Win64/Gadoopt [Threat Name] go to Threat
Win64/Gadoopt.AA [Threat Variant Name]
| Category | trojan |
| Size | 347136 B |
| Detection created | Jul 22, 2014 |
| Detection database version | 10135 |
| Aliases | Trojan.Win64.Agent.fp (Kaspersky) |
| BackDoor.Gates.19 (Dr.Web) | |
| Trojan:Win32/WebToos.A (Microsoft) |
Short description
Win64/Gadoopt.AA serves as a backdoor. It can be controlled remotely.
Installation
The trojan does not create any copies of itself.
The trojan is usually a part of other malware.
Information stealing
Win64/Gadoopt.AA is a trojan that steals sensitive information.
The trojan collects the following information:
- operating system version
- CPU information
- network adapter information
- amount of operating memory
The trojan attempts to send gathered information to a remote machine.
Other information
The trojan acquires data and commands from a remote computer or the Internet.
The trojan contains a list of (1) IP addresses. The TCP protocol is used in the communication.
It can execute the following operations:
- perform DoS/DDoS attacks
- execute shell commands
- update itself to a newer version
The trojan may execute the following commands:
- C:\Program Files\Windows Media Player\agony.exe -tcp %variable%
- C:\Program Files\Windows Media Player\agony.exe -s DNSSupport
- C:\Program Files\Windows Media Player\agony.exe -p DNSSupport.exe
- C:\Program Files\Windows Media Player\agony.exe -p DNSProtection.exe
- C:\Program Files\Windows Media Player\agony.exe -f DNSSupport.exe
- C:\Program Files\Windows Media Player\agony.exe -f DNSProtection.exe
- C:\Program Files\Windows Media Player\agony.exe -f agony.sys
- C:\Program Files\Windows Media Player\agony.exe -f agony.exe
- C:\Program Files\Windows Media Player\agony.exe -f conf.n
- C:\Program Files\Windows Media Player\agony.exe -f cmd.n
- C:\Program Files\Windows Media Player\agony.exe -f svch0st.exe
A variable numerical value is used instead of %variable% .
The trojan keeps various information in the following files:
- C:\Program Files\Windows Media Player\conf.n
- C:\Program Files\Windows Media Player\cmd.n
- C:\Windows\system32\libamplify.dll