Trojan-Downloader.Win32.Agent.qlh

Technical Details

This Trojan downloads another program and launches it on the victim machine without the user’s knowledge or consent. It is a Windows PE EXE file. It is 49152 bytes in size. It is written in C++.

Payload

Once launched, the Trojan deletes the following parameter from the system registry:

It then sends a request to the following site:

It sends the request shown below to the domain name which it receives in reply:

At the time of writing, the following name was being used:

In answer to the request, the Trojan gets the current version of the "VaccinePro" utility and compares it to the version which is installed on the victim machine by getting data from the following system registry key:

If the utility has not been previously installed on the victim machine, the Trojan creates the following directory:

It then downloads a file called "VaccPD.exe" to this directory from the following link:

This file is 73728 bytes in size.

In order to ensure that the Trojan is launched automatically each time the system is booted, it registers its executable file in the system registry:

The Trojan then creates and runs the following special system registry key:

[HKCU\Software\VaccinePro]
"code1" = "winwin"
"code2" = ""
"updateurl" = "*****vaccinepro.co.kr"
"controllerVersion" = "1.1"
"Version" = "1.1"

It then downloads the following file:

This file will be saved as "VaccPU.exe" to the directory created by the Trojan:

– the file is 701952 bytes in size

The Trojan then sends a request to the following address:

In reply it gets a list of links from which it will download files. At the time of writing, the list was as shown below:

http://*****vaccinepro.co.kr/version/bin/VaccP.dll
http://*****vaccinepro.co.kr/version/bin/vpd.dll
http://*****vaccinepro.co.kr/version/bin/uninst_vcpr.exe
http://*****vaccinepro.co.kr/version/bin/VaccPD.dat
http://*****vaccinepro.co.kr/version/bin/VaccPP.dat
http://*****vaccinepro.co.kr/version/bin/VaccPS.exe
http://*****vaccinepro.co.kr/version/bin/VaccP.exe
http://*****vaccinepro.co.kr/version/bin/VaccPP.exe

These files are saved under the following names:

• %Program Files%\VaccinePro\VaccP.dll – this file is 40960 bytes in size
• %Program Files%\VaccinePro\vpd.dll – this file is 511034 bytes in size
• %Program Files%\VaccinePro\uninst_vcpr.exe – this file is 27484 bytes in size
• %Program Files%\VaccinePro\VaccPD.dat – this file is 30183 bytes in size
• %Program Files%\VaccinePro\VaccPP.dat – this file is 30481 bytes in size
• %Program Files%\VaccinePro\VaccPS.exe – this file is 52602 bytes in size
• %Program Files%\VaccinePro\VaccP.exe – this file is 30128 bytes in size
• %Program Files%\VaccinePro\VaccPP.dat – this file is 252416 bytes in size

The Trojan then ceases running.

Removal instructions

If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program:

1. Delete the original Trojan file (the location will depend on how the program originally penetrated the victim machine).
2. Delete the following system registrykeys:

   [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 
   "VaccP" = "%Program Files%\VaccinePro\VaccPD.exe"
   [HKCU\Software\VaccinePro]

3. Delete the following directory and its contents:
   %Program Files%\VaccinePro
4. Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus).