Home / malware

PDF

Trojan.Agent.Delf.RHO

First posted on 21 November 2011.
Source: BitDefender

Aliases :

Trojan.Agent.Delf.RHO is also known as Generic.ImROBOT, Trojan-Im.Win32.Agent.ah, W32/Agent.AK!tr.

Explanation :

The malware spreads through links sent in instant messages on Yahoo!Messenger by other infected users. It tries to convince the target user that the message is legitimate by adding friendly phrases to trick the user into clicking the provided link. The used messages are:

sa intrii sa imi zici ce parere ai ca sigur recuonsti personaju ;)
o cunosti?

:)))
chiar vroiam sa te apelez, ai virusi si imi trimiti tot felu de mailuri
ia programu asta sa il scoti ca l-am avut si eu sau daca nu intra pe http://www.[link removed].ro
Afla cine te are pus la invizibil sau la ignore cu un singur click chiar si persoanele care sunt offline http://[link removed].blogspot.com
ce faci?
Super tare!!!!!!!! http://[link removed].blogspot.com

Depending on the version of the malware, if the target user replies, the virus will check for the presence of the following keywords in the reply and sends an automatic answer according to what is found:
KeywordReply
virusintra ca nu e nici un virus
estiuita-te si vrb dupa
mergetrebuie sa instalezi programu ca sa mearga
fricanu are de ce sa-ti fie frica


Once the user clicks the link he is usually directed to a web site or blog containing an embedded movie which requests the user to download a codec that is actually the malware. When the user executes the downloaded file, a progress bar briefly appears and the following files are installed without user intervention:

%WINDIR%system32yahooui.exe
%WINDIR%system32yahooauth2.dll
%WINDIR%system32ssleay32.dll
%WINDIR%system32libeay32.dll

It also places itself in the startup list by appending the following string to the registry key HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWinlogonShell

%WINDIR%system32yahooui.exe

After the next system startup, the yahooui.exe process creates the following registry key:

HKLMSOFTWAREYahoolidl

It waits for the user to sign in to Yahoo!Messenger and saves the username and password inside the values USER and PASS in the HKLMSOFTWAREYahoolidl key. The virus will then try to spread by sending spam messages to the contacts in the user's contact list.

The malware also downloads the following files:

%WINDIR%seocfg.exe
%WINDIR%upd1234.exe
%WINDIR%vbn.sdf

seocfg.exe and upd1234.exe are malware files, detected as Trojan.Spy.Banker.ACFQ, which tries to trick the user into accessing phishing sites related to banking. The vbn.sdf file contains the links which are sent in the spam messages.

Last update 21 November 2011

 

TOP