Backdoor.Win32.Agent.px

Technical Details

This Trojan program makes it possible to control a remote machine. The Trojan itself is a Windows PE EXE file, written in Delphi and packed using Aspack. The file is 418304 bytes in size.

Installation

Once launched, the backdoor copies itself to the Windows root directory as G_Server.exe:

%Windir%\G_Server.exe

It also creates the following files in the Windows root directory:

%Windir%\G_ServerKey.dll (38912 bytes)
%Windir%\G_Server.dll (372736 bytes)
%Windir%\G_Server_HOOk.dll (61440 bytes)

G_Server.exe, G_ServerKey.dll and G_Server.dll all have the following attributes: hidden, system, and read only.

G_ServerKey.dll will be detected by Kaspersky Anti-Virus as Backdoor.Win32.Hupigon.mk. G_Server_HOOk.dll and G_Server.dll will be detected as Backdoor.Win32.Hupigon.lk.

The backdoor registers a service, GrayPigeonServer, in autorun mode in the system registry (Start = "dword:00000002").

To do this, it creates the following keys in the sytem registry:

Windows NT, 2000, XP and Server 2003:

Windows 98, ME:

Payload

The Trojan uses rootkit technology to hide its processes in the system. It modifies active process memory, causing active processes to call its malicious functions. It is not possible to see the executable Trojan code in the task list.

Once launched, the Trojan starts the GrayPigeonServer service which it installed. It then infects IEXPLORER.EXE, opening it with all privileges and wriitng its data to the process's address space, linking functions from G_Server_HOOk.dll, G_ServerKey.dll). IEXPLORER.EXE will then infect all other active processes. G_Server.exe ceases running and deletes the original copy of itself.

The backdoor creates the following unique identifier to flag its presence in the system:

IEXPLORER.EXE attempts to establish a connection to vip.***gezi.com:8004 to get parameters for future downloads and opening a range of ports. This is done to give a remote user access to the victim machine.

Removal instructions

• Reboot Windows in Safe Mode (during the Windows boot sequence press F8 and choose Safe Mode).
• Delete the following files:

  %Windir%\G_Server.exe
  %Windir%\G_ServerKey.dll
  %Windir%\G_Server.dll
  %Windir%\G_Server_HOOk.dll

• Delete the following system registry entries:
  [HKLM\SYSTEM\CurrentControlSet\Services\GrayPigeonServer]
  [HKLM\SYSTEM\CurrentControlSet\Root\LEGACY_GRAYPIGEONSERVER]
• Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus).