Malware Information

Malware name Trojan.Dldr.Agent.XAE Type Trojan Affected platform Win32 Media-Type application/executable MD5 checksum D7C594E7118472DF80788C6DB4EFEEE6 Static file no Filesize 11,264 Bytes Alias names (also known as) Sophos Troj/DwnLdr-HIQ McAfee Generic Downloader.ab CA ETrust Win32/SillyDl.FKI Side effects Downloads malicious files Propagation Email

Description:

The following files are created:

– Temporary files that might be deleted afterwards:
• %temporary internet files%\Content.IE5\%eight-digit random character string%\scan[1].exe
• %temporary internet files%\Content.IE5\%eight-digit random character string%\l[1].exe
• %temporary internet files%\Content.IE5\%eight-digit random character string%\g[1].exe




It tries to download some files:

– The location is the following:
• http://79.135.167.1**********/scan.exe
It is saved on the local hard drive under: C:\2.tmp Furthermore this file gets executed after it was fully downloaded. Further investigation pointed out that this file is malware, too. Detected as: Trojan.Dldr.Small.aeum


– The location is the following:
• http://79.135.167.1**********/l.exe
It is saved on the local hard drive under: C:\3.tmp Furthermore this file gets executed after it was fully downloaded. Further investigation pointed out that this file is malware, too. Detected as: Trojan.Dldr.Exchanger.agc


– The location is the following:
• http://79.135.167.1**********/g.exe
It is saved on the local hard drive under: C:\4.tmp Furthermore this file gets executed after it was fully downloaded. Further investigation pointed out that this file is malware, too. Detected as: Trojan.Agent.AKJU


It doesn't have its own spreading routine but it was spammed out via email. The characteristics are described in the following:


From:
The sender address is spoofed.


Subject:
The following:
• New Bill for register.



Body:
The body of the email is the following:
• Hello register, the new bill is attached. Password is 123. Please pay in time


Attachment:
The filename of the attachment is:
• bill8.zip

The attachment is an archive containing a copy of the malware itself.



The email looks like the following:



Runtime packer:
In order to aggravate detection and reduce size of the file it is packed with a runtime packer.