Trojan.Win32.Agent2.dmdi

Technical Details

The malicious library is a component of a trojan program designed to steal the user's authentication data. It is a Windows dynamic-link library (PE-DLL file). 8192 bytes. Written in C++.

Payload

After launching, the malicious library checks the name of the process in the address space loaded. By loading the "duospeak.exe" process in the address space, the malicious library allows for the data entered by the user in the class "YYMainWnd" window to be tracked. The data collected is sent to the attacker's server in HTTP-requests:

124.***.56.12
121.***.13.22

Removal instructions

If your computer has not been protected with anti-virus software and has been infected with malware, you will need to take the following actions to delete this:

1. Using Task Manager, end the "duospeak.exe" process.
2. Delete the original trojan file (its location on the infected computer will depend on how it got onto the computer).
3. Run a full Kaspersky Antivirus scan of the computer with updated antivirus databases (download trial version).

MD5: CEA19C96DB10020F0D6E5AE5732B15CD
SHA1: 1909BFFCED2E698957473A984BD89962C27698D7