Trojan-Downloader.Win32.Agent.eljy

Technical Details

This Trojan downloads files from the Internet and launches them without the user's knowledge. It is a Windows application (PE EXE file). It is 29 696 bytes in size. It is packed using UPX. The unpacked file is approximately 48 KB in size. It is written in C++.

Payload

Once launched, the Trojan performs the following actions in a cycle with a 60-second interval:

• It establishes a connection with the hosts:

  ccoo***o.cc
  cccoo***o.cc
  

• If the connection to these hosts is successful, an HTTP request is sent in the following format:

  GET favicon.ico HTTP/1.1
  Host: bcProxyBot.com
  Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg
  Accept-Language: en-us
  UA-CPU: x86
  User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; 
  .NET CLR 1.2.2.1)
  Cookie: 000C29CBBE24<computer name>

• In response to this request, the server sends a file, which the Trojan saves in the current user's temporary files directory "%Temp%" under a random name. Once downloaded, the file is launched for execution.

Removal instructions

If your computer does not have an antivirus, and is infected by this malicious program, follow the instructions below to delete it:

1. Use Task Manager to terminate the Trojan process.
2. Delete the files downloaded by the Trojan in the "%Temp%" directory.
3. Delete the original Trojan file (its location will depend on how the program originally penetrated the infected computer).
4. Empty the Temporary Internet Files directory, which may contain infected files (see How to delete infected files from Temporary Internet Files folder?).
5. Perform a full scan of the computer using Kaspersky Anti-Virus with up-to-date antivirus databases (download a trial version).

Summary

• Implements network activity

Technical details

File size of 29696 bytes.

Malicious activity

Connects to to the following Internet addresses:

• ***.120.224.250:47873