Central Command network, including computers both in the headquarters and in the combat zones.The threat involved into this incident is referred as Agent.btz. There is even a clash with another threat that is also detected as Agent.btz by another vendor – but that's a totally different threat with different functionality. Once a removable disk is connected to a computer infected with Agent.btz, the active malware will detect a newly recognized drive. Agent.btz file is not packed. Thus, it’s not known what kind of code could have been injected into the browser process. Agent.btz locates this resource by looking for a marker 0xAA45F6F9 in its memory map.File wmcache.nldThe second spawned thread will wait for 10 seconds. The collected network details are also saved into the log file.File winview.ocxThe second spawned thread will log threat activity into the file %system32%\winview.ocx.This file is also encrypted with the same XOR mask. Posted by Sergei Shevchenko at Labels: Agent.btz Newer Post Older Post Home