Virus:TR/Agent.LS.5
Date discovered:28/07/2006
Type:Trojan
In the wild:No
Reported Infections:Low
Distribution Potential:Low
Damage Potential:Low to medium
Static file:Yes
File size:33.792 Bytes
MD5 checksum:055cc94ec195ddfa969535fe41f1891f
VDF version:6.35.01.17 - Friday, July 28, 2006
IVDF version:6.35.01.17 - Friday, July 28, 2006

 General Method of propagation:
   • No own spreading routine


Alias:
   •  Bitdefender: MemScan:Trojan.Downloader.Seproger.A


Platforms / OS:
   • Windows 95
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003


Side effects:
   • Drops files
   • Drops malicious files
   • Steals information

 Files It deletes the initially executed copy of itself.



The following files are created:

– %malware execution directory%\p2hhr.bat Furthermore it gets executed after it was fully created. This batch file is used to delete a file.
– %SYSDIR%\bensorty03.dll Further investigation pointed out that this file is malware, too. Detected as: TR/Dldr.Small.ddx.1

– %TEMPDIR%\%several random digits% .exe Furthermore it gets executed after it was fully created. Further investigation pointed out that this file is malware, too. Detected as: TR/Dldr.Small.ckf.3

– %TEMPDIR%\%several random digits% .exe Furthermore it gets executed after it was fully created. Further investigation pointed out that this file is malware, too. Detected as: TR/Drop.Small.app




It tries to execute the following file:

– Filename:
   • Regsvr32.exe
using the following command line arguments: /s bensorty03.dll

 Backdoor Contact server:
The following:
   • http://traffic-acc.com:8088/unik/**********

As a result it may send some information. This is done via the HTTP GET request on a PHP script.


Sends information about:
    • Current malware status

 File details Runtime packer:
In order to aggravate detection and reduce size of the file it is packed with the following runtime packer:
   • PE Pack

Description inserted by Marius T. Nicolae on Tuesday, August 1, 2006
Description updated by Marius T. Nicolae on Wednesday, August 9, 2006

Back . . . .