TROJAN W32/Rodecap.BA

Description               

• This trojan is a dropper at its core as it facilitates the installation of more harmful malware, but also offers command and control activity as well through the use of URLs that can be found in the malware code. This malware is usually discovered due to its outbound beaconing (Connectivity checks, IP checks, and generic command and control) it is easily spotted by signature-based detection due to the communication taking place over an unencrypted web traffic port 80 HTTP. This malware is spotted and removed by Windows Defender on Windows 10/8 versions or Microsoft Security Essentials on Windows 7 and Vista.

Vector

• Port 80 HTTPS

• This malware is installed via drive-by downloading done by visiting a compromised website. It can also be downloaded as part of a bundled package of 3rd party software or as a malicious attachment on a phishing email. 

Local Actions

• Once a machine is infected with the malware it replicates itself usually in one of or all of the following folders
  • %temp%
  • %appdata%
  • %appdata%\­microsoft
  • %localappdata%
  • %windir%
  • %system%
  • %system%\­drivers

• The malware file name could be one of the following (With variants/ detection evasion this could change)

Known False Positive Indicators

• N/A

Affected Host

• Windows Machine

Classification

• Malware

Sentinel Signature

• TROJAN W32/Rodecap.BA connectivity Check

DNS Calls

• N/A