| Malware name | Trojan.Agent.741376 | | Type | Trojan | | Affected platform | Win32 | | Media-Type | application/executable | | MD5 checksum | E44A7948CE845170845F83DA69D4D96A | | Static file | no | | Filesize | 741,376 Bytes | Alias names
(also known as) | | Webwasher Proactive | Virus.Win32.FileInfector.gen!94 | | Sophos | W32/Spar-A | | McAfee | Generic.b | | CA ETrust | Win32/VMalum.DBIX |
| | Protection | | Webwasher Anti Malware | 6039.196.x | | Webwasher Proactive | Database Version: 91 |
| | Side effects | - Drops a file
- Drops a malicious file
- Registry modification
| | Propagation | Peer to Peer |
|
Description:
Files
It copies itself to the following locations:
• %SYSDIR%\WinSpooler.exe
• %TEMPDIR%\runme.exe
It copies itself within an archive to the following location:
• %TEMPDIR%\temp01.rar
The following files are created:
– Non malicious file:
• %SYSDIR%\rar.exe
– A file that is for temporary use and it might be deleted afterwards:
• %TEMPDIR%\xx
%number%– %TEMPDIR%\temp_01.exe Furthermore it gets executed after it was fully created. Further investigation pointed out that this file is malware, too. Detected as: Trojan.Agent.741376
Registry
The following registry key is added in order to run the process after reboot:
– [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\
Run]
• Windows Printing Driver = WinSpooler.exe
The following registry keys are changed:
– [HKLM\SOFTWARE\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
Old value:
• TrapPollTimeMilliSecs= 3a98
New value:
• TrapPollTimeMilliSecs= 3a98
– [HKLM\SOFTWARE\Licenses]
Old value:
• {K7C0DB872A3F777C0} =
%hex values% New value:
• {K7C0DB872A3F777C0} =
%hex values%– [HKLM\SOFTWARE\Licenses]
New value:
• {I29A5EA887C231048} = 04,00,00,00
P2P
In order to infect other systems in the Peer to Peer network community the following action is performed:
– It searches for the following directories:
•
%BearShare's shared folder% •
%Kazaa's shared folder% •
%LimeWire's shared folder% •
%Morpheus's shared folder% •
%Shareaza's shared folder% If successful, the following files are created:
• 321 XviD Converter 1.2.rar; 3D Studio Max 9 + Tutorials and Keygen
+.rar; 3D Studio Max 9 Last Version crack.rar; ACDSee 9 build 108
Vista Compatible_.rar; Acronis Disk Director Server 10.0.216.rar;
Acronis Disk Director Server 10.0.2169 Keygenerator Working.rar;
Acronis True Image 11 Build 8053 Home..rar; Adobe Acrobat 8
Professional Incl keygen..rar; Adobe Acrobat Professional 8.1 - Latest
Version -.rar; Adobe Acrobat Professional 8.1 keygen.rar; Adobe
Creative Suite 3.01 crack.rar; Adobe CS3 Master Collection Corporate
Final +Keygen.rar; Adobe CS3 Master Collection Corporate ISO. .rar;
Adobe CS3 Master Collection Full Version + Keygen ..rar; Adobe
Illustrator CS3 with plugins (Thinstalled) .rar; Adobe Photoshop CS3
Extended Version Full + .Crack.rar; Adobe Photoshop CS3 Extended+
Crack.rar; Adobe Photoshop CS3 Keygen.rar; Adobe Photoshop CS3 Lite
crack.rar; Adobe Photoshop CS3 Plugins Collection..rar; Adobe
Photoshop CS3 v10 Extended Keygen.rar; Adobe Photoshop CS3 with
Crack..rar; Adobe Photoshop Elements v6.0(Full Version with
Keygen).rar; Adobe Photoshop Elements v6.0a Keygenerator.rar; Adobe
Photoshop Lightroom 1.3..rar; Adobe Photoshop Lightroom 1.4 crack.rar;
Adobe Premiere CS3 Pro Keygenerator.rar; Adobe Premiere Pro CS3
Multi-language Crack.rar; Adobe.Audition.v3.WinAll.Cracked-NoPE+.rar;
Adobe.Dreamweaver CS3 9.0.0.345 Latest Patched-RETAiL.rar; Advanced
System Optimizer 2.20.4.747 keygen.rar; Advanced Uninstaller Pro 8.54
Keygenerator.rar; Advanced Uninstaller Professional 8.5.2 + Working
crack.rar; Alcohol 120 1.9.7.602 with KeyMaker v3.6
(BetaMaster-24.Dec.2007).rar; Alcohol 120 v.1.9.7 crack.rar; Alcohol
120% 1.9.6.471 Activation Key + Crack.rar; Alive YouTube Video
Converter 1.2.7.rar; All Antivirus Keygenerator Pack.rar;
ALL.Adobe.Products.Keygen.rar; All.MicroSoft.Products.Keygen.rar;
Allok 3GP PSP MP4 iPod Video Converter 2.7.2 Keygen.rar;
All_ADOBE_Products_Crack+Keygen_2008-ReLEASE.rar; Anti Hacker Expert
2008 working License Key + Patch _.rar; Any DVD Converter Professional
3.5.rar; AnyDVD & AnyDVD HD 6.3.0 - Final.rar; AnyDVD & AnyDVD HD 6.4
keygen.rar; AnyDVD 6.3.0.6 +Activation Key.rar; Apollo No1 DVD Ripper
6.2.rar; Ashampoo Office 2008 3.01 + crack.rar; Atomix Virtual DJ
Professional 5 rev6 -.rar; Autodata v3.18 2 CDs Full +.rar; Autodesk
3DS MAX 2008 crack.rar; Autodesk AutoCAD 2008 crack.rar; Autodesk
AutoCAD Architecture Version 2008 (Full Version with Key).rar;
Autodesk AutoCAD Architecture Version 2008..rar; Autodesk Inventor
Suite 2008 .(Full Version with Crack).rar; Autodesk Inventor Suite
2008 crack.rar; Avast Antivirus Pro 4.7 Licensed till 2009.rar; Avast
Antivirus Pro 4.7.109 working Key.rar; AVG 7.5 Internet Security &
Firewall _.rar; AVG Anti-Spyware Plus 7.5.1.43 con el key
funcionante.rar; AVG Anti-Spyware Plus 7.5.1.43.333 Patched
Multilingual-ReL.rar; AVG Anti-Virus Professional Edition Latest
v7.5.5 + Key..rar; AVG Antivirus Latest Version 7.5 .Pro.rar; BayGenie
eBay Auction Sniper Pro Edition 3.13 _.rar; BIG CODEC Pack colleci•n
by Neo.rar; BitDefender Antivirus 10 LAST Working Crack .rar;
BitDefender Antivirus 2008 Patcheado ESP-ENG.rar; Bitdefender
AntiVirus 32bit 2008 patcheado + license_key.rar; Black XP 5.1 DVD
crack.rar; BLACK XP 6.0.0.1 ULTMATE DREAM PACK.rar; BSPlayer Pro 2.23
(player de DivX-XviD-MKV-RM-AVI-MPEG-MPG).rar; Computer FiX VoL1
[App][MULTI5]..rar; Convert DAA (PowerISO). or UIF (MagicISO) to ISO
..rar; Convert.all.DivX.in.DVD.patched.+ guides.rar;
Convert.all.MP3.in.WAV.and.create.CDMusical.rar;
Convert.All.your.AVI-MPEG-RM-RMVB-MKV-DIVX-XVID.in.DVD.for.home.theatre..rar;
ConvertXtoDVD 2.2.3.258 And Keygen (20th November 2007).rar;
ConvertXtoDVD 2.2.3.258f And Keygen ( October 2007).rar; ConvertXtoDVD
2.2.3.3 crack.rar; Cool Youtube Downloader Full..rar; Cute FTP Pro 8
Patched-Multilingual.rar; CyberLink MakeDVD 2.0.0.202.rar; CyberLink
PowerDVD 7.3.3516 crack.rar; Daemon Tools Pro 4.16 Patched.rar; Daemon
tools pro Advanced 4.10.218.rar; DAEMON Tools Pro Advanced v4.10.021
And Patch.rar; Daemon Tools Pro Basic 4.11.0220 crack.rar; DivX Bundle
6.9 Professional + Keygenerator.rar; DivX Professional 6.8.0.3 con el
media player actualizado col Coded.rar; DivX-XviD Multi Converter
1.9.[Converte.movies.en.el.fomrat.de.tu.selci•n].rar; Download
Accelerator Plus Premium 8.6.1.4 _.rar; Dr. Hardware 2008 9.0.0.rar;
Dr.Web Anti-virus with AntiSpam 4.44.1112 (vers•n mui complete).rar;
Driver Magic Pro 1.1.3 _ (update win drivers).rar; DVDFab Platinum
4.0.1.3 crack.rar; DVDFab Platinum 4.0.3 - Final - Full License -.rar;
DVDFab Platinum 4.0.4 crack.rar; DVDFab Platinum 4.0.5 + Best
Guide.rar; DVDFab Platinum 4.0.5 Final Full Version.rar;
DVDFab.Platinum.4.0.5_Final Keygen.rar; Easy DVD Creator 1.6.3 Working
KEY! .rar; Easy RM RMVB to DVD Burner 1.4.1 (burn your .RM and .RMVB
Movies)__.rar; Easy Video Downloader 1.1. (Download Videos From
Youtube, Google).rar; eMule 0.48 Download Speed patch (80% more speed
your download with emule and WORK).rar; eMule 0.48a Download Speed
patch (Mui bonito)...rar; ESET NOD32 Antivirus 3.0.56 Patcher to have
ALL updates.rar; Eset NOD32 Smart Security 3.0.621 + Working Update
Code .rar; ESET NOD32 Smart Security 3.0.621 Retail 32-bit .rar; ESET
Smart Security & NOD32 Antivirus 3.0.551 (el melior Antivirus en
circolation).rar; ESET Smart Security & NOD32 Antivirus 3.0.551.rar;
ESET.NOD32.Antivirus.Business.Edition.v3.0.566..CRACKED.rar; FL Studio
7 keygen.rar; FlashFXP.v3.6.1
MULTiLiNGUAL-(ESP-ITA-ENG-DEU-FRA)-crack.rar; FlashGet 1.9.6.1074
[Best Download manager] + crack.rar; FLV to AVI MPEG WMV 3GP MP4 iPod,
Zune Converter ..rar; Football Manager 2008 [MULTI 5]Keygen.rar;
football manager 2008_v8_Patch.rar; Fruity Loops Studio 7 Full +
Crack..rar; Full Set of Lynda.com -Adobe Creative Suite 3.rar;
GetRight Pro 6.3.rar; Goldenfoundsoft MSN Webcam Recorder 13.rar;
Google Earth 4.3 crack.rar; Google Earth Pro 4.2 + Sky FuLL ..rar;
Great Battles of Rome [PcGame][MULTI5]Crack.rar; Guitar Pro v5.2 (Full
Version with CD Keygenerator).rar; Guitar Pro v5.2a Keygenerator.rar;
Hirens Boot CD 9.3..rar; Imtoo 3GP Video Converter 3.1.8.08.rar; ImTOO
DVD Creator 3.0.33.010.rar; ImTOO iPod Movie Converter
3.1.40.0831.rar; Internet Download Manager 5.11.11 crack.rar; Internet
Download Manager 5.12 ._.rar; Intervideo WinDVD Platinum 8.1
crack.rar; Karaoke Builder Studio 3.0.08 Patch.rar; Kaspersky
Anti-Virus 7.0.1.32 Working Key file (till 2010).rar; Kaspersky
Antivirus Tested Working crack.rar; KASPERSKY
AntiVirus7.0.1.321FINAL.(with keys pack-key checker).rar; Kaspersky
Internet Security 7 Full Update patch till 2009.rar; Kaspersky
Internet Security and Antivirus 7.0.1 license key valid untill
2010.rar; Kaspersky Internet Security v7.0.1.32 Final [ENG] [NewKeys]
All.rar; Koyote IPOD Video Converter 2.4..rar; LavaSoft Ad-Aware 2007
Professional 7.0.2.5 .rar; LimeWire Pro 4.14 Spped Download Patch.rar;
Macromedia DreamWeaver CS3 +Plugins and Crack.rar; Macromedia
DreamWeaver CS3 crack.rar; Magic DVD Ripper 5.2.2 crack.rar; Magic ISO
5.4 + serial..rar; Magic ISO 5.41 crack.rar; Magic ISO Maker 5.4 with
serial -.rar; Magic Video Converter 8.0.2.1 (The Ultimate Video
Converter).rar; Magic Video Converter 8.0.2.19 crack.rar; Matlab 2007
crack.rar; Maximus Multiband Maximizer 1.rar; McAfee Anti-Virus 10
keygenerator.rar; McAfee Antivirus 10 ENG-ESP-FRA Cracked.rar; McAfee
VirusScan Enterprise 8.5.0 Licensed.rar;
McAfee.Total.Protection.2007.Multilingual.Crack.rar;
McAfee.Total.Protection.2008.WorkingPatch.Update.TILL.201.rar;
MediaMonkey 3.0.1 Full Multilingual.rar; Microsoft Office 2003
Professional with SP1 2 3 .Working Serial.rar; Microsoft Office 2007
Complete + Serial.rar; Microsoft Office 2007 Complete Version
Keygenerator.rar; Microsoft Office 2007 COMPLETE..rar; Microsoft
Office 2007 Enterprise Edition Incl Keygen..rar; Microsoft Office 2007
Enterprise Genuine Patch _.rar; Microsoft Office 2007 FULL + Keygen (
Vista comp..).rar; Microsoft Office 2007 keygenerator.rar; Microsoft
Office 2007 Ultimate..rar; Microsoft Office Home and Student Edition
2007 FULL Versions with Working Activation Key_.rar; Microsoft Office
XP PRO includes word, excel, powerpoint, outloock..rar; Microsoft
Visual Studio 2008 Professional Edition.rar; Microsoft Windows Vista
32-X86-X64 Activation Key-(june 08).rar; Microsoft Windows Vista
Ultimate x86 crack November 2007.rar; Microsoft Windows VISTA
Validation Crack 01-2008.rar; Microsoft Windows XP Pro SP2 WGA
Validation Patch.rar;
Microsoft.Windows.VISTA.Ultimate.Activation.Code.Patch.rar;
Microsoft.Windows.Vista.Ultimate.x64.Integrated.December.2007.rar;
Microsoft.Windows.Vista.Ultimate.x64.Integrated.January.2008.OEM..rar;
Microsoft.Windows.XP.WGA.Validate.Patcher.(funciona.perfieto!)...rar;
MIRC.6.3.+.Keygen.+Manuales.+instrucions+scripts.(Pack.by.eLs0M).rar;
MKV to AVI Converter 3.0.01.rar; Movie Collector Pro 5.25.rar; MP3
Remix Plus 3.31 Crack.rar; MP3Resizer 1.8 ESP.rar; MS Office 2007 Full
DVD Incl SN..rar; MSN Messenger 8 Fully Patched for XP Sp2 and Windows
ViSTA.rar; MSN.Messenger.8.Working.Patch.to.nudge.all.rar; My Screen
Recorder Pro 2.3.rar; Nero 8 Ultra 8.1.1 ESPANOL co key funcionante
actualizado!.rar; Nero 8 Ultra Edition Keygen.rar; Nero 8 Ultra
Edition 8.1.1+KeyMaker.rar; Nero 8 Ultra Edition 8.2.8 (complete with
Patch).rar; Nero 8 Ultra Edition 8.2.8+Keymaker.rar; Nero 8 Ultra
Edition Serial Key -.rar; Nero 8 with instructions(Only version that
is fully cracked).rar; Nero 8.2.8 Ultra Edition incl. Keygen (WORKS
PERFECT).rar; NOD32 3.xxx Universal Fix.rar; NOD32 Antivirus 3.0.551
ESP.rar; NOD32 AntiVirus BUSINESS EDITIONv3.0.621..(NEW
FIX.FINAL).rar; Norton 360 Tested Working crack.rar; Norton Anti Virus
2008 for Vista RETAiL + Crack .rar; Norton Antivirus 2008 Full Cracked
INCL KEYGEN +..rar; Norton Ghost 12 keygen.rar; Norton Internet
Security 2008 15.0.0.58 Cracked .rar; Norton Internet Security 2008
Multilingual-(ESP-ITA-ENG-FRA)+ Guide to crack.rar; Norton Partition
Magic 8Full Cracked.rar; Norton Product Suite 2007 Keygenerator.rar;
Norton.Antivirus.2008.beta.with.crack.rar;
Norton.Internet.Security.2008.+crack+instruciones.to.crack.it.rar;
NortonInternetSecurity 2008 Espanol .rar; O&O Defrag Professional
10.0.1635 Key (.rar; Oxygen Phone Manager for Nokia Phones II
2.12.1.rar; Panda Antivirus 2008 CracKed_.rar; Panda Antivirus Plus
Firewall (2008) crack.rar; Patch.all.Windows.XP.in.a.second-(and make
updates!)...rar; PC Satellite TV 2007 Elite Working KeyGenerator.rar;
PC Tools AntiVirus 3.6.0.3 (version complete).rar; PC Tools Internet
Security 2008 Patch to 2009 Updates..rar; PhotoSphere Professional 2.2
Keygen.rar; Pinnacle Studio Plus v11 crack.rar; Pinnacle Studio Plus
v11 MultiLanguage Bonus DVD Incl Keygenerator.rar; PlayStation 2
Emulator for PC .rar; Power ISO + serial 3.8. latest.rar; Power ISO
3.8 + Aiudos + key.rar; Power ISO 3.9 crack.rar; PS3 Video Converter
3.1.21.0115 NEW.rar; RapidGet Download Manager by kenshin.rar;
Rapidshare Leecher + Rapidshare Tools.rar; RapidShare Manager
_2008.rar; Rapidshare Premium Downloader Manager.rar; Real Player
11.0.0.373 keygen-W0rking.rar; RealPlayer 11 Plus for XP-VISTA.rar;
Registry First Aid Platinum 6.1.0.154 + Key.rar; Resident Evil 3
Nemesis[PcGame][MULTI5]Crack.rar; Rosetta Stone 2007 and language
pack..rar; Roxio Easy Media Creator 10a crack.rar; Screen Grab Pro
Deluxe 1.1 (pics of your desktop)..rar; SlySoft AnyDVD & AnyDVD HD 6.3
Crack.rar; SlySoft AnyDVD HD 6.3.0 FINAL incl. crack by Team
Resurrection.rar; Slysoft AnyDVD HD 6.3.0.rar; SolSuite 2008 8 (Best
Card Game!).rar; Sony DVD Architect Studio 4.5 (Complete Disk).rar;
Sony Vegas 8 Complete.rar; Sony Vegas Pro 8 0a build 179 .Corporate
Full.rar; Sophos Antivirus 6.5.rar; Spyware Doctor 5.1.0.27.rar; Super
Internet TV 7 2007 Patched.rar; Super Todo En Uno V3
[DVD9][Spanish].rar; Symantec AntiVirus Corporate Edition 1.0.3-8 for
Server.rar; System Mechanic 7.5 Keygen.rar; System Mechanic
Professional 7.5.5.1 Full.rar; TechSmith Camtasia Studio 5 [Record
your own videos]-Cracked.rar; TEU Essentials 2007 .rar; The Shield
Antivirus 2007 Pro & Firewall_.rar; Total Commander 7 for
XP-VISTA.rar; Trend Micro Anti-Spyware 3.5.0.104 (crackeado).rar;
Trend Micro PC-Cillin Internet Security Pro 2008 16.05.10+ License Key
patcher.rar; TuneUp Utilities 2007 6.0.2312 crack.rar; TuneUp
Utilities 2008 7 working Key.rar; UltraISO Premium Edition 8.6.6.2180
Working Crack + Keygenerator.rar; USB Safely Remove 3.3.0.61.rar;
Video Fixer 3.23 .rar; Vista Codec Package 4.5(Audio and Video
Codec).rar; VISTA.All.Version.Activation.Code.2008..rar; VLC Media
Player 0.8.6d . (Latest Version.). -Legal-Ups.rar;
WGA.Validate.2008.for.Windows.XP.Home+Professional..rar; Winamp 5.5.
Pro incluido plugins-advanced system.rar; Winamp Pro v5.6 crack.rar;
WinAVI Video Converter 8.0 crack.rar; WinAVI Video Converter
9.0+Serial.rar; Windows 98 Second Edition Full Bootable CD + CD
Key..rar; Windows UE V.9.5 Fina [App][MULTI5]+.rar; Windows vista All
Versions - All languages..rar; Windows Vista Ultimate 32bit crack.rar;
Windows Vista Ultimate 32bit.Full.rar; Windows Vista Ultimate OEM
EDITION (Pre-Activated + Genuine Forever with Patcher).rar; Windows
Vista x86 MultiLang.AutoPatcher.rar; Windows Vista x86 Ultimate
Genuine OEM crack.rar; Windows Xp Pro Sp3 3264 Vista Style ..rar;
Windows XP Professional Genuine Crack gennaio 2008.rar; Windows XP
Professional Service Pack 2 ..rar; Windows XP Professional Student
SP3-Integrated + CD Key ..rar; Windows XP Ultimate Edition
[December2007-R3 4 .No serial or activation needed].rar; Windows XP
Ultimate Edition [January2008-R3.5].iso.rar; WinRar 3.7 Crack.rar;
WinRAR 3.7 Extreme cracked.rar; WinRar 3.7 Full.rar; WinRar 3.71 final
+ keygen .rar; WinRar 3.71 final Incl keygen (Works 100%)..rar; WinRAR
3.71.1.0 Multilingual for XP and VISTA + cRack.rar; WinZip 11.2
professional patched.rar; WinZIP 12 (co el key funcionante)_.rar;
WirelessMon 2.1 Patched .rar; WS FTP Server with SSH 6.rar; Xilisoft
iPod to PC Copy 1.0.54.110.rar; Yamicsoft Vista Manager 1.1.rar;
YouTube FastDownloader.rar; ZoneAlarm Anti-Spyware + Firewall 7.0.462
Retail-ReLEASD.rar; ZoneAlarm Anti-Spyware and Antivirus 7.0.462 +
working Key and Serial.rar
The archive contains a copy of the malware inside.
The shared directory might look like the following:
File details
Programming language:
The malware program was written in Delphi.
