Home / malware Trojan-Downloader:W32/Agent.BRK
First posted on 27 July 2007.
Source: SecurityHomeAliases :
Trojan-Downloader:W32/Agent.BRK is also known as Agent.brk, Trojan-Downloader.Win32.Agent.brk, Win32/TrojanDownloader.Agent.NPW.
Explanation :
Trojan-Downloader:W32/Agent.BRK attempts to download and install other malware onto the affected system.
- %sysdir%drivers
untime.sys
The component is detected as Rootkit.Win32.Agent.dw.
It also replaces the file for the Microsoft Windows IPv6 Windows Firewall Driver service:
- %sysdir%driversip6fw.sys
The file is replaced with a copy of Rootkit.Win32.Agent.dp.
The services are then installed and started.
Furthermore, Trojan-Downloader:W32/Agent.BRK launches an instance of Microsoft Internet Explorer as a hidden process with its code injected into the process.
It then attempts to connect to the following addresses:
- 66.246.72.173
- 67.18.114.98
- 208.66.194.241
It attempts to download another malware component by sending an HTTP GET command with some details regarding the infected machine.
The downloaded file is then saved as:
- %sysdir%9_exception.nls
The downloaded malware is currently detected as Rootkit.Win32.Agent.ey which makes the infected machine act as an e-mail spam bot.
Trojan-Downloader:W32/Agent.BRK creates the following mutex while active:
- k4j.32H_f7z_Z6e.g8G0
Last update 27 July 2007