Troj/Agent-EY is a downloader and information stealer Trojan for the Windows platform.
The Trojan will copy itself to the Windows system folder as "perfmnt.exe" .
The Trojan creates the following registry entries:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe
Debugger
<path of Trojan EXE>
Troj/Agent-EY uses Internet Explorer to open a predefined URL without the user's knowledge, and download a file as "update.php" to the Temporary Internet Files folder.
The Trojan collects certain information and submits it to a predefined URL.