Backdoor.Win32.Agent.nj

Technical Details

This Trojan program makes it possible for a remote malicious user to control the victim machine. The program itself is a Windows PE EXE file approximately 290KB in size.

Installation

Once launched, the program copies itself to the Windows system directory as "winsN2S.exe"

%System%\winsN2S.exe

It then registers this file in the system registry, ensuring that the Trojan will be launched each time Windows is rebooted on the victim machine:

[HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
[HKCU\Software\Microsoft\OLE]
[HKCU\System\CurrentControlSet\Control\Lsa]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
[HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices]
[HKLM\Software\Microsoft\OLE]
[HKLM\System\CurrentControlSet\Control\Lsa]
[HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices]
"Windows NetStart Service2" = "winsN2S.exe"

Payload

This backdoor program provides a remote malicious user with full control over the infected machine, making it possible to upload and launch files, view the list of active processes, terminate processes, conduct DoS attacks, launch a proxy server on the victim machine, and receive information about the infected system, including mail protocol configuration, passwords entered via the keyboard, screenshots and other information.