• Home
• >Threat Encyclopaedia
• >Descriptions
• > Win32/AutoRun.Agent.TG

Short description

Win32/AutoRun.Agent.TG is a worm that spreads via removable media, shared folders and IM. The worm serves as a backdoor. It can be controlled remotely.

Installation

When executed, the worm creates the following files:

The worm copies itself to the following locations:

The files are then executed.

The worm creates the following files:

The worm may create the following files:

The worm creates the following folders:

In order to be executed on every system start, the worm sets the following Registry entries:

A string with variable content is used instead of %variable1-21% .

The following Registry entries are created:

The worm quits immediately if it is run within a debugger.

The worm terminates its execution if it detects that it's running in a specific virtual environment.

Spreading

The worm searches for files with the following file extensions:

The worm inserts a copy of itself into RAR archives.

The worm copies itself into the root folders of local and remote drives.

The following filename is used:

A string with variable content is used instead of %variable% .

The following file is created in the same folders:

The AUTORUN.INF file contains the path to the malware executable.

The worm searches for network drives.

The worm tries to copy itself to the available shared network folders.

Win32/AutoRun.Agent.TG is a worm that spreads through social networking sites.

The following social networking sites are affected:

Spreading on removable media

The worm copies itself into the root folders of removable drives using the following names:

A string with variable content is used instead of %variable% .

The following file is dropped in the same folder:

The AUTORUN.INF file contains the path to the malware executable.

Thus, the worm ensures it is started each time infected media is inserted into the computer.

The worm copies itself into the existing subfolders also.

Spreading via IM networks

Win32/AutoRun.Agent.TG is a worm that spreads via IM networks.

The worm sends links to

users. The messages may contain any of the following texts:

If the link is clicked a copy of the worm is retrieved from the attacking machine using HTTP protocol.

Information stealing

The worm is able to log keystrokes.

The worm can send the information to a remote machine.

The worm searches local drives for files with the following file extensions:

Only following folders are searched:

The worm attempts to send the found files to a remote machine.

Other information

The worm terminates processes with any of the following strings in the name:

The worm terminates any program that creates a window containing any of the following strings in its name:

The following services are disabled:

The worm may create copies of the following files (source, destination):

A string with variable content is used instead of %variable1-2% .

The worm may create the following files:

The worm checks for Internet connectivity by trying to connect to the following servers:

The worm connects to the following addresses:

The worm acquires data and commands from a remote computer or the Internet.

The worm generates various URL addresses. The TCP, HTTP protocol is used.

It can execute the following operations:

The worm can modify the following file:

The worm opens a random TCP port.

A HTTP proxy is listening there.

• Contact |
• Privacy |
• Legal Information |
• Sitemap