Backdoor.Win32.Agent.jn

Summary

• Backdoor. Provides cybercriminals with remote access to an infected computer

• Trojan-IM. Steals confidential information from internet pagers

• Implements network activity

• Performs potentially dangerous activity

Technical details

The main file is a Windows application (PE EXE file). File created using Development tools used to create the programthe compiler "Borland Delphi". File size of 177664 bytes.

Installation

Copies itself once launched

Ensures Using the system registry, system services or special system files, the program can launch itself or launch the creation of its files every time the Windows OS is subsequently booted autorun of installed files:

by writing to autorun keys in the system registry

Malicious activity

Receives After a command from a cybercriminal, the program performs its malicious functions, for example, performing network attacks on internet sites, distributing spam and other malicious programs, or deleting a user's files. Those using this type of malicious program frequently make use of botnets (networks of infected computers which cybercriminals control centrally in order to carry out malicious activities.
Read more details here: http://www.viruslist.com/en/analysis?pubid=204792003remote commands from cybercriminal:

via connection to Receives commands from cybercriminals using IRC (Internet Relay Chat). After the malicious program is launched, it calls a specific IRC server and establishes contact with the cybercriminal, receives commands and passes on messages in responseIRC server

Steals confidential user information from A malicious program designed to steal accounts (login and password) from instant messaging clients pagers (e.g., ICQ, MSN Messenger, Yahoo Pager, QQ, Skype, etc.). The information is sent to a cybercriminal via email, ftp, the web or other methods. The stolen accounts can be sold or used to spread other malicious programs.
Read more details here: http://www.viruslist.com/en/analysis?pubid=204792005the following internet pagers:

• MSN Messenger

Connects to specific Internet addresses

Creates unique identifiers to flag its presence in the system

Other activities

Runs specific files (commands)

Modifies certain system registry keys

Deletes specific files onfrom the victim machine