Troj/BagleDl-BO includes functionality to download files, access the internet and communicate with a remote server via HTTP.
When Troj/BagleDl-BO is installed the following files are created:
<Temp>\~1.exe
<Temp>\~2.jpg
<Windows system folder>\im_2.exe
~1.exe and im_2.exe are detected as Troj/BagleDl-BO. ~2.jpg is a clean image file.
The following registry entry is created to run im_2.exe on startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
im_autorn
<Windows system folder>\im_2.exe
Registry entries are created under:
HKCU\Software\Microsoft\IME15\