PE_AGATDUL.A-O

This file infector arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

However, as of this writing, the said sites are inaccessible.

Arrival Details

This file infector may arrive via network shares.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This file infector drops and executes the following files:

• %System Root%\z1.tmp - detected as TROJ_ROOTER.AACZ

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

It drops the following copies of itself into the affected system:

• %System%\drivers\TXPlatform.exe

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

It drops the following non-malicious file:

• %System Root%\GK.TMP

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

Autostart Technique

This file infector adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Explorer = "%System%\drivers\TXPlatform.exe"

Other System Modifications

This file infector modifies the following registry entries:

HKEY_CLASSES_ROOT\HTTP\shell\
open\command
@ = ""%Program Files%\InternetExplorer\iexplore.exe" -nohome"

(Note: The default value data of the said registry entry is "%Program Files%\Internet Explorer\iexplore.exe" -nohome.)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer
NoDriveTypeAutoRun = "80"

(Note: The default value data of the said registry entry is 91.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced\Folder\Hidden\
SHOWALL
CheckedValue = "0"

(Note: The default value data of the said registry entry is 1.)

Propagation

This file infector drops the following copy of itself in all physical and removable drives:

• [DRIVE]:\¡¡¡¡¡¡.exe

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

The said .INF file contains the following strings:

[autorun]
OPEN=¡¡¡¡¡¡.exe
shell\open={garbage code}
shell\open\Command=¡¡¡¡¡¡.exe
shell\open\Default=1
shell\explore={garbage code}
shell\explore\Command=¡¡¡¡¡¡.exe

Other Details

This file infector connects to the following possibly malicious URL:

• http://www.{BLOCKED}gou.com/goto/down.txt
• http://www.{BLOCKED}s.com/TJ.Htm

However, as of this writing, the said sites are inaccessible.

NOTES:

It infects all executeable files found in shared folders. Infected files are detected by Trend Micro as PE_AGATDUL.A.

It drops the following file in the found shared folders as an infection marker:

• Desktop_1.ini

It creates the following IFEO registries to disable certain applications:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
Debugger = "ntsd -d"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\{application name}
Debugger = "ntsd -d"

{application name} may be any of the following:

• 360hotfix.exe
• 360rpt.exe
• 360safe.exe
• 360safebox.exe
• 360tray.exe
• Debugger
• SetupLD.exe
• agentsvr.exe
• apvxdwin.exe
• ast.exe
• avcenter.exe
• avengine.exe
• avgnt.exe
• avguard.exe
• avltmain.exe
• avp.exe
• avp32.exe
• avtask.exe
• bdagent.exe
• bdwizreg.exe
• boxmod.exe
• ccapp.exe
• ccenter.exe
• ccevtmgr.exe
• ccregvfy.exe
• ccsetmgr.exe
• egui.exe
• ekrn.exe
• extdb.exe
• frameworkservice.exe
• frwstub.exe
• guardfield.exe
• iparmor.exe
• kaccore.exe
• kasmain.exe
• kav32.exe
• kavstart.exe
• kavsvc.exe
• kavsvcui.exe
• kislnchr.exe
• kissvc.exe
• kmailmon.exe
• knownsvr.exe
• kpfw32.exe
• kpfwsvc.exe
• kregex.exe
• kvfw.exe
• kvmonxp.exe
• kvmonxp.kxp
• kvol.exe
• kvprescan.exe
• kvsrvxp.exe
• kvwsc.exe
• kvxp.kxp
• kwatch.exe
• livesrv.exe
• makereport.exe
• mcagent.exe
• mcdash.exe
• mcdetect.exe
• mcshield.exe
• mctskshd.exe
• mcvsescn.exe
• mcvsshld.exe
• mghtml.exe
• naprdmgr.exe
• navapsvc.exe
• navapw32.exe
• navw32.exe
• nmain.exe
• nod32.exe
• nod32krn.exe
• nod32kui.exe
• npfmntor.exe
• oasclnt.exe
• pavsrv51.exe
• pfw.exe
• psctrls.exe
• psimreal.exe
• psimsvc.exe
• qqdoctormain.exe
• ras.exe
• ravmon.exe
• ravmond.exe
• ravstub.exe
• ravtask.exe
• rfwcfg.exe
• rfwmain.exe
• rfwproxy.exe
• rfwsrv.exe
• rsagent.exe
• rsmain.exe
• rsnetsvr.exe
• rssafety.exe
• rstray.exe
• safebank.exe
• safeboxtray.exe
• scan32.exe
• scanfrm.exe
• sched.exe
• seccenter.exe
• secnotifier.exe
• shstat.exe
• smartup.exe
• sndsrvc.exe
• spbbcsvc.exe
• symlcsvc.exe
• tbmon.exe
• uihost.exe
• ulibcfg.exe
• updaterui.exe
• uplive.exe
• vcr32.exe
• vcrmon.exe
• vptray.exe
• vsserv.exe
• vstskmgr.exe
• webproxy.exe
• xcommsvr.exe
• xnlscn.exe