Trojan-Downloader.Win32.Agent.ekbl

Technical Details
Payload
Removal instructions

Technical Details

This Trojan downloads files from the Internet and launches them without the user's knowledge. It is a Windows application (PE EXE file). It is 57 856 bytes in size. It is written in C++.

Payload

Once launched, the Trojan extracts the following file from its body:

%Temp%\<rnd>.vbs

(3247 bytes; detected by Kaspersky Anti-Virus as "Trojan-Downloader.VBS.Agent.aag") where <rnd> is a random eight-digit hexadecimal number.

Next, the extracted file is launched for execution through the system command interpreter: <>"%System%\cmd.exe" /c %Temp%\<rnd>.vbs The Trojan then ceases running.

Once launched, the file "<rnd>.vbs" performs the following actions:

• It creates the directory:

  <my_doc>\<rnd1>

  where <rnd1> is a random sequence of letters, for example "VPAVQXCUUNGUFLTJSLNAU", and <my_doc> is the path to the current user's "My Documents" directory, which the Trojan obtains from the following system registry key:

  [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\
  Shell Folders\Personal]
  

• It downloads a file from the following link:

  http://ka***ow.info/PCDefenderSilentSetup.msi 
  (At the time of writing, this link was inactive)
  

  The downloaded file is saved in the previously created directory as

  <my_doc>\<rnd1>\<rnd2>

  where <rnd2> is a random sequence of letters, for example "YSCXTAFWWQJWIO".
• It checks whether UAC is enabled, by reading the value of this system registry key:

  [HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\
  System\EnableLUA]
  

  If UAC is enabled, the Trojan installs the downloaded file in quiet mode, without user involvement; otherwise, it attempts to launch the file for execution with enhanced privileges.
• So that the directory with the downloaded file is deleted automatically the next time the system is rebooted, it creates the following system registry key:

  [HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce]
  "delpcdefmsi"="cmd /c rmdir /s /q <my_doc>\<rnd1>"
  

Removal instructions

If your computer does not have an antivirus, and is infected by this malicious program, follow the instructions below to delete it:

1. Delete the original Trojan file (its location will depend on how the program originally penetrated the infected computer).
2. Delete the following files:

   %Temp%\<rnd1>.vbs
   <my_doc>\<rnd1>\<rnd2>
   

3. Delete the following system registry key (see What is a system registry and how do I use it?):

   [HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce]
   "delpcdefmsi"="cmd /c rmdir /s /q <my_doc>\<rnd1>"
   

4. Empty the Temporary Internet Files directory, which may contain infected files (see How to delete infected files from Temporary Internet Files folder?).
5. Perform a full scan of the computer using Kaspersky Anti-Virus with up-to-date antivirus databases (download a trial version).