BKDR_AGNT.D

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Delete and Create Files
• Check Disk Info
• Shutdown system
• Delete Self
• Sleep
• Connect to remote site
• Create/Terminate processes

NOTES:
Once executed, this malware checks for the following command line arguments:

• Ntvdm.exe {URL1} {Port1} {URL2} {Port2}

• {URL1} and {URL2} = sites where the malware connects to
• {Port1} and {Port2} = ports that are used for connecting

These arguments are required by the malware to successfully connect to the malicious user and received commands. However, these arguments are not from the malware itself. These arguments may come from another malware (dropper or downloader) which feeds the URL where this backdoor connects to.

It may require other components to properly execute.