Trojan.Win32.Agent2.dmuw

Technical Details
Payload
Removal instructions

Technical Details

A trojan program designed to steal the user's authentication data. It is a Windows dynamic-link library (PE-DLL file). 4608 bytes. Written in C++.

Payload

After launching, the malicious library checks the name of the process in the address space loaded. With the "duospeak.exe" process loaded into the address space, the trojan allows for tracking of the information entered by the user into the windows with the following class names:

YYMainWnd
YYLogin
Edit

and sends the data received to the attacker's server in HTML-requests:

124.***.56.12
121.***.13.22

Removal instructions

If your computer has not been protected with anti-virus software and has been infected with malware, you will need to take the following actions to delete this:

1. Using Task Manager end the "duospeak.exe" process.
2. Delete the original trojan file (its location on the infected computer will depend on how the program got onto the computer).
3. Run a full Kaspersky Antivirus scan of the computer with updated antivirus databases (download trial version).

MD5: 70FD4FFA984AB10EF0E4CAB3FDCB655E
SHA1: 1FB3E4659CA40D76C5070DEE387E94355D633D7B