Trojan-Downloader.Win32.Agent.uj

Technical Details

This Trojan downloads files via the Internet without the user’s knowledge or consent. It is a Windows PE EXE file. The size of infected files may vary from 10KB to 51KB.

Payload

Once launched, the Trojan copies itself to the Windows system directory as under a variety of names. The original Trojan file is then deleted.

A .DLL file may be dropped to the Windows system directory. This file will infect the IEXPLORER.EXE process by opening it with all rights and injecting its code into the process’ address space.

IEXPLORER.EXE will then attempt to download other files from the Internet and launch them on the victim machine.

A remote malicious user may place other malicious programs on the links contained in the body of the Trojan.

Summary

• Trojan-Dropper. Hidden installation of other malicious programs in the system

• Trojan. Performs actions that are typical of malicious programs

• Implements network activity

• Performs potentially dangerous activity

Technical details

File size of 10801 bytes.

Installation

Makes copies of itself with the following names once launched:

• Windows system directory (usually, C:\Windows\System32) %System%\svchf47.exe

Malicious activity

Creates the following files:

• Windows system directory (usually, C:\Windows\System32) %System%\syst5.dll (­Kaspersky Anti-Virus detects as­ Trojan-Downloader.Win32.Small.vwd)

Ensures subsequent Using the system registry, system services or special system files, the program can launch itself or launch the creation of its files every time the Windows OS is subsequently booted autorun of installed files:

by adding values to autorun keys in the system registry:

[ System registry hive HKEY_LOCAL_MACHINEHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows ] "AppInit_DLLs" = " Windows system directory (usually, C:\Windows\System32) %System%\syst5.dll"

Injects its code into the following processes:

• svchost.exe

Opens the following ports on an infected computer for incoming connections:

• 0

Creates unique identifiers to flag its presence in the system

• WhAtTheFuck
• IAMPROGRAM!

Other activities

Modifies the system registry keys:

[ System registry hive HKEY_LOCAL_MACHINEHKLM\SOFTWARE\Microsoft\Internet Explorer ] "MinVersion" = "\1DE\0B\nver=%lu&uid=%lu&conn=%s&os=%s&socks=%lu&ip=%s"

Deletes the following files on an infected computer:

• <­path to source program­><­file of source program ­>