TROJ_AGENT.SMRC

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It deletes itself after execution.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Other System Modifications

This Trojan modifies the following file(s):

• %Windows%\Prefetch\NTOSBOOT-B00DFAAD.pf
• %Windows%\Prefetch\WUAUCLT.EXE-399A8E72.pf

(Note: %Windows% is the Windows folder, which is usually C:\Windows.)

It deletes the following files:

• %Temporary Internet Files%\Content.IE5\KZSJCDCF\0[1].htm
• %Temporary Internet Files%\Content.IE5\89ABCDEF\0[1].htm
• %Windows%\SoftwareDistribution\DataStore\Logs\edbtmp.log

(Note: %Temporary Internet Files% is the Temporary Internet Files folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temporary Internet Files on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Microsoft\Windows\Temporary Internet Files on Windows Vista and 7.. %Windows% is the Windows folder, which is usually C:\Windows.)

Dropping Routine

This Trojan drops the following files:

• %Temp%\0525.exe
• %Temp%\02210.exe
• %Temp%\01700.exe
• %Temp%\01749.exe
• %Temp%\01191.exe
• %Temp%\02719.exe
• %Temp%\0783.exe
• %Temp%\01292.exe
• %Temp%\02771.exe

(Note: %Temp% is the Windows Temporary folder, which is usually C:\Windows\Temp.)

Other Details

This Trojan connects to the following possibly malicious URL:

• http://{BLOCKED}.211.244/bhy/0.exe

It deletes itself after execution.

This report is generated via an automated analysis system.