TR/Dldr.Agent.SY - Trojan

See also

Summary

Full description

Statistics

Virus:	TR/Dldr.Agent.SY
Date discovered:	28/10/2005
Type:	Worm
In the wild:	No
Reported Infections:	Low
Distribution Potential:	Low
Damage Potential:	Low to medium
Static file:	Yes
File size:	12.592 Bytes
MD5 checksum:	e9392f9786d1780a2a18cff13666d14b
VDF version:	6.31.01.150 - Fri, 19 Aug 2005 15:55 (GMT+1)

General Method of propagation:
   • No own spreading routine

Alias:
   • Kaspersky: Trojan-Downloader.Win32.Small.awa

Platforms / OS:
   • Windows 95
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003

Side effects:
   • Downloads malicious files
   • Drops a file
   • Registry modification

Files It copies itself to the following location:
   • %SYSDIR%\popcorn72.exe

The following files are created:

– %SYSDIR%\msblank.html

It tries to download some files:

– The location is the following:
   • http://www.**********link.biz/07/1001.exe
It is saved on the local hard drive under: %malware execution directory%\1.dat Further investigation pointed out that this file is malware, too. Detected as: TR/Dldr.Small.awa.64

– The location is the following:
   • http://www.**********link.biz/07/1001.exe
It is saved on the local hard drive under: %sysdir%\winctrl64.exe Furthermore this file gets executed after it was fully downloaded. Further investigation pointed out that this file is malware, too. Detected as: TR/Dldr.Small.awa.64

– The location is the following:
   • http://www.**********link.biz/07/1002.exe
It is saved on the local hard drive under: %malware execution directory%\2.dat Further investigation pointed out that this file is malware, too. Detected as: Joke/Renos.W

– The location is the following:
   • http://www.**********link.biz/07/1002.exe
It is saved on the local hard drive under: %SYSDIR%\winctrl32.exe Furthermore this file gets executed after it was fully downloaded. Further investigation pointed out that this file is malware, too. Detected as: Joke/Renos.W

– The location is the following:
   • http://www.**********link.biz/07/1003.exe
It is saved on the local hard drive under: %malware execution directory%\3.dat Further investigation pointed out that this file is malware, too.

– The location is the following:
   • http://www.**********link.biz/07/1003.exe
It is saved on the local hard drive under: %SYSDIR%\winctrl16.exe Furthermore this file gets executed after it was fully downloaded. Further investigation pointed out that this file is malware, too.

Registry The following registry key is added in order to run the process after reboot:

– [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   • "ControlPanel"="%SYSDIR%\popcorn72.exe rundll.dll,LoadMouseProfile"

The registered DLL file changes the startpage of Internet Explorer to: %SYSDIR%\msblank.html
– [HKCU\Software\Microsoft\Internet Explorer\Main]
   Old value:
   • "Start Page"="%user defined settings%"
   New value:
   • "Start Page"="%SYSDIR%\msblank.html"

File details Programming language:
The malware program was written in Delphi.

Runtime packer:
In order to aggravate detection and reduce size of the file it is packed with the following runtime packer:
• FSG

See a brief description here.

Description inserted by Iulia Diaconescu on Tue, 01 Nov 2005 12:39 (GMT+1)
Description updated by Iulia Diaconescu on Mon, 28 Nov 2005 17:34 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back