Troj/Agent-BN is a downloader Trojan for the Windows platform.
Troj/Agent-BN connects to a preconfigured internet site and downloads code. The downloaded code is specific to the country of the infected computer.
In addition Troj/Agent-BN alters the Internet Security zone for a preconfigured website by setting the following registry entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\
Domains\63.219.181.7\http
2
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\
Domains\search-soft.net\http
2
Troj/Agent-BN will not affect computers from certain countries, determined by the value of the following registry entry:
HKCU\Control Panel\International\
Geo
<Code>
If <Code> is one of these values the Trojan will not run:
203
241
70
59
75
7
5
29
88
130
137
140
141
152
247