Internet threat level: 1
Home→Descriptions→Trojan-Downloader.Win32.Agent.ed
Trojan-Downloader.Win32.Agent.ed
| Detected | Oct 16 2004 11:58 GMT |
| Released | Oct 16 2004 11:58 GMT |
| Published | Jan 21 2005 13:08 GMT |
Technical Details
This is a primitive Win32 Trojan.
It is written in C, and packed using PecBundle and PECompact. The packed file is approximately 48KB in size, and the unpacked file is approximately 114KB in size.
It creates a synchronization object named "BaloonMutex". This checks the system for active copies of the Trojan in the system.
When launching, the Trojan drops a harmless sound file named balloon.wav (6400 bytes in size) into the Windows directory.
It also saved a CHM file of 10716 bytes, which when launched will direct the victim machine to a malicious web site.
Once activated, the Trojan will cause the following window to be displayed at random intervals:
Programs classified as Trojan-Downloader download and install new versions of malicious programs, including Trojans and AdWare, on victim computers. Once downloaded from the Internet, the programs are launched or included on a list of programs which will run automatically when the operating system boots up.
Information about the names and locations of the programs which are downloaded are in the Trojan code, or are downloaded by the Trojan from an Internet resource (usually a web page).
This type of malicious program is frequently used in the initial infection of visitors to websites which contain exploits.
Trojan-Downloader.
- Trojan-Dropper.
Win32. Agent. ed (Kaspersky Lab) - TrojanDownloader.
Win32. Agent. ed (Kaspersky Lab) - Trojan.
DownLoader. 57574 (DrWeb) - Trojan.
Downloader. Apropo. I (BitDef7)
© 1997-2013 Kaspersky Lab ZAO. All Rights Reserved.
Industry-leading Antivirus Software.
Registered trademarks and service marks are the property of their respective owners.
The authors' opinions do not necessarily reflect the official positions of Kaspersky Lab.