Trojan-Downloader.Win32.Agent.alr

Technical Details

This Trojan downloads files via the Internet without the user's knowledge or consent.

The Trojan itself is a Windows PE EXE file, written in Visual C++. It is not packed in any way. The file size may vary from 55KB to 95KB.

Payload

When launching, the Trojan causes the following dialogue box to be displayed:

Once the user clicks on "Continue", the Trojan connects to 66.244.***.178 (*****.errorsafe.com) and downloads software called ErrorSafe:

The Trojan loads the setup.exe file (2352848 bytes in size) to %temp%\NI.UERS_0001_N85M0906 and then launches it for execution. This files installs a program which contains another Trojan program within it. This Trojan will be detected by Kaspersky Anti-Virus as Trojan-Downloader.Win32.Agent.aqh.

The Trojan also creates a unique identifier, "InstallMutex", to flag its presence in the system.

Summary

• Implements network activity

Technical details

File size of 149278 bytes. The file was packed using a special compression utility. Compression can be used for a number of reasons, including for legitimate programs. However, virus writers frequently use it to bypass antivirus protection and to make it difficult for virus analysts to analyze compressed programs Packed Execryptor.

Malicious activity

Checks for connection with the following Internet addresses:

• http://***tlog.sysprotect.com/

Downloads information from the following Internet addresses:

• ***tlog.sysprotect.com/files/SysProtectScannerSetup.exe

Creates unique identifiers to flag its presence in the system

• USYPInstallerMutex
• 83609468248B40A8A3DC1E40B3893D60

Other activities

Modifies the system registry keys:

[ System registry hive HKEY_LOCAL_MACHINEHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ] "NI.USYP_0001_S85M1007" = ""<­path to source program­><­file of source program ­>" -nag"

Description:
­Used to automatically run files when the Windows OS boots­