Malware Information

Malware name Trojan.Agent.137216.2.A Type Trojan Affected platform Win32 Media-Type application/executable MD5 checksum 831E11DA49FEE6B692D009B8F71822CF Static file yes Filesize 137,216 Bytes Alias names (also known as) Sophos Troj/Drop-AK McAfee Generic BackDoor CA ETrust Win32/Rustock.BH Side effects Uses its own Email engine Propagation No own spreading routine

Description:

It contains an integrated SMTP engine in order to send Spam emails. A direct connection with the destination server will be established. The characteristics are described in the following:


From:
The sender address is spoofed.


To:
– Generated addresses


Subject:
One of the following:
• Miley Cyrus describes her dream man
• West Nile virus cases reported in California
• Beijing under threat as Olympics looms
• US Potatoes unsafe for consumption
• Man shoots churchgoers over liberal views
• Typhoon in Taiwan devastates city
• Car bomb in Washington kills hundreds
• Bridge collapses in New York
• FDA warns against eating lobster
• Amy Winehouse hospitalized following drug overdose
• New cure for Alzheimers' discovered
• Woman gives birth to 18th child



Body:
– Contains HTML code.
The body of the email is one of the following:

• JFK heir found http://**********.de/livestreaming.html.

• Plastic surgery on face can cause cancer - Johns Hopkins study http://www.firma-**********.de/livestreaming.html

• China now richer than US - Merrill Lynch study http://www.**********.com.tw/livestreaming.html

• Thailand decides to cut off economic exchanges with Cambodia, putting possibility of war on the table
http://www.**********studio.com/livestreaming.html



The email looks like the following:



Programming language:
The malware program was written in MS Visual C++.


Runtime packer:
In order to aggravate detection and reduce size of the file it is packed with the following runtime packer:
• UPX