virus logo Virus

W32/Agent.IIC!tr.bdr

description-logoAnalysis

  • It uses the following mutexes:
    • _win32__wans_um__
    • _win32__wans_sm__
    • __win32__wans_sdm__
  • It deletes itself from the current directory.

  • It connects to a remote server using:
    • HTTP
  • It tries to access the following URL:
    • dep2.mvl0{Removed}.com
  • It drops the following file:
    • undefinedSYSTEMundefined\wans.exe
  • It adds the following registry:
    • key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
    • value: undefinedSYSTEMundefined\wans.exe
    • data: undefinedSYSTEMundefined\wans.exe:*:Enabled:Windows Automated Network Service
    • key: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
    • value: Windows Automated Network Service
    • data: undefinedSYSTEMundefined\wans.exe
    • key: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • value: Windows Automated Network Service
    • data: undefinedSYSTEMundefined\wans.exe
    • key: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Terminal Server\Wds\rdpwd
    • value: StartupPrograms
    • data: undefinedSYSTEMundefined\wans.exe
    • key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
    • value: Userinit
    • data: undefinedSYSTEMundefined\wans.exe
    • key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
    • value: load
    • data: undefinedSYSTEMundefined\wans.exe
  • It registers itself as the following Windows service:
    • DisplayName :Windows Automated Network Service
    • ServiceName: WANS
    • BinaryPathName: undefinedSYSTEMundefined\wans.exe

    recommended-action-logoRecommended Action

      FortiGate Systems
    • Check the main screen using the web interface for your FortiGate unit to ensure that the latest AV/NIDS database has been downloaded and installed on your system - if required, enable the "Allow Push Update" option.
      FortiClient Systems
    • Quarantine/delete files that are detected and replace infected files with clean backup copies.

    Telemetry logoTelemetry

    Detection Availability

    FortiClient
    Extreme
    FortiMail
    Extreme
    FortiSandbox
    Extreme
    FortiWeb
    Extreme
    Web Application Firewall
    Extreme
    FortiIsolator
    Extreme
    FortiDeceptor
    Extreme
    FortiEDR
    ID 477002
    Released May 17, 2008
    Description
    Updated    		 May 21, 2008
    Aliases Backdoor.Win32.Agent.iic(Kaspersky), probably unknown NewHeur_PE virus (NOD32), Bck/Agent.IUQ (Panda), Win32/NSAnti (AVG)
    Platform Profile Win32 file format / PE 32 bit
    Profile Type Trojan Backdoor (tr.bdr)