Name :	Trojan-Downloader:W32/Agent.FCG
Size:	3,117
Category:	Malware
Type:	Trojan-Downloader
Platform:	W32

This trojan arrives on the system as a downloaded file of another malware installation package. The first reported instance of the malware was during the recent (October 2007) PDF exploit attack that is detected as Exploit:W32/AdobeReader.L. Upon execution, this trojan downloads and executes another trojan file in the compromised system, currently detected as Trojan-Dropper:W32/Agent.CMW.

Being a means to an end, this trojan's role is primarily to download another trojan and execute it on the user's system.

Utilizing Windows' own Background Intelligent Transfer Service (BITS), which Windows also uses for Downloading Updates to a user's system, the malware will attempt to download the target payload file from the following URL:

This method proves to be effective in bypassing firewall applications.

For the purpose of bypassing antivirus scanners, this trojan's downloaded payload file is encrypted. Once downloaded, it will then decrypt and execute the file in memory, thus avoiding antivirus scanners that work mostly if a physical file is present.

In case the file download via BITS has not been successful, it will attempt to download the same payload file again, this time using a direct download via Windows API functions.

The payload file downloaded is currently detected as Trojan-Dropper:W32/Agent.CMW.

When this file has been successfully executed, the malware will then perform a cleanup by deleting itself from the system.