Win64/Gadoopt [Threat Name] go to Threat

Win64/Gadoopt.AA [Threat Variant Name]

Category trojan
Size 347136 B
Detection created Jul 22, 2014
Detection database version 10135
Aliases Trojan.Win64.Agent.fp (Kaspersky)
  BackDoor.Gates.19 (Dr.Web)
  Trojan:Win32/WebToos.A (Microsoft)
Short description

Win64/Gadoopt.AA serves as a backdoor. It can be controlled remotely.

Installation

The trojan does not create any copies of itself.


The trojan is usually a part of other malware.

Information stealing

Win64/Gadoopt.AA is a trojan that steals sensitive information.


The trojan collects the following information:

  • operating system version
  • CPU information
  • network adapter information
  • amount of operating memory

The trojan attempts to send gathered information to a remote machine.

Other information

The trojan acquires data and commands from a remote computer or the Internet.


The trojan contains a list of (1) IP addresses. The TCP protocol is used in the communication.


It can execute the following operations:

  • perform DoS/DDoS attacks
  • execute shell commands
  • update itself to a newer version

The trojan may execute the following commands:

  • C:\­Program Files\­Windows Media Player\­agony.exe -tcp %variable%
  • C:\­Program Files\­Windows Media Player\­agony.exe -s DNSSupport
  • C:\­Program Files\­Windows Media Player\­agony.exe -p DNSSupport.exe
  • C:\­Program Files\­Windows Media Player\­agony.exe -p DNSProtection.exe
  • C:\­Program Files\­Windows Media Player\­agony.exe -f DNSSupport.exe
  • C:\­Program Files\­Windows Media Player\­agony.exe -f DNSProtection.exe
  • C:\­Program Files\­Windows Media Player\­agony.exe -f agony.sys
  • C:\­Program Files\­Windows Media Player\­agony.exe -f agony.exe
  • C:\­Program Files\­Windows Media Player\­agony.exe -f conf.n
  • C:\­Program Files\­Windows Media Player\­agony.exe -f cmd.n
  • C:\­Program Files\­Windows Media Player\­agony.exe -f svch0st.exe

A variable numerical value is used instead of %variable% .


The trojan keeps various information in the following files:

  • C:\­Program Files\­Windows Media Player\­conf.n
  • C:\­Program Files\­Windows Media Player\­cmd.n
  • C:\­Windows\­system32\­libamplify.dll

Please enable Javascript to ensure correct displaying of this content and refresh this page.