Troj/Bdoor-AMP is a password stealing Trojan for the Windows platform.
TrpkBdoor-AMP includes functionality to access the internet and communicate with a remote server via HTTP.
When first run Bdoor-AMP copies itself to:
<System>\hiquooc.exe
<System>\koovyjyna.exe
The following registry entry is created to run hiquooc.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
delol
<System>\hiquooc.exe
The file koovyjyna.exe is registered as a new system driver service named "c3ci6aip4mj", with a display name of "Websense CPM Report Scheduler" and a startup type of automatic, so that it is started automatically during system startup. Registry entries are created under:
HKLM\SYSTEM\CurrentControlSet\Services\c3ci6aip4mj