TR/Drop.MuJoin.AF - Trojan

See also

Summary

Full description

Statistics

Virus:	TR/Drop.MuJoin.AF
Date discovered:	28/08/2008
Type:	Trojan
Subtype:	Dropper
In the wild:	Yes
Reported Infections:	Low
Distribution Potential:	Low
Damage Potential:	Low to medium
Static file:	Yes
File size:	106.464 Bytes
MD5 checksum:	f55af02d70f51af5ff3095e7c53c9a9c
IVDF version:	7.00.06.88 - Thu, 28 Aug 2008 17:13 (GMT+1)

General Method of propagation:
   • Email

Aliases:
   • Kaspersky: Trojan-Dropper.Win32.Agent.age
   • F-Secure: Trojan-Dropper.Win32.Agent.age
   • Sophos: Troj/Dropper-PY
   • Panda: Trj/Comic.G
   • Grisoft: Dropper.Agent.AJL
   • VirusBuster: Trojan.DR.Agent.RCE
   • Eset: Win32/TrojanDropper.Agent.AGE trojan
   • Bitdefender: Trojan.Dropper.Multijoiner.AC

Platforms / OS:
   • Windows 95
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003

Side effects:
   • Drops a malicious file

Files The following file is created:

– %home%\Local Settings\Temp Furthermore it gets executed after it was fully created. Further investigation pointed out that this file is malware, too. Detected as: BDS/TOn.AB

Email It doesn't have its own spreading routine but it was spammed out via email. The characteristics are described in the following:

From:
The sender address is spoofed.

Subject:
The following:
   • Hallo von Simone

Body:
The body of the email is the following:

   • Hallo,

     Deine Kontaktanzeige bei single.de fand ich toll, auch
     Dein Bild und Deine Vorstellungen.

     Ich suche auch schon seit lägerer Zeit nach netten Kontakten,
     für Freizeit, Hobbys und Erotik.

     Ich schicke mal ein Bild von mir mit, wenn Du Interesse hast,
     melde Dich, damit wie ein Treffen vereinbaren können.
     Gern mit Tel. Nummer.

     Bild von mir im Anhang.


     Bis bald, Simone

Attachment:

The attachment is a copy of the malware itself.

The email looks like the following:

File details Programming language:
The malware program was written in MS Visual C++.

See a brief description here.

Description inserted by Thomas Wegele on Thu, 28 Aug 2008 09:13 (GMT+1)
Description updated by Thomas Wegele on Fri, 29 Aug 2008 05:49 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back