Central Command network, including computers both in the headquarters and in the combat zones.The threat involved into this incident is referred as Agent.btz. There is even a clash with another threat that is also detected as Agent.btz by another vendor – but that's a totally different threat with different functionality. Once a removable disk is connected to a computer infected with Agent.btz, the active malware will detect a newly recognized drive. Agent.btz file is not packed. Agent.btz locates this resource by looking for a marker 0xAA45F6F9 in its memory map.File wmcache.nldThe second spawned thread will wait for 10 seconds. The collected network details are also saved into the log file.File winview.ocxThe second spawned thread will log threat activity into the file %system32%\winview.ocx.This file is also encrypted with the same XOR mask. Note: an attempt to run a valid thumb.db file, which is an OLE-type container has no effect.Files thumb.dd and mssysmgr.ocxAgent.btz is capable to create a binary file thumb.dd on a newly connected drive. Posted by Sergei Shevchenko at Labels: Agent.btz Newer Post Older Post Home