AVIRA Virus Description BDS/Agent.ktp Full description

Virus:	BDS/Agent.ktp
Date discovered:	24/06/2008
Type:	Backdoor Server
In the wild:	Yes
Reported Infections:	Low
Distribution Potential:	Low
Damage Potential:	Medium
Static file:	Yes
File size:	2.169.600 Bytes
MD5 checksum:	b2b111bdea64a2a54e20371dc8cee753
IVDF version:	7.00.05.03

General Method of propagation:
   • No own spreading routine

Aliases:
   • Symantec: Backdoor.Graybird
   • Kaspersky: Backdoor.Win32.Agent.ktp
   • F-Secure: Backdoor.Win32.Agent.ktp
   • Panda: Trj/Multijoiner.A

Platforms / OS:
   • Windows 95
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003

Side effects:
   • Drops a file
   • Drops a malicious file

Files The following files are created:

– %TEMPDIR%\install_flash_player_active.exe Furthermore it gets executed after it was fully created. Further investigation pointed out that this file is malware, too. Detected as: TR/Dldr.Losabel.WE

– %TEMPDIR%\install_flash_player_active_x.exe Furthermore it gets executed after it was fully created.

File details Runtime packer:
In order to aggravate detection and reduce size of the file it is packed with a runtime packer.

See a brief description here.

Inserted by Thomas Wegele
on 12 Nov 2008 11:46 (GMT +1)

Updated by Thomas Wegele
on 12 Nov 2008 12:10 (GMT +1)

Should you like to make your voice heard, please fill in our Virus Description Survey here. You may tell us what you think about this description.

BDS/Agent.ktp - Backdoor Server