| Malware name | Trojan.Drop.Agent.poa.2 | | Type | Trojan | | Affected platform | Win32 | | Media-Type | application/executable | | MD5 checksum | 50E9D4B4CFAA847BE20E9813EDB0589B | | Static file | yes | | Filesize | 106,803 Bytes | Alias names
(also known as) | | Webwasher Proactive | Virus.Win32.FileInfector.gen | | Sophos | Mal/EncPk-IG | | McAfee | Generic PWS.ak |
| | Protection | | Webwasher Proactive | Database Version: 113 |
| | Side effects | - Downloads a malicious file
- Drops malicious files
- Lowers security settings
- Registry modification
|
|
Description:
Files
It copies itself to the following locations:
• %SYSDIR%\olhrwef.exe
•
%drive%\qphdin.com
It deletes the initially executed copy of itself.
The following files are created:
–
%drive%\autorun.inf This is a non malicious text file with the following content:
•
%code that runs malware%– %SYSDIR%\nmdfgds0.dll Further investigation pointed out that this file is malware, too. Detected as: Trojan.PSW.Magania.avgo
It tries to download a file:
– The location is the following:
• http://hjwx3.com/xmfx/**********
At the time of writing this file was not online for further investigation.
Registry
One of the following values is added in order to run the process after reboot:
– [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
• "cdoosoft"="%SYSDIR%\olhrwef.exe"
The following registry keys are changed:
– [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\
Connections]
New value:
• "DefaultConnectionSettings"=hex:46,00,00,00,04,00,00,00,09,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,04,00,00,00,00,00,00,00,00,C4,5D,52,1A,78,CA,01,00,00,00,00,00,00,00,00,00,00,00,00,01,00,00,00,02,00,00,00,C0,A8,6B,64,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00
– [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
New value:
• "Hidden"=dword:0x00000002
• "ShowSuperHidden"=dword:0x00000000
– [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\
Folder\Hidden\SHOWALL]
New value:
• "CheckedValue"=dword:0x00000000
File details
Runtime packer: In order to aggravate detection and reduce size of the file it is packed with a runtime packer.
