MSIL/Agent.QVI [Threat Name] go to Threat

MSIL/Agent.QVI [Threat Variant Name]

Category trojan
Size 2099200 B
Detection created Nov 06, 2015
Detection database version 12526
Aliases Backdoor.Win32.Androm.iqkk (Kaspersky)
  TrojanSpy:MSIL/Yakbeex.A (Microsoft)
  Trojan.MulDrop6.13081 (Dr.Web)
Short description

The trojan has a simple payload. It serves as a dropper. The trojan usually contains within the main malware body another malware files.

Installation

When executed, the trojan copies itself into the following location:

  • %appdata%\­MSBuild\­MSBuild.exe

The trojan may set the following Registry entries:

  • [HKEY_CURRENT_USER\­SOFTWARE\­Microsoft\­Windows NT\­CurrentVersion\­Winlogon]
    • "shell" = "%appdata%\­MSBuild\­MSBuild.exe,explorer.exe"
  • [HKEY_CURRENT_USER\­Software\­Microsoft\­Windows\­CurrentVersion\­Run]
    • "Microsoft" = "%appdata%\­MSBuild\­MSBuild.exe"

This causes the trojan to be executed on every system start.


The trojan may set the following Registry entries:

  • [HKEY_LOCAL_MACHINE\­SOFTWARE\­Microsoft\­Windows\­CurrentVersion\­Policies\­System]
    • "EnableLUA" = 0

The trojan terminates its execution if it detects that it's running in a specific virtual environment.


The trojan quits immediately if it is run within a debugger.


The trojan quits immediately if it detects a running process containing one of the following strings in its name:

  • SbieCtrl.exe
  • vmwtoolsd.exe
  • Vbox.exe
  • sandboxierpcss

The trojan launches the following processes:

  • C:\­Windows\­Microsoft.NET\­Framework\­v2.0.50727\­RegAsm.exe
  • C:\­Windows\­Microsoft.NET\­Framework\­v2.0.50727\­AppLaunch.exe
  • C:\­Windows\­Microsoft.NET\­Framework\­v2.0.50727\­vbc.exe
  • %system%\­svchost.exe

The trojan creates and runs a new thread with its own code within these running processes.


The trojan usually contains the program code of the following malware:

  • MSIL/Spy.Agent.ADH
  • Win32/Spy.Weecnaw.A
  • Win32/PSW.Agent.NTM
  • Win32/PSW.VB.NIS
Other information

It can execute the following operations:

  • download files from a remote computer and/or the Internet
  • run executable files
  • create files
  • copy files
  • display a dialog window
  • move files

Trojan requires the Microsoft .NET Framework to run.

Please enable Javascript to ensure correct displaying of this content and refresh this page.