Full description

Virus:	TR/Agent.33792.R
Date discovered:	04/01/2010
Type:	Trojan
In the wild:	Yes
Reported Infections:	Low
Distribution Potential:	Low
Damage Potential:	Low
Static file:	Yes
File size:	33.792 Bytes
MD5 checksum:	51ab5c878892a48bd8ff4561bfd0bb2b
IVDF version:	7.10.02.116 - Monday, January 4, 2010

General Aliases:
   • Panda: W32/Koobface.HG.worm
   • Eset: Win32/Koobface.NBH
   • Bitdefender: Win32.Worm.Koobface.APD

Platforms / OS:
   • Windows 2000
   • Windows XP
   • Windows 2003

Side effects:
   • Drops malicious files
   • Registry modification

Files It copies itself to the following location:
• %WINDIR%\pp14.exe

It deletes the initially executed copy of itself.

It deletes the following file:
• %WINDIR%\dxxdv34567.bat

The following files are created:

– %WINDIR%\dxxdv34567.bat Furthermore it gets executed after it was fully created. This batch file is used to delete a file.
– %WINDIR%\fdgg34353edfgdfdf

Registry One of the following values is added in order to run the process after reboot:

– [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
• "pp"="%WINDIR%\pp14.exe"

File details Runtime packer:
In order to aggravate detection and reduce size of the file it is packed with a runtime packer.

설명 삽입자 Petre Galan 2010년 3월 17일 수요일
설명 업데이트 Petre Galan 2010년 3월 17일 수요일

뒤로 . . . .

내 계정