Win32/Agent.OBA [Threat Name] go to Threat

Win32/Agent.OBA [Threat Variant Name]

Category	trojan,worm
Size	103936 B
Aliases	Trojan.Win32.Agent.xsi (Kaspersky)
	VirTool:WinNT/Rootkitdrv.KD (Microsoft)
	Downloader (Symantec)

Win32/Agent.OBA installs a backdoor that can be controlled remotely. It uses techniques common for rootkits.

When executed, the trojan creates the following files:

The trojan may create the following files:

A string with variable content is used instead of %variable1-11% .

The trojan executes the following commands:

sc.exe stop http
sc.exe start http
sc.exe create %variable1% type= kernel start= auto binpath= %system%\drivers\%variable1%.sys

The trojan can modify the following file:

The trojan collects the following information:

The trojan attempts to send gathered information to a remote machine.

The trojan contains a list of (4) URLs. The HTTP protocol is used.

The trojan may delete the following files:

The trojan creates and runs a new thread with its own program code within the following processes:

It can execute the following operations: