Home / malwarePDF  

Trojan-Dropper:W32/Agent.REK


First posted on 25 June 2008.
Source: SecurityHome

Aliases :

There are no other names known for Trojan-Dropper:W32/Agent.REK.

Explanation :

Agent.REK drops and executes other malware applications on the infected system, thus compromising system security.

right]Upon execution, Agent.REK drops and executes the following files:

  • %System%WinNt32.dll
  • %System%drivers[Random Filename].sys

Note: %System% represents a path that is typically C:WindowsSystem32.

Note: [Random Filename] represents a randomly generated filename used by the trojan at the time of infection, such as Oiv23.sys and Tqy10.sys.

The dropped files are detected as Trojan-Downloader.Win32.Agent.GLH and Trojan-Dropper.Win32.Agent.REK respectively.

This Trojan creates the following registry entries as part of its installation:

  • HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifyWinNt32
    DLLName = "WinNt32.dll"
    StartShell = WLEventStartShell
  • HKLMSYSTEMCurrentControlSetServices[random filename]
    ImagePath = "%System%drivers[random filename]
  • HKLMSYSTEMCurrentControlSetControlSafeBootMinimal[random filename].sys (default) = Driver
  • HKLMSYSTEMCurrentControlSetControlSafeBootNetwork[random filename].sys (default) = Driver

Trojan-Downloader.Win32.Agent.GLH then attempts to connect to the following IP addresses:

  • 208.66.195.15
  • 217.170.77.146
  • 66.232.113.80

Additional Note

Files detected as Trojan-Dropper.Win32.Agent.slh have the same characteristics as Agent.REK.

Last update 25 June 2008

 

TOP

Malware :

Family: