MSIL/Spy.Agent.AES [Threat Name] go to Threat
MSIL/Spy.Agent.AES [Threat Variant Name]
| Category | trojan |
| Size | 273920 B |
| Aliases | TrojanSpy:MSIL/Tinclex!rfn (Microsoft) |
| Trojan.DownLoader20.14451 (Dr.Web) |
Short description
The trojan serves as a backdoor. It can be controlled remotely.
Installation
When executed, the trojan copies itself into the following location:
- %appdata%\SubDir\Client.exe
In order to be executed on every system start, the trojan sets the following Registry entry:
- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
- "HostPTP" = "%malwarefilepath%"
- [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
- "HostPTP" = "%malwarefilepath%"
- [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
- "HostPTP" = "%malwarefilepath%"
- [HKEY_CURRENT_USER\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
- "HostPTP" = "%malwarefilepath%"
Information stealing
The trojan collects the following information:
- login user names for certain applications/services
- user name
- computer name
- computer IP address
- external IP address of the network device
- amount of operating memory
- CPU information
- installed antivirus software
- installed firewall application
- country
- MAC address
- the path to specific folders
- login passwords for certain applications/services
The trojan is able to log keystrokes.
The following programs are affected:
- FileZilla
- WinSCP
- Google Chrome
- Mozilla Firefox
- Internet Explorer
- Opera
- Yandex Browser
Other information
The trojan acquires data and commands from a remote computer or the Internet.
The trojan contains a URL address. The TCP protocol is used in the communication.
It can execute the following operations:
- download files from a remote computer and/or the Internet
- run executable files
- send gathered information
- update itself to a newer version
- uninstall itself
- execute shell commands
- terminate running processes
- send the list of running processes to a remote computer
- send the list of disk devices and their type to a remote computer
- send gathered information
- delete files
- delete folders
- move files
- delete Registry entries
- create Registry entries
- simulate user's input (clicks, taps)
- capture screenshots
- send requested files
- set up a proxy server
- shut down/restart the computer
- visit a specific website
Trojan requires the Microsoft .NET Framework to run.