Tag Archives: Trojan.Win32.Bublik.bkhe

Anatomy and Behavior of a Trojan Downloader

I received this malware sample from a system administrator of a small technology firm. He had discovered the sample as an email attachment on his mail server. He was concerned because his malware defenses had not protected his users. Furthermore, his endpoint anti-virus solution did not identify the malware, even after decompressing and executing it on an isolated system. I agreed to take a closer look at the executable and report my findings.

Continue reading