|
|
|  |
|
|
|
|
F-Secure Malware Information Pages: Trojan-Downloader:W32/Agent.ICF
|
|
|
| Radar |
 |
|
|
|
Summary
|
Trojan-Downloader:W32/Agent.ICF attempts to download files.
It also drops files and writes to the system registry. |
|
|
|
Disinfection
|
Trojan-Downloader |
|
|
|
Detailed Description
|
File System Changes
Attention: %windir% represents the default Windows directory.
Creates these files:
- %windir%\system32\dx6vcl.dll
- %windir%\system32\notepod.exe
- %windir%\system32\disk.ico
- %windir%\system32\xtemp1.exe
- %windir%\system32\xtemp2.exe
Replaces the following file with a copy of itself:
- %windir%\system32\rsvp.exe
Note: The file called rsvp.exe is a Windows system file. Deletion of the malware file during disinfection will require the repair of the system file.
Creates these directories:
- %windir%\Web\webpf
- %windir%\Web\webdc
- %windir%\Web\webpt
- %windir%\Web\webhp
- %windir%\Web\webxs
Process Changes
Creates these processes:
- %windir%\system32\rsvp.exe
Uses these temporary processes:
- %windir%\system32\xtemp1.exe
- %windir%\system32\xtemp2.exe
These modules were loaded into other processes:
- %windir%\system32\dx6vcl.dll
Loaded into %windir%\system32\svchost.exe
Creates these mutexes:
- c:!windows!system32!config!systemprofile
!local settings!temporary internet files!content.ie5! - c:!windows!system32!config!systemprofile!cookies!
- c:!windows!system32!config!systemprofile!local settings!history!history.ie5!
Network Connections
Attempts to download files from:
- http://www.why001.com/[Removed].exe
- http://www.koreaara.com/down/[Removed].rar
- http://63.245.209.10/[Removed].dat
Registry Modifications
Sets these values:
- HKLM\System\CurrentControlSet\Control\Session Manager\SFC
ProgramFilesDir = C:\Program Files\x174 - HKLM\System\CurrentControlSet\Control\Session Manager\SFC
CommonFilesDir = C:\Program Files\Common FilesurrentControlSet
\Control\Session Manager - HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt
Application = notepod.exe - HKLM\System\CurrentControlSet\Services\RSVP
Type = 00000010 - HKLM\System\CurrentControlSet\Services\RSVP
Start = 00000002 - HKLM\System\CurrentControlSet\Services\RSVP
ErrorControl = 00000000 - HKCU\Software\Microsoft\Windows Script\Settings
JITDebug = 00000000
Creates these keys:
- HKLM\Software\Classes\Applications\notepod.exe
- HKLM\Software\Classes\Applications\notepod.exe\shell
- HKLM\Software\Classes\Applications\notepod.exe\shell\open
- HKLM\Software\Classes\Applications\notepod.exe\shell\open\command
- HKCU\Software\Microsoft\Windows Script
- HKCU\Software\Microsoft\Windows Script\Setting
Additional Details
Notepod:
Agent.ICF creates a file called notepod.exe and sets a registry value to associate .TXT files with it. If the system user opens a text file notepod.exe will be launched, which in turn calls on notepad.exe. Notepad.exe is a legitimate Windows file.
The launching of notepod.exe will once again execute the trojan-downloader mechanisms.
Automatic Updates:
Agent.ICF attempts to delete the Automatic Updates service. The Automatic Update service enables the download and installation of Windows updates.
Autorun Features:
Agent.ICF also contains autorun features. See the Worm/W32:Autorun description for additional details. The autorun.inf file will copy to the root of a removable drive. Under a folder called recycled there is a file called cleardisk.pif. The PIF file a copy of the trojan-downloader. |
|
|
|
F-Secure Corporation |
|
|
|
|
|
Last Modified: February 05, 2008
|
|
|
|
|
