Troj/Agent-AAOT

Category: Viruses and Spyware Protection available since:10 Mar 2013 20:28:28 (GMT)
Type: Trojan Last Updated:10 Mar 2013 20:28:28 (GMT)
Prevalence: Small Number of Reports

Download Download our free Virus Removal Tool - Find and remove threats your antivirus missed

Troj/Agent-AAOT exhibits the following characteristics:

File Information

Size
309K
SHA-1
99fe674873063b40f98729b0fcd718fa56842ded
MD5
3555bb4cb459b69c7b1ddc9654c76a31
CRC-32
1c789675
File type
Windows executable
First seen
2007-07-30

Other vendor detection

Kaspersky
HEUR:Trojan.Win32.Generic

Runtime Analysis

Dropped Files
  • c:\Documents and Settings\test user\Local Settings\Temp\~unins1603.bat
Registry Keys Created
  • HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
    6
    i□□□□□p□□
  • HKLM\SOFTWARE\zpppmcegc
    GY
    2a 35 ea 32 27 50 44 d2 c7 2e 5d 22 46 14 0e 98 64 d6 4a e4 1a f6 3e f4 41 51 ba e5 51 65 c5 2c a9 9e 9f 63 88 96 0d cf a7 93 bb c5 55 95 9c f1 1f a9 b9 3a 22 ca 82 f9 d3 ac 77 3e c4 7e b0 d2 be 3e 52 a4 f3 32 9a 3c 0f e9 b4 77 8b e7 c5 ad 1a 3b ab a2 53 65 7b 2e fe a2 7a 0c 23 ca a9 ef 28 da c6 da 35 7d 4b 3f 9f 7b 19 4d c8 86 a6 1c a4 1d ed 84 1c 49 a2 a9 bc 19 d6 13 53 6d f8 71 f2 b9 54 cf 62 45 f9 8f 03 9c a7 aa ea 05 7b c4 e0 a1 3b 6e 51 85 5e 89 25 5c d5 d5 a8 ff c4 6a bd d2 a1 00 fd c2 e9 5e 99 90 a2 b8 9b 72 7a 18 a4 ce 47 31 cd 5e ea b3 d2 9d 5a 57 61 64 a2 2a d8 f0 6b f9 29 71 07 6f 75 c2 b4 aa 07 9b 53 14 f1 d1 5d 28 e2 60 3c 66 19 a3 c1 a2 cb 37 aa e7 f4 80 d3 a0 f7 47 06 6e eb 07 26 77 be b1 bb db cd f6 7a 93 9b b5 87 ae 25 6d 5a 08 4f 94 18 e7 [... 158784 intervening characters ...] 6f 90 7c 34 7a 33 f0 85 87 75 67 e3 ce 99 44 87 96 24 56 5f d9 5a bc 95 b8 5c 99 c6 cb 2e 54 bd 08 a3 7f 62 0c 00 37 36 e1 0d 8a 87 41 c6 ed 0d 04 c9 e4 f8 15 9f 77 e3 e0 8d 27 0e 5a 51 0e cf
  • HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
    Jdqxdc
    C:\WINDOWS\system32\blackboxj.exe
  • HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings
    6
    i□□□□□p□□
  • HKCU\Software\zpppmcegc
    GY
    2a 35 ea 32 27 50 44 d2 c7 2e 5d 22 46 14 0e 98 64 d6 4a e4 1a f6 3e f4 41 51 ba e5 51 65 c5 2c a9 9e 9f 63 88 96 0d cf a7 93 bb c5 55 95 9c f1 1f a9 b9 3a 22 ca 82 f9 d3 ac 77 3e c4 7e b0 d2 be 3e 52 a4 f3 32 9a 3c 0f e9 b4 77 8b e7 c5 ad 1a 3b ab a2 53 65 7b 2e fe a2 7a 0c 23 ca a9 ef 28 da c6 da 35 7d 4b 3f 9f 7b 19 4d c8 86 a6 1c a4 1d ed 84 1c 49 a2 a9 bc 19 d6 13 53 6d f8 71 f2 b9 54 cf 62 45 f9 8f 03 9c a7 aa ea 05 7b c4 e0 a1 3b 6e 51 85 5e 89 25 5c d5 d5 a8 ff c4 6a bd d2 a1 00 fd c2 e9 5e 99 90 a2 b8 9b 72 7a 18 a4 ce 47 31 cd 5e ea b3 d2 9d 5a 57 61 64 a2 2a d8 f0 6b f9 29 71 07 6f 75 c2 b4 aa 07 9b 53 14 f1 d1 5d 28 e2 60 3c 66 19 a3 c1 a2 cb 37 aa e7 f4 80 d3 a0 f7 47 06 6e eb 07 26 77 be b1 bb db cd f6 7a 93 9b b5 87 ae 25 6d 5a 08 4f 94 18 e7 [... 158784 intervening characters ...] 6f 90 7c 34 7a 33 f0 85 87 75 67 e3 ce 99 44 87 96 24 56 5f d9 5a bc 95 b8 5c 99 c6 cb 2e 54 bd 08 a3 7f 62 0c 00 37 36 e1 0d 8a 87 41 c6 ed 0d 04 c9 e4 f8 15 9f 77 e3 e0 8d 27 0e 5a 51 0e cf
Processes Created
  • c:\windows\system32\blackboxj.exe
  • c:\windows\system32\cmd.exe
HTTP Requests
  • http://180.123.136.203/adj/Category.aspx
IP Connections
  • 180.123.136.203:80
DNS Requests
  • intohave.com

download Try Sophos products for free
Download now