Win32/Spy.Agent.OXJ [Threat Name] go to Threat

Win32/Spy.Agent.OXJ [Threat Variant Name]

Category trojan
Size 72192 B
Aliases Trojan.Win32.Danti.o (Kaspersky)
  Trojan:Win32/Azden.A!cl (Microsoft)
  Infostealer.Hoardy (Symantec)
Short description

The trojan serves as a backdoor. It can be controlled remotely.


The trojan is usually a part of other malware.

The trojan does not create any copies of itself.

In order to be executed on every system start, the trojan sets the following Registry entry:

  • [HKEY_CURRENT_USER\­SOFTWARE\­Microsoft\­Windows\­CurrentVersion\­Run]
    • "{2625E0BA-BF1E-3C23-D1B1-B640040AE720}" = "C:\­Windows\­System32\­rundll32.exe %malwarefilepath%,,IEHelper"

The trojan may set the following Registry entries:

  • [HKEY_CURRENT_USER\­Software\­Microsoft\­Internet Explorer\­Main]
    • "DisableFirstRunCustomize" = 1
    • "Check_Associations" = "no"
  • [HKEY_CURRENT_USER\­Software\­Microsoft\­Internet Connection Wizard]
    • "Completed" =  1
  • [HKEY_CURRENT_USER\­Software\­Microsoft\­Windows\­CurrentVersion\­Internet Settings\­ZoneMap]
    • "IEHarden" = 0
  • [HKEY_LOCAL_MACHINE\­Software\­Microsoft\­Active Setup\­Installed Components\­{2625E0BA-BF1E-3C23-D1B1-B640040AE720}]
    • "StubPath" = "C:\­Windows\­System32\­rundll32.exe %malwarefilepath%,,IEHelper"
  • [HKEY_CURRENT_USER\­Software\­Microsoft\­Windows\­CurrentVersion\­Internet Settings]
    • "ProxyEnable" = 1
    • "ProxyServer" = "%variable%"

A string with variable content is used instead of %variable% .

Information stealing

Win32/Spy.Agent.OXJ is a trojan that steals sensitive information.

The trojan collects the following information:

  • information about the operating system and system settings
  • computer name
  • user name
  • hardware information
  • computer IP address
  • MAC address
  • list of files/folders on a specific drive

The trojan attempts to send gathered information to a remote machine.

Other information

The trojan acquires data and commands from a remote computer or the Internet.

The trojan contains a URL address. The HTTP protocol is used in the communication.

It may perform the following actions:

  • download files from a remote computer and/or the Internet
  • run executable files
  • upload files to a remote computer
  • execute shell commands
  • various file system operations
  • send gathered information

The trojan may execute the following commands:

  • C:\­Windows\­System32\­rundll32.exe %malwarefilepath%,,IEHelper

Please enable Javascript to ensure correct displaying of this content and refresh this page.