About:
Troj/Agent-LNC is a backdoor Trojan which allows a remote intruder to gain access and control over the computer. The Trojan accesses the internet to communicate with a remote server via HTTP.
Troj/Agent-LNC is typically distributed in a zip file attached to an email informing the recipient that "You are today's Macbook Air Winner!" (Read the SophosLabs blog entry on this threat.)
The zip file is detected as Troj/SpefZp-A. When the samples first appeared in Sophos's spam traps, Troj/Agent-LNC was proactively detected as Mal/FakeAV-AX. This is because Troj/Agent-LNC uses distinctive encryption techniques that SophosLabs identifies in fake anti-virus Trojans.
The lure of a new laptop has been used by cybercriminals before to spread fake anti-virus via spam. We saw it with Troj/Agent-LGE, featured in our October 8, 2009 Threat Spotlight.
When Troj/Agent-LNC is installed, it creates the following files:
- <User>\reader_s.exe
- <System>\reader_s.exe
It creates the following registry entries to run reader_s.exe on startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
reader_s
<User>\reader_s.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
reader_s
<System>\reader_s.exe