Trojan Nap

Posted: February 6, 2013

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Threat Level:	9/10
Infected PCs:	17

First Seen:	February 6, 2013
OS(es) Affected:	Windows

Trojan Nap is a Trojan downloader that appears to be distributing backdoor Trojans throughout the globe, with such far-apart regions as Taiwan, the Ukraine and the United States all including PCs that have been confirmed to be part of the botnet that Trojan Nap installs. Although Trojan Nap's actions are limited to installing malware and using multiple methods to avoid being detected, the Trojan that Trojan Nap installs puts in place meaningful security vulnerabilities that could be used to control your computer, steal private information or install more PC threats. Since Trojan Nap is a sophisticated and dedicated danger to your PC's safety, SywareRemove.com malware researchers strongly encourage the use of repeated and extensive anti-malware scans for removing Trojan Nap... and any other malware that Trojan Nap is likely to have installed.

Why You Don't Want to Be Caught Napping During Trojan Nap's Watch

Trojan Nap is built for the ever-common purpose of downloading and installing other programs without your consent, but has a few quirks to its attacks that make Trojan Nap noteworthy. Perhaps the most meaningful, and the one for which Trojan Nap was named, is Trojan Nap's ability to 'sleep' after performing its malicious functions. This 'sleep mode' is designed to render Trojan Nap inert for ten minutes at a time after Trojan Nap downloads its payload. During this time, some anti-malware programs – particularly automated ones that are used to identify new PC threats – may be unable to detect Trojan Nap.

Trojan Nap uses the so-called 'fast flux' DNS-morphing tactic, which conceals Trojan Nap's original controller with a variety of dynamically-generated proxies. These proxies usually are composed of other infected PCs, but the ultimate controls and payloads all issue forth from the hands of malware-controlling criminals.

However, these two functions don't alter Trojan Nap's foremost responsibility, which is to install a backdoor Trojan on your computer. After being installed, this Trojan creates several port vulnerabilities and listens for further instructions on the attacks that Trojan Nap should make. Like all backdoor Trojans, SywareRemove.com malware experts consider Trojan Nap's payload to be a very potent danger to your computer's privacy and overall security.

Giving Trojan Nap the Rude Awakening that It Deserves

Since Trojan Nap uses techniques that are designed to hide Trojan Nap from anti-malware analysis, it should be stressed that you shouldn't assume that a single scanner failing to find Trojan Nap necessarily indicates a lack of a potential Trojan Nap infection. Regular and repeated scans with only high-quality, trustworthy and, if necessary, multiple brands of anti-malware products should be used in any instance where you suspect that your PC might be compromised by Trojan Nap.

In a similar fashion, SywareRemove.com malware research team also recommends the use of such software for deleting Trojan Nap, which will not display any of the obvious hallmarks of a normal application that could be used to delete Trojan Nap. The same software also should be used to detect and delete Trojan Nap's payload, which may leave TCP port vulnerabilities on your computer. If necessary, these ports can be closed manually. By default, and as a security measure against network-based intrusions, network ports that aren't being used by benign programs always should be kept closed.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

6aa9331fc1a5e87828026bc294459c6f

File name: 6aa9331fc1a5e87828026bc294459c6f
Size: 892.92 KB (892928 bytes)
MD5: 6aa9331fc1a5e87828026bc294459c6f
Detection count: 53
Group: Malware file
Last Updated: February 11, 2013

930be50caae275d518ed49590202b9c4

File name: 930be50caae275d518ed49590202b9c4
Size: 514.06 KB (514064 bytes)
MD5: f7ead0f70bc632b81740a21cc0c1b7c2
Detection count: 50
Group: Malware file
Last Updated: February 11, 2013

ZeuS_binary_d2580f1f780baa81cf1396bb0855e43a.exe

File name: ZeuS_binary_d2580f1f780baa81cf1396bb0855e43a.exe
Size: 2.35 MB (2351616 bytes)
MD5: d2580f1f780baa81cf1396bb0855e43a
Detection count: 48
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: February 11, 2013

1fdc5905308e58a7a64accb54a8a39b1

File name: 1fdc5905308e58a7a64accb54a8a39b1
Size: 59.9 KB (59904 bytes)
MD5: 1fdc5905308e58a7a64accb54a8a39b1
Detection count: 47
Group: Malware file
Last Updated: February 11, 2013

newbos2.exe

File name: newbos2.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file