W32/Yabe.AT is a trojan. The trojan will infect Windows systems and spreads through email.

The trojan usually arrives as a dropped or downloaded file of other malware from a remote site. It may also arrive as an attachment to a spammed email.

The subject of the spammed email may be;

Rechnung GEZ 22.2006

The body of the spammed email may be;

Bei Ruckfragen bitte Kundennummer=ngeben

The name of the infected attachment may be: 1.zip

Upon execution, it drops a copy of IPCBT.EXE in the Windows System folder.

It modifies the registry at the following location to ensure its automatic execution at every system startup.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

The trojan attempts to download text file from any of the following web sites.

http://66.235.(Blocked).21/~academic/img/horr.dat
http://{blocked}lles-pouliot.com/images/index2.txt
http://{blocked}aceinthedesert.org/images/photo_page/index2.txt
http://{blocked}deonsarmy3.com/gideons_files/index2.txt
http://{blocked}zal18.com/temp/index2.txt
http://{blocked}ecorsairs.co.uk/Pics/index.txt
http://{blocked}acesanders.com/images/index2.txt
http://{blocked}ckells.co.uk/heidi/index.txt
http://{blocked}oorsovertexas.com/images/index2.txt

The downloaded text file contain encrypted link leads to download malicious file.

This trojan first appeared on January 23, 2007.

 Other names of W32/Yabe.AT Trojan:

This trojan is also known as TROJ_YABE.AT.