Backdoor:W32/Agent.AMB

Threat description

Details

CATEGORYMalware
TYPEBackdoor

Summary

A remote administration utility which bypasses normal security mechanisms to secretly control a program, computer or network.



Removal

Automatic action

Depending on the settings of your F-Secure security product, it will either automatically delete, quarantine or rename the suspect file, or ask you for a desired action.

More scanning & removal options

More information on the scanning and removal options available in your F-Secure product can be found in the Help Center.

You may also refer to the Knowledge Base on the F-Secure Community site for more information.

Contact Support

F-Secure customers can request support online via the Request support or the Chat forms on our Home - Global site.

Technical Details

Backdoor:W32/Agent.AMB is a malicious program that allows an attacker to remotely download and execute files on the infected computer. The backdoor may also be used to force the computer to perform Denial of Service (DoS) attacks.

Installation

It drops its main executable in Windows System directory using any of the following filenames:

  • serivces.exe
  • svchost.exe

Agent.AMB also drops the following file:

  • %temp%\rs.bat - A batch file used to delete the executed copy of the backdoor.

It installs itself as a service using any of the following service names:

  • Windows Firewall
  • wuauserv
Activity

Agent.AMB connects to a remote site and awaits for commands from a remote hacker.

It may also perform DoS attacks on certain websites and download other malware from the Internet.

Some variants of this backdoor may drop copies of its executable file (using random filenames) to the following locations:

  • %Program Files%\Common Files\Microsoft Shared\
  • %Program Files%\Windows Media Player\
  • %Program Files%\Internet Explorer\Connection Wizard\
  • %WinDir%\addins\
  • %WinDir%\system\

Other variants also drop the configuration file, Autorun.inf, together with the main executable. If the Windows Autorun function is enabled in the system, the Autorun.inf file is used to automatically run the backdoor upon opening a drive or inserting a removable device into the machine.

Submit a Sample

Suspect a file or URL was wrongly detected?
Send it to our Labs for further analysis

Submit a Sample

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

More Info