TR/Dldr.Agent.RCE - Trojan

See also

Summary

Full description

Statistics

Virus:	TR/Dldr.Agent.RCE
Date discovered:	17/09/2008
Type:	Trojan
Subtype:	Downloader
In the wild:	Yes
Reported Infections:	Low
Distribution Potential:	Low
Damage Potential:	Low to medium
Static file:	Yes
File size:	66.560 Bytes
MD5 checksum:	a189d2fbb2f3ed3e72b6e0f3bbd80a4f
IVDF version:	7.00.06.171 - Wed, 17 Sep 2008 16:24 (GMT+1)

General Method of propagation:
   • Email

Platforms / OS:
   • Windows 95
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003

Side effects:
   • Downloads a malicious file

Files It copies itself to the following location:
• %PROGRAM FILES%\Microsoft Common\wuauclt.exe

It deletes the initially executed copy of itself.

It tries to download a file:

– The location is the following:
• http://www.natursinnesgarten.de/**********/lspr.exe
It is saved on the local hard drive under: %temporary internet files%\lspr[1].exe Furthermore this file gets executed after it was fully downloaded. Further investigation pointed out that this file is malware, too. Detected as: TR/Dropper.Gen

Email It doesn't have its own spreading routine but it was spammed out via email. The characteristics are described in the following:

From:
The sender address is spoofed.

Subject:
One of the following:
   • Loan Contract
   • Contract of order fulfillment
   • Your new labour contract
   • Record in debit of account

   • Dear Sirs,
     We have prepared a contract and added the paragraphs that you wanted to see in it.
     Our lawyers made alterations on the last page. If you agree with all the provisions we are ready to make the payment on Friday for the first consignment.
     We are enclosing the file with the prepared contract.

     If necessary, we can send it by fax.
     Looking forward to your decision.

Attachment:
The filename of the attachment is:
   • contract.zip

The attachment is an archive containing a copy of the malware itself.

The email looks like the following:

File details Runtime packer:
In order to aggravate detection and reduce size of the file it is packed with a runtime packer.

See a brief description here.

Description inserted by Thomas Wegele on Wed, 17 Sep 2008 12:34 (GMT+1)
Description updated by Thomas Wegele on Wed, 17 Sep 2008 13:09 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back