TR/Dldr.Agen.xa.1.B - Trojan

See also

Summary

Full description

Statistics

Virus:	TR/Dldr.Agen.xa.1.B
Date discovered:	19/10/2005
Type:	Trojan
Subtype:	Downloader
In the wild:	No
Reported Infections:	Low
Distribution Potential:	Low
Damage Potential:	Low to medium
Static file:	Yes
File size:	28.160 Bytes
MD5 checksum:	809B4BC6E0CB8202DACF522CC36FA5E0
VDF version:	6.32.00.95 - Tue, 18 Oct 2005 09:06 (GMT+1)

General Method of propagation:
   • No own spreading routine

Aliases:
   • TrendMicro: TROJ_SPYWAD.J
   • Bitdefender: Trojan.Hoax.Renos.P

Platforms / OS:
   • Windows 95
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003

Side effects:
   • Downloads a file
   • Registry modification

Right after execution the following information is displayed:

Files It copies itself to the following location:
   • %system drive root%\winstall.exe

The following files are created:

– Non malicious file:
   • %WINDIR%\desktop.html

– %PROGRAM FILES%\SpySheriff\base.avd
– %PROGRAM FILES%\SpySheriff\base001.avd
– %PROGRAM FILES%\SpySheriff\base002.avd
– %PROGRAM FILES%\SpySheriff\found.wav
– %PROGRAM FILES%\SpySheriff\heur000.dll
– %PROGRAM FILES%\SpySheriff\heur001.dll
– %PROGRAM FILES%\SpySheriff\heur002.dll
– %PROGRAM FILES%\SpySheriff\heur003.dll
– %PROGRAM FILES%\SpySheriff\IESecurity.dll
– %PROGRAM FILES%\SpySheriff\notfound.wav
– %PROGRAM FILES%\SpySheriff\ProcMon.dll
– %PROGRAM FILES%\SpySheriff\removed.wav
– %PROGRAM FILES%\SpySheriff\SpySheriff.exe
– %PROGRAM FILES%\SpySheriff\Uninstall.exe
– %PROGRAM FILES%\SpySheriff\SpySheriff.dvm

It tries to download a file:

– The location is the following:
   • http://www.**********sheriff.com/trial.php?rest=%several random numbers from 0 to 9%&ver=%several random numbers from 0 to 9%&a=00000001
It is saved on the local hard drive under: %home%\Application Data\Install.dat

Registry The following registry keys are added in order to run the processes after reboot:

– [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   • "Windows installer"="%system drive root%\winstall.exe"
   • "SNInstall"="%malware execution directory%\%executed file%"

The value of the following registry key is removed:

– [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer]
   • NoDesktop

The following registry key including all values and subkeys is removed:
   • [HKCU\SOFTWARE\Install]

The following registry keys are added:

– [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\
   ActiveDesktop]
   • "NoChangingWallpaper"=dword:00000000
   • "NoComponents"=dword:00000000
   • "NoAddingComponents"=dword:00000000
   • "NoDeletingComponents"=dword:00000000
   • "NoEditingComponents"=dword:00000000
   • "NoHTMLWallPaper"=dword:00000000

– [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
   • "NoActiveDesktop"=dword:00000000
   • "ClassicShell"=dword:00000000
   • "ForceActiveDesktopOn"=dword:00000001

– [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System]
   • "Wallpaper"="%WINDIR%\desktop.html"

The following registry keys are changed:

– [HKCU\Software\Microsoft\Internet Explorer\Desktop\General]
   Old value:
   • "WallpaperFileTime"=%user defined settings%
   • "WallpaperLocalFileTime"=%user defined settings%
   • "TileWallpaper"=%user defined settings%
   • "WallpaperStyle"=%user defined settings%
   • "ComponentsPositioned"=%user defined settings%
   New value:
   • "WallpaperFileTime"=%hex values%
   • "WallpaperLocalFileTime"=%hex values%
   • "TileWallpaper"="0"
   • "WallpaperStyle"="2"
   • "ComponentsPositioned"=dword:00000002

– [HKCU\Software\Microsoft\Internet Explorer\Desktop\Components]
   Old value:
   • "DeskHtmlVersion"=%user defined settings%
   • "DeskHtmlMinorVersion"=%user defined settings%
   • "Settings"=%user defined settings%
   • "GeneralFlags"=%user defined settings%
   New value:
   • "DeskHtmlVersion"=dword:00000110
   • "DeskHtmlMinorVersion"=dword:00000005
   • "Settings"=dword:00000001
   • "GeneralFlags"=dword:00000004

– [HKCU\Software\Microsoft\Internet Explorer\Desktop\Components\0]
   Old value:
   • "Source"=%user defined settings%
   • "SubscribedURL"=%user defined settings%
   • "FriendlyName"=%user defined settings%
   • "Flags"=%user defined settings%
   • "Position"=%user defined settings%
   • "CurrentState"=%user defined settings%
   • "OriginalStateInfo"=%user defined settings%
   • "RestoredStateInfo"=%user defined settings%
   New value:
   • "Source"="About:Home"
   • "SubscribedURL"="About:Home"
   • "FriendlyName"="My Current Home Page"
   • "Flags"=dword:00000002
   • "Position"=%hex values%
   • "CurrentState"=dword:40000004
   • "OriginalStateInfo"=%hex values%
   • "RestoredStateInfo"=%hex values%

– [HKCU\Control Panel\Desktop]
   Old value:
   • "TileWallpaper"=%user defined settings%
   • "WallpaperStyle"=%user defined settings%
   • "Pattern"=%user defined settings%
   New value:
   • "TileWallpaper"="0"
   • "WallpaperStyle"="2"
   • "Pattern"=""

File details Programming language:
The malware program was written in MS Visual C++.

See a brief description here.

Description inserted by Andrei Gherman on Mon, 24 Oct 2005 10:21 (GMT+1)
Description updated by Andrei Gherman on Tue, 25 Oct 2005 15:59 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back