Backdoor.Win32.Agent.amps

Technical Details
Payload
Removal instructions

Technical Details

This malicious program provides a malicious user with remote access to the infected computer. It is a Windows application (PE EXE file) and is 40 448 bytes in size. It is written in C++.

Payload

Once launched, the backdoor uses the function "GetSystemDefaultLCID" to obtain the ID for the group of national settings that the operating system uses by default. If the value obtained corresponds with:

Yakut
Armenian
Azeri
Bashkir
Belarusian
Divehi
Kazakh
Kyrgyz
Tatar
Ukrainian
Uzbek
Russian

the backdoor ceases running. In this case, the original backdoor file will be deleted the next time the system is rebooted.

Otherwise, the backdoor performs the following actions:

• It extracts files from its body, which are saved in the system as

  %System%\mscert.dll

  (35 840 bytes; detected by Kaspersky Anti-Virus as "Backdoor.Win32.Agent.amps")

  %System%\kbdnet.dll

  (30 208 bytes; detected by Kaspersky Anti-Virus as "Backdoor.Win32.Agent.amos")
• It registers the extracted libraries in the system registry by creating the following keys:

  [HKLM\System\CurrentControlSet\Control\Session Manager\AppCertDlls]
  "AppSecDll" = "%System%\mscert.dll"
  
  [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows]
  "AppInit_DLLs" = "%System%\kbdnet.dll"
  "LoadAppInit_DLLs" = "1"
  

  Thereby, the libraries extracted by the Trojan will be injected into the address spaces of all processes launched in the system.

The backdoor then ceases running. The original backdoor file will be deleted the next time the system is rebooted.

By being injected into the address space of Internet Explorer ("iexplore.exe"), the previously extracted libraries enable the malicious user to track incoming and outgoing traffic on the infected computer. Search requests by the user in the following resources:

altavista.com
google.com
yahoo.com
bing.com

will be redirected to an address specified by the malicious user. In addition, by means of these libraries, other malicious programs can be downloaded to the infected computer.

Removal instructions

If your computer does not have an antivirus, and is infected by this malicious program, use Kaspersky Anti-Virus to delete it: perform a full scan of the computer using Kaspersky Anti-Virus with up-to-date antivirus databases (download a trial version).

MD5: 93BCA465417D62AE9114BCB596834747
SHA1: 8C17B74DC904E739B6EEF5A28FDD0FE56D9A9C0B