F-Secure
Tools
Trojan-Dropper:W32/Agent.FBB
| Name : | Trojan-Dropper:W32/Agent.FBB |
| Detection Names : |
Trojan-Dropper.Win32.Agent.vmh Trojan-Dropper:W32/Agent.FBB Trojan-Dropper:W32/Agent.FBB |
| Size: | 41472 |
| Category: | Malware |
| Type: | Trojan-Dropper |
| Platform: | W32 |
Summary
This type of trojan contains one or more malicious programs, which it will secretly install and execute.
Details
File System Changes
Creates these files:
• %windir%\system32\devecl.dll
• %windir%\system32\deveio.dll
• %windir%\system32\drivers\devekd.sys
• %appdata%\dever.tmp
Process Changes
Creates these mutexes:
• deveinf.exe
Registry Modifications
Sets these values:
• HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MSKDC
Type = 00000001
Type = 00000001
• HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MSKDC
Start = 00000003
Start = 00000003
• HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MSKDC
ErrorControl = 00000000
ErrorControl = 00000000
• HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MSKDC
ImagePath = C:\WINDOWS\System32\drivers\devekd.sys
ImagePath = C:\WINDOWS\System32\drivers\devekd.sys
• HKEY_CURRENT_USER\Software\myclient
Software = iamxxxx
Software = iamxxxx
• HKEY_CURRENT_USER\Software\myclient
myclient = myuser@webmail.hotmailhotmail.com.cn
myclient = myuser@webmail.hotmailhotmail.com.cn
• HKEY_CURRENT_USER\Software\myclient
ip = 127.0.0.1
ip = 127.0.0.1
• HKEY_CURRENT_USER\Software\myclient
port = 000001BB
port = 000001BB
• HKEY_CURRENT_USER\Software\Microsoft
Waiting = 0100007F
Waiting = 0100007F
• HKEY_CURRENT_USER\Software\Windows NT\CurrentVersion\Winlogon
Shell = explorer.exe C:\DOCUME~1\[username]\APPLIC~1\deveinf.exe
Shell = explorer.exe C:\DOCUME~1\[username]\APPLIC~1\deveinf.exe
Additional Details
Trojan-Dropper:W32/Agent.FBB appears to be an innocent EXE file, and is usually delivered as an e-mail attachment, or as a standalone file. The recipient must click on and execute the EXE file in order to infect their system.
Installation
On execution, Agent.FBB creates a copy of itself as %appdata%\deveinf.exe. A process iexplore.exe is created and two DLL files, devecl.dll and deveio.dll, are injected into it. The process name is the same as the process name for the legitimate application Microsoft Internet Explorer, and is deliberately used to camouflage the malware.
The trojan also creates DLL files in the application data folder (by default, C:\Documents and Settings\[username]\Application Data) and the Windows folder (default is C:\Winnt for Windows NT/2000 and C:\Windows for Windows XP). One of the files created in the Windows folder, devekd.sys, uses rootkit techniques to hide itself, the injected process IEXPLORE.EXE, and the other malicious dll files.
Activity
The deveio.dll file injected into the iexplore.exe process is detected as Backdoor:W32/Hupigon.BXBH and is a keylogger program. Any information typed in by the individual on the infected system is logged. The malware author can then enter the infected system at their own leisure and retrieve the logged information using a separate server program.
The other injected file devecl.dll is detected as Trojan:W32/Inject.EC and acts by manipulating the process to make registry changes. The changes to the winlogon registry keys enable the malware to start automatically whenever the system is restarted, while another registry key change allows the rootkit to start automatically as a Windows NT service on every subsequent startup. The changes also hide the Windows system file devenum.dll, which enumerates the available devices which receive DirectX data.
Installation
On execution, Agent.FBB creates a copy of itself as %appdata%\deveinf.exe. A process iexplore.exe is created and two DLL files, devecl.dll and deveio.dll, are injected into it. The process name is the same as the process name for the legitimate application Microsoft Internet Explorer, and is deliberately used to camouflage the malware.
The trojan also creates DLL files in the application data folder (by default, C:\Documents and Settings\[username]\Application Data) and the Windows folder (default is C:\Winnt for Windows NT/2000 and C:\Windows for Windows XP). One of the files created in the Windows folder, devekd.sys, uses rootkit techniques to hide itself, the injected process IEXPLORE.EXE, and the other malicious dll files.
Activity
The deveio.dll file injected into the iexplore.exe process is detected as Backdoor:W32/Hupigon.BXBH and is a keylogger program. Any information typed in by the individual on the infected system is logged. The malware author can then enter the infected system at their own leisure and retrieve the logged information using a separate server program.
The other injected file devecl.dll is detected as Trojan:W32/Inject.EC and acts by manipulating the process to make registry changes. The changes to the winlogon registry keys enable the malware to start automatically whenever the system is restarted, while another registry key change allows the rootkit to start automatically as a Windows NT service on every subsequent startup. The changes also hide the Windows system file devenum.dll, which enumerates the available devices which receive DirectX data.