Trojan-Downloader.Win32.Agent.fwcp

Technical Details
Payload
Removal instructions

Technical Details

This Trojan downloads another program to the computer and launches it for execution without the user's knowledge. It is a Windows application (PE EXE file) and is 56 320 bytes in size. It is packed using an unknown packer and is written in C++.

Installation

After launching, the Trojan checks the name of its original file. If the name of the malware's executable file does not contain the string "sdcml.exe", it copies its executable file to the current user's temporary files directory under the name:

%Temp%\<rnd>\<rnd2>sdcml.exe

where rnd and rnd2 are random sequences of letters. It then launches a copy of its file for execution. In order to ensure that it is launched automatically each time the system is restarted, the Trojan adds a link to its executable file in the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"<rnd3>"="%Temp%\<rnd>\<rnd2>sdcml.exe"

where rnd3 is a random sequence of letters.

Payload

To ensure that its process is unique within the system, the Trojan creates a unique ID with the name:

M192A9959A495455c9A91F31AD22B6833

To obtain additional parameters, the malware connects to the malicious user's server, sending an HTTP request of the following format in cycles of 30-second intervals:

GET /mod/ HTTP/1.1
User-Agent: Microsoft Internet Explorer
Host: ai***hk.com
Connection: Keep-Alive

At the time of writing, this link was inactive.

After obtaining additional data from the server, the Trojan obtains access to the reading and writing of files located on the ftp server:

ftp://ai***hk.com/mod

The malware also searches for the following strings:

index
indix
default
main
home
login
auth
user
check
head
headerA
footer
top
start
counters
redirect
go
in
out
feedback
feed
contact
support
page
news
blog
forum
stat
process
upload
payment
test
restore

in files with the extensions:

php
htm
html
aspx 

and also in the files "htm.php" and "html.php".

Removal instructions

If your computer does not have an antivirus, and is infected by this malicious program, follow the instructions below to delete it:

1. Use Task Manager to terminate the process "iexplore.exe".
2. Delete the original Trojan file (its location will depend on how the program originally penetrated the infected computer).
3. Delete the following system registry key parameter:

   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "<rnd3>"="%Temp%\<rnd>\<rnd2>sdcml.exe"
   

4. Delete the following file:

   %Temp%\<rnd>\<rnd2>sdcml.exe

5. Empty the Temporary Internet Files directory, which contains infected files (How to delete infected files from Temporary Internet Files folder?):

   %Temporary Internet Files%

6. Perform a full scan of the computer using Kaspersky Anti-Virus with up-to-date antivirus databases (download a trial version).

MD5: d18a551353ff197b67c361dec11bdbce
SHA1: c8d3e381da1d7bd78041b2e0bfd45982cb317fbd