Content

BackDoor-AWQ.b!7F2862DB

Type
Trojan
SubType
-
Discovery Date
09/24/2008
Length
290304
Minimum DAT
5391 (09/24/2008)
Updated DAT
5391 (09/24/2008)
Minimum Engine
N/A
Description Added
09/24/2008
Description Modified
09/25/2008 1:32 AM (PT)
Risk Assessment
Corporate User
Low
Home User
Low

Tab Navigation

Characteristics

File Property Property Value
FileName Unavailable
McAfee Detection BackDoor-AWQ.b
Length 290,304 bytes
CRC 7F2862DB
MD5 1C7FE2B32B160E9B4C8DA7EB68B0AED1
SHA1 ABCE58E656BB715659E5DE307786ABE40C05A25B

Other Common Detection Aliases

Company Name Detection Name
ahnlab Win32/NSAnti.suspicious
avast Win32:Monga
AVG (GriSoft) Win32/NSAnti
Avira TR/Crypt.NSAnti.Gen
BitDefender Packer.Malware.NSAnti.A
Dr.Web BackDoor.Huai.3349
eSafe (Alladin) Suspicious file
Eset probably a variant of Win32/Hupigon
F-Prot W32/Hupigon.C.gen!Eldorado
Kaspersky Packed.Win32.NSAnti.r
microsoft VirTool:Win32/DelfInject.gen!AN
norman hupigon.gen82
panda Suspicious file
rising Suspicious.Backdoor.Win32.ShangXing.a
Sophos Mal/Emogen-N
Symantec Trojan.Packed.NsAnti
Trend Micro Mal_MLWR-5
vba32 MalwareScope.Trojan-PSW.Game.16
V-Buster Packed/NSPM

AvertŪ Labs has observed the following system activities:

Activity Risk Level
Modifies memory of other processes
 Critical
Enumerates running processes
 Medium
Performs a shell execute of downloaded or existing files
 Informational

System Changes

These are general defaults for typical path variables. (Although they may differ, these examples are common.):
%WinDir% = \WINDOWS (Windows 9x/ME/XP/Vista), \WINNT (Windows NT/2000)
%SystemDir% = \WINDOWS\SYSTEM (Windows 98/ME), \WINDOWS\SYSTEM32 (Windows XP/Vista), \WINNT\SYSTEM32 (Windows NT/2000)
%ProgramFiles% = \Program Files

The following files have been added to the system:

  • %PROGRAMFILES%\_srceao.exe
  • %PROGRAMFILES%\common files\microsoft shared\msinfo\srceao.exe

    • Symptoms

    This symptoms of this detection are the files, registry, and network communication referenced in the characteristics section.

    Method of Infection

    Trojans do not self-replicate. They are spread manually, often under the premise that the executable is something beneficial. Distribution channels include IRC, peer-to-peer networks, newsgroup postings, e-mail, etc.

    Removal

    AVERT recommends to always use latest DATs and engine. This threat will be cleaned if you have this combination.

    Additional Windows ME/XP removal considerations

    Variants

    Variants

      N/A

    All Information

    Overview -

    This is a Trojan detection. Unlike viruses, Trojans do not self-replicate. They are spread manually, often under the premise that they are beneficial or wanted. The most common installation methods involve system or security exploitation, and unsuspecting users manually executing unknown programs. Distribution channels include e-mail, malicious or hacked Web pages, Internet Relay Chat (IRC), peer-to-peer networks, etc.

    Characteristics

    Characteristics -

    File Property Property Value
    FileName Unavailable
    McAfee Detection BackDoor-AWQ.b
    Length 290,304 bytes
    CRC 7F2862DB
    MD5 1C7FE2B32B160E9B4C8DA7EB68B0AED1
    SHA1 ABCE58E656BB715659E5DE307786ABE40C05A25B

    Other Common Detection Aliases

    Company Name Detection Name
    ahnlab Win32/NSAnti.suspicious
    avast Win32:Monga
    AVG (GriSoft) Win32/NSAnti
    Avira TR/Crypt.NSAnti.Gen
    BitDefender Packer.Malware.NSAnti.A
    Dr.Web BackDoor.Huai.3349
    eSafe (Alladin) Suspicious file
    Eset probably a variant of Win32/Hupigon
    F-Prot W32/Hupigon.C.gen!Eldorado
    Kaspersky Packed.Win32.NSAnti.r
    microsoft VirTool:Win32/DelfInject.gen!AN
    norman hupigon.gen82
    panda Suspicious file
    rising Suspicious.Backdoor.Win32.ShangXing.a
    Sophos Mal/Emogen-N
    Symantec Trojan.Packed.NsAnti
    Trend Micro Mal_MLWR-5
    vba32 MalwareScope.Trojan-PSW.Game.16
    V-Buster Packed/NSPM

    AvertŪ Labs has observed the following system activities:

    Activity Risk Level
    Modifies memory of other processes
    		 Critical
    Enumerates running processes
    		 Medium
    Performs a shell execute of downloaded or existing files
    		 Informational

    System Changes

    These are general defaults for typical path variables. (Although they may differ, these examples are common.):
    %WinDir% = \WINDOWS (Windows 9x/ME/XP/Vista), \WINNT (Windows NT/2000)
    %SystemDir% = \WINDOWS\SYSTEM (Windows 98/ME), \WINDOWS\SYSTEM32 (Windows XP/Vista), \WINNT\SYSTEM32 (Windows NT/2000)
    %ProgramFiles% = \Program Files

    The following files have been added to the system:

  • %PROGRAMFILES%\_srceao.exe
  • %PROGRAMFILES%\common files\microsoft shared\msinfo\srceao.exe

    • Symptoms

    Symptoms -

    This symptoms of this detection are the files, registry, and network communication referenced in the characteristics section.

    Method of Infection

    Method of Infection -

    Trojans do not self-replicate. They are spread manually, often under the premise that the executable is something beneficial. Distribution channels include IRC, peer-to-peer networks, newsgroup postings, e-mail, etc.

    Removal -

    Removal -

    AVERT recommends to always use latest DATs and engine. This threat will be cleaned if you have this combination.

    Additional Windows ME/XP removal considerations

    Variants

    Variants -

      N/A