W32/Dropper.NBH!tr

Analysis

W32/Dropper.NBH!tr is a generic detection for a type of trojan that drops other malwares onto the compromised computer. Since this is a generic detection, malware that are detected as W32/Dropper.NBH!tr may have varying behavior.
Below are examples of these behaviors:

• Once it is executed, it loads itself into memory and extracts files from its resource section.


• It drops the following files and executes them:
  
  • undefinedAppDataundefined\SERVER.EXE
  • undefinedAppDataundefined\FAKE NAME GENERATOR.EXE

Recommended Action

FortiGate Systems

• Check the main screen using the web interface for your FortiGate unit to ensure that the latest AV/NIDS database has been downloaded and installed on your system - if required, enable the "Allow Push Update" option.
  FortiClient Systems
  
• Quarantine/delete files that are detected and replace infected files with clean backup copies.