Troj/Bravo-C is a Trojan for the Windows platform.
Troj/Bravo-C includes the functionality to communicate with a remove server via http.
When first run Troj/Bravo-C copies itself to:
\web.exe
<Windows>\assistse.exe
<Windows>\uninstall.exe
The following registry entries are created to run Troj/Bravo-C on startup:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
Load
<Windows>\assistse.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Net
<Windows>\services.exe
The following registry entry is set:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
HideFileExt
1
When run, Troj/Bravo-C creates and runs <Windows>\services.exe and this file is detected by Sophos as W32/Ritdoor-E.
When run, Troj/Bravo-C creates and runs <Windows>\h00kdll.dll and this file is detected by Sophos as Troj/LegMir-BS.
When run, Troj/Bravo-C may create and run the file C:\bbs.exe