TROJ_AGENTE.DXEN

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It does not have any propagation routine.

It does not have any backdoor routine.

It does not have any downloading capability.

It does not have any information-stealing capability.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following files:

• %Windows%\setupa.tmp

(Note: %Windows% is the Windows folder, which is usually C:\Windows.)

It creates the following folders:

• %Windows%\$NtUninstallKB09527$
• %Windows%\$NtUninstallKB09527$\spuninst

(Note: %Windows% is the Windows folder, which is usually C:\Windows.)

Autostart Technique

This Trojan registers itself as a system service to ensure its automatic execution at every system startup by adding the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\DirectX Extended

Propagation

This Trojan does not have any propagation routine.

Backdoor Routine

This Trojan does not have any backdoor routine.

Download Routine

This Trojan does not have any downloading capability.

Information Theft

This Trojan does not have any information-stealing capability.

NOTES:

This Trojan retrieves its settings from the following configuration file:

• %Current%\cfg.dat

It monitors for removable drives inserted in the affected system. Once triggered, it will copy user files with pre-defined file names and specific file types.

The file name and type depends on its configuration file.

The file name is determined by the F1 - F100 keys under [FILE] section of the configuration file.

By default, it copies .ppt and .doc user files and saves them to the following folder:

• %Windows%\$NtUninstallKB09527$\

If it fails to do so, it will try to save the copied file to the following folder:

• %Windows%\$NtUninstallKB09527$\spuninst

It renames the copied files by changing the last letter of the file extension to '-'. (e.g. .do-, .pp-)

Then, it will log the properties of the copied files to %Windows%\setupa.tmp.

The said .tmp file also contains the following strings on the start and end of the file, respectively:

• *************start********************
• *************stop*********************

It does not have rootkit capabilities.

It does not exploit any vulnerability.