TR/Agent.JH.1 - Trojan

See also

Summary

Full description

Statistics

Virus:	TR/Agent.JH.1
Date discovered:	28/09/2005
Type:	Trojan
In the wild:	No
Reported Infections:	Low
Distribution Potential:	Low
Damage Potential:	Medium
Static file:	Yes
File size:	103.447 Bytes
MD5 checksum:	28b891a152e6c9430f5ad2023b3694e1
VDF version:	6.32.0.46

General Method of propagation:
   • No own spreading routine

Aliases:
   • Symantec: Backdoor.Dagonit
   • VirusBuster: Trojan.Agent.GT

Platforms / OS:
   • Windows 95
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003

Side effects:
   • Drops malicious files
   • Registry modification
   • Third party control

Files It deletes the following files:
   • %SYSDIR%\dllcache\winlogon.exe
   • %SYSDIR%\dllcache\termsrv.dll
   • %SYSDIR%\dllcache\mstscax.dll

The following files are created:

– %SYSDIR%\wpap.exe
– %SYSDIR%\dalia2.exe
– %SYSDIR%\winspool.exe Detected as: TR/Agent.JH.2

– %SYSDIR%\dali.reg This file serves as flag for an internal routine.
– %SYSDIR%\system.bat This batch file is used to delete a file. Detected as: TR/Agent.JH.3

Registry The following registry keys are added in order to load the services after reboot:

– [HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TLNTSVR]
   • "NextInstance"=dword:00000001

– [HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TLNTSVR\0000]
   • "Service"="TlntSvr"
   • "Legacy"=dword:00000001
   • "ConfigFlags"=dword:00000000
   • "Class"="LegacyDriver"
   • "ClassGUID"="{8ECC055D-047F-11D1-A537-0000F8753ED1}"
   • "DeviceDesc"="Telnet"

– [HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TLNTSVR\0000\
   Control]
   • "*NewlyCreated*"=dword:00000000
   • "ActiveService"="TlntSvr"

– [HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr\Enum]
   • "0"="Root\\LEGACY_TLNTSVR\\0000"
   • "Count"=dword:00000001
   • "NextInstance"=dword:00000001

– [HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NTLMSSP]
   • "NextInstance"=dword:00000001

– [HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NTLMSSP\0000]
   • "Service"="NtLmSsp"
   • "Legacy"=dword:00000001
   • "ConfigFlags"=dword:00000000
   • "Class"="LegacyDriver"
   • "ClassGUID"="{8ECC055D-047F-11D1-A537-0000F8753ED1}"
   • "DeviceDesc"="NT LM Security Support Provider"

– [HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NTLMSSP\0000\
   Control]
   • "*NewlyCreated*"=dword:00000000
   • "ActiveService"="NtLmSsp"

– [HKLM\SYSTEM\CurrentControlSet\Services\NtLmSsp\Enum]
   • "0"="Root\\LEGACY_NTLMSSP\\0000"
   • "Count"=dword:00000001
   • "NextInstance"=dword:00000001

– [HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NPF\0000\Control]
   • "ActiveService"="NPF"

– [HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr]
   • "Start"=dword:00000002

– [HKLM\SYSTEM\CurrentControlSet\Services\RDSessMgr]
   • "Start"=dword:00000002

– [HKLM\SYSTEM\CurrentControlSet\Services\TermService]
   • "Start"=dword:00000002

– [HKLM\SYSTEM\CurrentControlSet\Services\lanmanserver]
   • "Start"=dword:00000002

The following registry key is changed:

– [HKLM\SYSTEM\ControlSet001\Control\ServiceCurrent]
   Old value:
   • @=%user defined settings%
   New value:
   • @=dword:0000000c

Backdoor The following port is opened:

– tlntsvr.exe on a random TCP port in order to provide backdoor capabilities.

Remote control capabilities:
• Open remote shell

File details Programming language:
The malware program was written in MS Visual C++.

Runtime packer:
In order to aggravate detection and reduce size of the file it is packed with the following runtime packer:
• MEW 11

See a brief description here.

Description inserted by Catalin Jora on Wed, 28 Sep 2005 16:29 (GMT+1)
Description updated by Catalin Jora on Mon, 10 Oct 2005 08:59 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back