Name :	Trojan-Downloader:W32/Agent.HSM
Category:	Malware
Type:	Trojan-Downloader
Platform:	W32

This type of trojan secretly downloads malicious files from a remote server, then installs and executes the files.

This trojan may be downloaded from a malicious website. It may also arrive as an e-mail attachment.

Known e-mail subjects associated with this malware are:


Installation
During installation, the trojan will drop a copy of itself to:


It also sets a launch point with the following registry key:


It will then try to launch svchost.exe, and injects its code by replacing the launched svchost.exe code.

Execution
Upon execution, this malware will attempt to connect to the following websites:


It then attempts to download additional files from the following IP addresses:


As of this writing, these IP addresses are down and are not available.