This type of trojan secretly downloads malicious files from a remote server, then installs and executes the files.
Once detected, the F-Secure security product will automatically disinfect the suspect file by either deleting it or renaming it.
Trojan-Downloader:W32/Agent.BRK attempts to download and install a rootkit program onto the affected system, which then forces the computer to act as an e-mail spam-bot.
Trojan-Downloader:W32/Agent.BRK drops the following driver component once it has been executed:
The component is detected as Rootkit.Win32.Agent.dw.
It also replaces the file for the Microsoft Windows IPv6 Windows Firewall Driver service:
The file is replaced with a copy of Rootkit.Win32.Agent.dp.
The services are then installed and started.
Trojan-Downloader:W32/Agent.BRK launches an instance of Microsoft Internet Explorer as a hidden process with its code injected into the process.
It then attempts to connect to the following addresses:
The following address were seen from newer variants of this malware:
It attempts to download another malware component by sending an HTTP GET command with some details regarding the infected machine.
The downloaded file is then saved as:
The variable [number] is any number from 0 - 9.
The downloaded malware is currently detected as Rootkit.Win32.Agent.ey and makes the infected machine act as an e-mail spam bot.
Trojan-Downloader:W32/Agent.BRK may create any of the following mutex while active: