| Malware name | Trojan.Dldr.Agent.amzp | | Type | Trojan | | Affected platform | Win32 | | Media-Type | application/executable | | MD5 checksum | 37A54F26AAE1C5F1886D72AEE40E0E9D | | Static file | yes | | Filesize | 77,828 Bytes | Alias names
(also known as) | | Sophos | Troj/Renos-BQ | | McAfee | Downloader-BKM | | CA ETrust | Win32/FakeAlert.KV |
| | Side effects | - Downloads malicious files
- Registry modification
| | Propagation | No own spreading routine |
|
Description:
Files
It tries to download some files:
– The location is the following:
• http://193.142.244.55/**********/item_g.gif
It is saved on the local hard drive under: %TEMPDIR%\~tmpa.exe Furthermore this file gets executed after it was fully downloaded. Further investigation pointed out that this file is malware, too. Detected as: Trojan.BHO.hfq
– The location is the following:
• http://193.142.244.20/**********/216-1.exe
It is saved on the local hard drive under: %TEMPDIR%\~tmpc.exe Furthermore this file gets executed after it was fully downloaded. Further investigation pointed out that this file is malware, too. Detected as:
3041 – The location is the following:
• http://bigimagecatalogue.com/**********/chagall.gif
It is saved on the local hard drive under: %TEMPDIR%\~tmpd.exe Furthermore this file gets executed after it was fully downloaded. Further investigation pointed out that this file is malware, too. Detected as: Trojan.Agent.87552.F
Registry
One of the following values is added in order to run the process after reboot:
– [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
• "MSFox"="
%executed file%"
The following registry keys are added:
– [HKLM\SOFTWARE\Mozilla\MSFox]
• "Str5"="
%random character string%"
• "Str9"="
%random character string%"
• "Str6"="
%random character string%"
• "Str7"="
%random character string%"
• "Str8"="
%random character string%"
• "Str4"="
%random character string%"
• "Str1"="
%random character string%"
• "Int2"=dword:
%hex number% • "Int3"=dword:
%hex number%– [HKLM\Software\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
• "TrapPollTimeMilliSecs"=dword:
%hex number% File details
Programming language:
The malware program was written in MS Visual C++.
Runtime packer: In order to aggravate detection and reduce size of the file it is packed with the following runtime packer:
• UPX
