Name :	Backdoor:W32/Agent.CTH
Category:	Malware
Type:	Backdoor
Platform:	W32

Backdoor:W32/Agent.CTH is a backdoor that can steal information.

Stolen information is sent to a collection site using an HTTP POST command.

Upon execution, this malware drops the following files:


The files s32.txt and ws386.ini are logs.

As part of its autostart mechanism, it installs itself as a system service.


It also creates the following registry entry:


It checks for Internet connectivity by attempting to connect to the following sites:


This malware can steal information such as:


Stolen information is sent to a collection site using an HTTP POST command.

It also collects e-mail addresses but ignores addresses with the following strings: