Worm:W32/Agent.T

Classification

Category :

Malware

Type :

Worm

Platform :

W32

Aliases :

Trojan.Downloader-1419, Trojan.Downloader.Agent.ASH, W32/Generic.m

Summary

Worm:W32/Agent.T drops several copies of itself onto the system and downloads other additional malware from the Internet.

Removal

Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.

A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:

Check for the latest database updates

First check if your F-Secure security program is using the latest updates, then try scanning the file again.
Submit a sample

After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.

Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.
Exclude a file from further scanning

If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.

Note: You need administrative rights to change the settings.

Technical Details

Execution

Upon execution, Agent.T drops the following files:

%windir%\yqqty.exe - A copy of itself.

It modifies the following autostart registry entry to enable its automatic execution every system boot-up:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] Userinit=%windir%\system32\userinit.exe,%windir%\yqqty.exe

Note: The default value is Userinit=%windir%\system32\userinit.exe

It may drop a copy of itself to several drives. The Autorun.inf file, which is a configuration file used to automatically execute the malware when a directory or drive is being opened, is also dropped together with the main executable file.

Activity

Agent.T downloads the following files from the Internet:

https://www.sinavip.net/A[REMOVED].asp
https://www.sinavip.net/L[REMOVED].txt

It then saves the files to the Windows directory using the following filenames:

listsas.txt
saslogww.txt

One of the text files contains the following download sites:

https://www.aame.cn/k[REMOVED].rar
https://www.aame.cn/c[REMOVED].rar

The downloaded files are also trojan-downloaders that are now detected as Trojan-Downloader:W32/Small.EJW and Trojan-Downloader:W32/Small.ELM.

More Support

Community

Ask questions in our Community .

User Guides

Check the user guide for instructions.

Contact Support

Chat with or call an expert.

Submit a Sample

Submit a file or URL for analysis.