Backdoor.Win32.Agent.abgg

Technical Details

This Trojan provides a remote malicious user with access to the victim machine. It is a Windows PE EXE file. It is 22528 bytes in size.

Installation

Once launched, the Trojan copies its body to the Windows system directory as "digeste.dll":

In order to ensure that the Trojan is launched automatically each time the system is restarted, the Trojan registers its executable file in the system registry:

In order to flag its presence in the system, the Trojan creates a unique identifier: "_SYSTEM_F2A5DE7_”.

Payload

The Trojan launches a copy of the svchost.exe process and injects part of its malicious code (detected by Kaspersky Anti-Virus as Backdoor.Win32.Small.gra) into this process. This code sends an http request containing the information show below to the remote malicious user’s server:

"uid” is "1"; "guid” is the serial number of the disk; “rnd” is a random number; “first” indicates the first launch of the malicious program (if this is the first launch, this value will be "1", otherwise it will be "0").

The backdoor then receives commands on what action to take. The Trojan saves its log files to the Windows directory as shown below:

At the time of writing, the remote malicious server was not accessible.

Removal instructions

If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program:

1. Delete the original Trojan file (the location will depend on how the program originally penetrated the victim machine).
2. Delete the copy of the Trojan:
   %System%\digeste.dll
3. Delete the file created by the Trojan:
   %WinDir%\wiaserviv.log
4. Delete the following system registry key:
   [HKLM\System\CurrentControlSet\Control\SecurityProviders]
   "SecurityProviders" = "digeste.dll"
5. Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus).