Win32/Agent.RZR [Threat Name] go to Threat

Win32/Agent.RZR [Threat Variant Name]

Category trojan
Size 52224 B
Aliases Trojan.Win32.Danti.o (Kaspersky)
  Infostealer.Hoardy (Symantec)
Short description

Win32/Agent.RZR is a trojan designed to deliver various malware to the user's systems. The trojan serves as a backdoor. It can be controlled remotely.

Installation

When executed, the trojan creates the following files:

  • %allusersprofile%\­IEHelper\­mshmtl.dll (72192 B, Win32/Spy.Agent.OXJ)

In order to be executed on every system start, the trojan sets the following Registry entry:

  • [HKEY_CURRENT_USER\­SOFTWARE\­Microsoft\­Windows\­CurrentVersion\­Run]
    • "{FC2DDD1E-F536-D240-F456-A6DD58C42C5A}" = "C:\­Windows\­System32\­rundll32.exe %allusersprofile%\­IEHelper\­mshtml.dll,,IEHelper"

The trojan may set the following Registry entries:

  • [HKEY_CURRENT_USER\­Software\­Microsoft\­Internet Explorer\­Main]
    • "DisableFirstRunCustomize" = 1
    • "Check_Associations" = "no"
  • [HKEY_CURRENT_USER\­Software\­Microsoft\­Internet Connection Wizard]
    • "Completed" =  1
  • [HKEY_CURRENT_USER\­Software\­Microsoft\­Windows\­CurrentVersion\­Internet Settings\­ZoneMap]
    • "IEHarden" = 0
  • [HKEY_LOCAL_MACHINE\­Software\­Microsoft\­Active Setup\­Installed Components\­{FC2DDD1E-F536-D240-F456-A6DD58C42C5A}]
Information stealing

Win32/Agent.RZR is a trojan that steals sensitive information.


The trojan collects the following information:

  • information about the operating system and system settings
  • computer name
  • user name
  • hardware information
  • computer IP address
  • MAC address
  • list of files/folders on a specific drive

The trojan attempts to send gathered information to a remote machine.


Other information

The trojan acquires data and commands from a remote computer or the Internet.


The trojan contains a URL address. The HTTP protocol is used in the communication.


It may perform the following actions:

  • download files from a remote computer and/or the Internet
  • run executable files
  • upload files to a remote computer
  • execute shell commands
  • various file system operations
  • send gathered information

Please enable Javascript to ensure correct displaying of this content and refresh this page.