malware is executed, the dropped file will try to disguise itself under a true process name and will be injected into a hidden dummy process. Then, it will execute certain command lines such asipconfig, which can be used to retrieve IP address, subnet mask, and default gateway.Once the DLL file has been injected and running under the hidden Internet Explorer process, the attacker will be able to control the infected machine and retrieve information such as list of processes and hard disk information from the affected machine. The attacker could also obtain data such as username, system date and time, and how long the machine has been up and running.