Backdoor.Win32.Agent.ich

Technical Details

This Trojan provides a remote malicious user with access to the victim machine. It is a Windows PE EXE file. It is 48640 bytes in size. It is packed using UPX. The unpacked file is approximately 360KB in size.

Installation

The Trojan extracts the following file from its body:

This file is 73728 bytes in size. Kaspersky Anti-Virus does not detect this file as malicious.

The original file will then be deleted.

The backdoor creates a service called "Microsoft ASPI Manager" which ensures the backdoor executable file will be launched each time the victim machine is restarted.

Payload

The Trojan launches a HTTP proxy server on the victim machine on TCP port 80. It then sends notification that the victim machine has been infected to the addresses shown below:

It does this by sending HTTP requests. Once infected, the victim machine becomes part of a zombie network and can be used to send spam or to conduct DoS attacks.

The backdoor creates the following log files:

It creates the following registry key:

and saves its configuration to this key.

Removal instructions

If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program:

1. Use Task Manager to terminate the malicious process
2. Delete the following registry key:
   [HKLM\SOFTWARE\Microsoft\Sft]
3. Delete the "Microsoft ASPI Manager" service.
4. Delete the following files:
   %WinDir%\ws386.ini
   %WinDir%\db32.txt
   %WinDir%\s32.txt
   %WinDir%\f32.txt
   %System%\aspimgr.exe
5. Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus).

Summary

• Trojan-Dropper. Hidden installation of other malicious programs in the system

Technical details

File size of 48640 bytes.

Installation

Creates the following files on an infected computer:

• Windows directory (usually, C:\Windows)%Windir%\lg32.txt_
• Directory for storage of temporary files on Windows OS (usually, C:\Documents and Settings\\Local Settings\Temp)%Temp%\~1.tmp
• Windows system directory (usually, C:\Windows\System32) %System%\aspimgr.exe_ (­Kaspersky Anti-Virus detects as­ Backdoor.Win32.Agent.ljj)

Malicious activity

Creates the following files:

• Directory for storage of temporary files on Windows OS (usually, C:\Documents and Settings\\Local Settings\Temp)%Temp%\_check32.bat

Launches files shown below for execution:

• Directory for storage of temporary files on Windows OS (usually, C:\Documents and Settings\\Local Settings\Temp)%Temp%\_check32.bat

Uses the masks shown below to search for files on the victim machine:

• *.ini

Other activities

Installs the following system services (drivers):

Service name:	aspimgr
Displayed service name:	Microsoft ASPI Manager
Startup parameters	Windows system directory (usually, C:\Windows\System32) %System%\aspimgr.exe
Startup type:	­automatic­

Modifies the status of the following system services:

Service name:	aspimgr
Displayed service name:	Microsoft ASPI Manager
Startup parameters	Windows system directory (usually, C:\Windows\System32) %System%\aspimgr.exe

Deletes the following files on an infected computer:

• <­path to source program­><­file of source program ­>
• Directory for storage of temporary files on Windows OS (usually, C:\Documents and Settings\\Local Settings\Temp)%Temp%\~1.tmp
• Windows directory (usually, C:\Windows)%Windir%\ws386.ini
• Windows directory (usually, C:\Windows)%Windir%\lg32.txt
• Windows system directory (usually, C:\Windows\System32) %System%\aspimgr.exe