My Bitdefender
  • 0 Shopping Cart

SHARE
THIS ON

Facebook Twitter Google Plus

Trojan.Agent.Delf.RHO

MEDIUM
LOW
~650k, ~2.7MB
(Generic.ImROBOT, Trojan-Im.Win32.Agent.ah, W32/Agent.AK!tr)

Symptoms

The presence of the following files:
  %WINDIR%\system32\yahooui.exe
  %WINDIR%\seocfg.exe
  %WINDIR%\upd1234.exe
  %WINDIR%\vbn.sdf

The malware also installs the following clean files:
  %WINDIR%\system32\yahooauth2.dll
  %WINDIR%\system32\ssleay32.dll
  %WINDIR%\system32\libeay32.dll

The virus will also modify the following registry key:
  HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
by appending the following strings to it:
  %WINDIR%\system32\yahooui.exe
  %WINDIR%\seocfg.exe


The presence of the following subkeys:
  HKLM\SOFTWARE\Yahoo\smartkey
and
  HKLM\SOFTWARE\Yahoo\lidl
Which contains the values:
  Count
  USER
  PASS

Removal instructions:

Please let BitDefender disinfect your files.

Analyzed By

Livadariu Mihai Andrei, virus researcher

Technical Description:

The malware spreads through links sent in instant messages on Yahoo!Messenger by other infected users. It tries to convince the target user that the message is legitimate by adding friendly phrases to trick the user into clicking the provided link. The used messages are:

  sa intrii sa imi zici ce parere ai ca sigur recuonsti personaju ;)
  o cunosti?
 

  :)))
  chiar vroiam sa te apelez, ai virusi si imi trimiti tot felu de mailuri
  ia programu asta sa il scoti ca l-am avut si eu sau daca nu intra pe http://www.[link removed].ro
  Afla cine te are pus la invizibil sau la ignore cu un singur click chiar si persoanele care sunt offline http://[link     removed].blogspot.com
  ce faci?
  Super tare!!!!!!!! http://[link removed].blogspot.com

Depending on the version of the malware, if the target user replies, the virus will check for the presence of the following keywords in the reply and sends an automatic answer according to what is found:





KeywordReply
virusintra ca nu e nici un virus
estiuita-te si vrb dupa
mergetrebuie sa instalezi programu ca sa mearga
fricanu are de ce sa-ti fie frica


Once the user clicks the link he is usually directed to a web site or blog containing an embedded movie which requests the user to download a codec that is actually the malware. When the user executes the downloaded file, a progress bar briefly appears and the following files are installed without user intervention:

  %WINDIR%\system32\yahooui.exe
  %WINDIR%\system32\yahooauth2.dll
  %WINDIR%\system32\ssleay32.dll
  %WINDIR%\system32\libeay32.dll

It also places itself in the startup list by appending the following string to the registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell

  %WINDIR%\system32\yahooui.exe

After the next system startup, the yahooui.exe process creates the following registry key:

  HKLM\SOFTWARE\Yahoo\lidl

It waits for the user to sign in to Yahoo!Messenger and saves the username and password inside the values USER and PASS in the HKLM\SOFTWARE\Yahoo\lidl key. The virus will then try to spread by sending spam messages to the contacts in the user's contact list.

The malware also downloads the following files:

  %WINDIR%\seocfg.exe
  %WINDIR%\upd1234.exe
  %WINDIR%\vbn.sdf


seocfg.exe and upd1234.exe are malware files, detected as Trojan.Spy.Banker.ACFQ, which tries to trick the user into accessing phishing sites related to banking. The vbn.sdf file contains the links which are sent in the spam messages.