Virus:TR/Dldr.Agent.sisq
Date discovered:17/02/2009
Type:Trojan
Subtype:Downloader
In the wild:Yes
Reported Infections:Low to medium
Distribution Potential:Low
Damage Potential:Low to medium
Static file:Yes
File size:40.960 Bytes
MD5 checksum:d15a163da2962ebbd01c027e3b7a41ce
VDF version:7.01.02.12
IVDF version:7.01.02.38 - Tuesday, February 17, 2009

 General Method of propagation:
   • No own spreading routine


Aliases:
   •  Kaspersky: Trojan-Downloader.Win32.VB.kzu
   •  F-Secure: Trojan-Downloader.Win32.VB.kzu


Platforms / OS:
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003


Side effects:
   • Downloads malicious files
   • Registry modification

 Files It tries to download a file:

– The location is the following:
   • http://**********go/play.php
Furthermore this file gets executed after it was fully downloaded. Further investigation pointed out that this file is malware, too.

 File details Programming language:
 The malware program was written in Visual Basic.

Description inserted by Alexandru Dinu on Tuesday, April 7, 2009
Description updated by Andrei Ivanes on Wednesday, May 13, 2009

Back . . . .