SecurityHome.eu Trojan-Spy:W32/Agent.AHG

Home / malware PDF

Trojan-Spy:W32/Agent.AHG

First posted on 31 October 2007.
Source: SecurityHome
Aliases :
Trojan-Spy:W32/Agent.AHG is also known as Trojan-Spy.Win32.Agent.ahg.
Explanation :
This is a key-logging trojan that logs all the keystrokes of the user and sends them to a certain website.

Upon Execution, this malware displays the following fake error message:

It then drops the following files on Windows System folder:

%systemdir%GenuineLicence.exe
Detected as Trojan-Spy.Win32.Agent.ahg
%systemdir%kbd.dll
Detected as Trojan-Spy.Win32.KeyLogger.rk
%systemdir% est.dll
Detected as Trojan-Spy.Win32.Agent.ahg

Note: %systemdir% by default is C:Windowssystem32

It also creates the following registry key as part of its auto-start mechanism:

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun
service = "C:WINDOWSsystem32GenuineLicence.exe"

This malware sends the user's keylogs to the following site:

http://208.101.11.35/~bistecin/about/profile/.old/[REMOVED].php

Last update 31 October 2007

Malware :

Last 20

Family: