F-Secure
Tools
Trojan-Downloader:W32/Agent.HPS
| Name : | Trojan-Downloader:W32/Agent.HPS |
| Detection Names : |
Trojan.Win32.Agent.aejy |
| Category: | Malware |
| Type: | Trojan-Downloader |
| Platform: | W32 |
Summary
Trojan-downloaders attempt to download and install new malware, spyware, or adware on the targeted computer. No graphical user interface can be seen; it will run in the background.
Additional Details
This file will copy itself to:
It creates a process as svchost.exe.
It sets a launch point with the following registry key:
Agent.HPS attempts to download files from these IP addresses:
• \system32\rs32net.exe
It creates a process as svchost.exe.
It sets a launch point with the following registry key:
• Key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Value: rs32net
Data: \system32\rs32net.exe
Value: rs32net
Data: \system32\rs32net.exe
Agent.HPS attempts to download files from these IP addresses:
• 91.203.92.7
• 208.66.195.16
• 208.66.195.71
• 208.66.195.232
• 208.66.195.240
• 216.195.55.50
• 216.195.56.22
• 209.66.122.238