Backdoor.Win32.Agent.lw

Technical Details

This Trojan provides a remote malicious user with access to the victim machine. It is a Windows PE EXE file. The size of the backdoor components varies between 8KB to 80KB.

Installation

When launched, the backdoor copies its executable file to the Windows system directory:

The backdoor then extracts a DLL file called stu.dll from its body:

The DLL file will then be loaded to the svchost.exe address space, and the original Trojan file will be deleted.

In order to ensure that the Trojan is launched automatically when the system is rebooted, the Trojan registers its executable file in the system registry:

Payload

This backdoor is created using a generating program called "editor.exe", which is 24 576 bytes in size. The program interface has the following appearance:

The user can enter an IP address in the generator’s main window. Commands will be received on a specified port from this address. The user can also enter parameters for the system registry auto run key and values for this parameter.

When the right hand button is clicked, the generator copies a file called server.exe to its current folder as setup.exe, and writes data entered by the user to the end of this file in encrypted form.

When the generated file is launched on the victim machine, it will be installed and then attempt to connect to the address which was entered when the backdoor was generated. Commands will be received on this address.

The backdoor is managed via a dedicated program. The program’s interface has the following appearance:

A remote malicious user can use the backdoor to:

• gain full access to files on the user’s hard disk
• download files to the victim computer
• launch programs on the victim machine
• view a list of active processes
• execute any command on the victim machine

Removal instructions

1. Use Task Manager to terminate the Trojan process:
2. Delete the following files:
   %System%\ssclie.exe
   %System%\stu.dll
3. Delete the following registry value:
   [HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
   "system" = "%System%\ssclie.exe"
4. Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus).