Trojan.DownLoader21.64209

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Error Workstation Modules Layer Logs' = '<SYSTEM32>\mktozoxyszix.exe'

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\Level Netlogon Session Net.Tcp] 'ImagePath' = '<SYSTEM32>\mktozoxyszix.exe'
[<HKLM>\SYSTEM\ControlSet001\Services\Level Netlogon Session Net.Tcp] 'Start' = '00000002'

Malicious functions:

To complicate detection of its presence in the operating system,

blocks the following features:

Windows Security Center

Executes the following:

'<SYSTEM32>\roejrgblfmxl.exe' "<SYSTEM32>\mktozoxyszix.exe"
'%WINDIR%\Temp\nzkksx2ublyja.exe' -r 31971 tcp
'%TEMP%\nzkksx2okzyjaieikqe.exe'
'<SYSTEM32>\mktozoxyszix.exe'

Modifies file system:

Creates the following files:

<SYSTEM32>\jrlkodz\run
<SYSTEM32>\jrlkodz\rng
%WINDIR%\Temp\nzkksx2ublyja.exe
<SYSTEM32>\jrlkodz\cfg
<SYSTEM32>\roejrgblfmxl.exe
%TEMP%\nzkksx2okzyjaieikqe.exe
<SYSTEM32>\jrlkodz\tst
<SYSTEM32>\mktozoxyszix.exe
<SYSTEM32>\jrlkodz\etc

Sets the 'hidden' attribute to the following files:

<SYSTEM32>\roejrgblfmxl.exe
<SYSTEM32>\mktozoxyszix.exe

Deletes the following files:

%WINDIR%\Temp\nzkksx2ublyja.exe
<DRIVERS>\etc\hosts
%TEMP%\nzkksx2okzyjaieikqe.exe

Substitutes the HOSTS file.

Network activity:

Connects to:

'dr###feet.net':80
'wi###eet.net':80
'th####esterday.net':80
'th###wedge.net':80
'dr####esterday.net':80
'wi####sterday.net':80
'dr###each.net':80
'wi###ach.net':80
'th###each.net':80
'lo###ach.net':80
'fe####sterday.net':80
'lo###eet.net':80
'fe###ach.net':80
'lo###edge.net':80
'th###feet.net':80
'lo####sterday.net':80
'fe###edge.net':80
'dr###wedge.net':80
'pi###pril.net':80
'so###pril.net':80
'pi###ray.net':80
'so###ray.net':80
'pi###dge.net':80
'so###dge.net':80
'pi###rmy.net':80
'so###rmy.net':80
'ab###dge.net':80
'ab###ray.net':80
'kn###pril.net':80
'wi###edge.net':80
'kn###ray.net':80
'ab###rmy.net':80
'kn###dge.net':80
'ab###pril.net':80
'kn###rmy.net':80
'fe###eet.net':80
'al###being.net':80
'ri###nstorm.net':80
'pr####tbottom.net':80
'ca####nbring.net':80
'ro####sterday.net':80
'si####sterday.net':80
'ro###ach.net':80
'si###ach.net':80
'mo###olor.net':80
'jo####ymeasure.net':80
'cr#####onaraminta.net':80
'ef###tbuilt.net':80
'th###while.net':80
'mi###hown.net':80
'ab###ell.net':80
'le###form.net':80
'mo###ugust.net':80
'ro###edge.net':80
'hi###ach.net':80
'wh###ach.net':80
'hi###eet.net':80
'wh###eet.net':80
'hi###edge.net':80
'wh###edge.net':80
'hi####sterday.net':80
'wh####sterday.net':80
'ju###edge.net':80
'ju###eet.net':80
'mo###ach.net':80
'si###edge.net':80
'mo###eet.net':80
'ju####sterday.net':80
'mo###edge.net':80
'ju###ach.net':80
'mo####sterday.net':80

TCP:

HTTP GET requests:

http://dr###feet.net/index.php
http://wi###eet.net/index.php
http://th####esterday.net/index.php
http://th###wedge.net/index.php
http://dr####esterday.net/index.php
http://wi####sterday.net/index.php
http://dr###each.net/index.php
http://wi###ach.net/index.php
http://th###each.net/index.php
http://lo###ach.net/index.php
http://fe####sterday.net/index.php
http://lo###eet.net/index.php
http://fe###ach.net/index.php
http://lo###edge.net/index.php
http://th###feet.net/index.php
http://lo####sterday.net/index.php
http://fe###edge.net/index.php
http://dr###wedge.net/index.php
http://pi###pril.net/index.php
http://so###pril.net/index.php
http://pi###ray.net/index.php
http://so###ray.net/index.php
http://pi###dge.net/index.php
http://so###dge.net/index.php
http://pi###rmy.net/index.php
http://so###rmy.net/index.php
http://ab###dge.net/index.php
http://ab###ray.net/index.php
http://kn###pril.net/index.php
http://wi###edge.net/index.php
http://kn###ray.net/index.php
http://ab###rmy.net/index.php
http://kn###dge.net/index.php
http://ab###pril.net/index.php
http://kn###rmy.net/index.php
http://fe###eet.net/index.php
http://al###being.net/index.php
http://ri###nstorm.net/index.php
http://pr####tbottom.net/index.php
http://ca####nbring.net/index.php
http://ro####sterday.net/index.php
http://si####sterday.net/index.php
http://ro###ach.net/index.php
http://si###ach.net/index.php
http://mo###olor.net/index.php
http://jo####ymeasure.net/index.php
http://cr#####onaraminta.net/index.php
http://ef###tbuilt.net/index.php
http://th###while.net/index.php
http://mi###hown.net/index.php
http://ab###ell.net/index.php
http://le###form.net/index.php
http://mo###ugust.net/index.php
http://ro###edge.net/index.php
http://hi###ach.net/index.php
http://wh###ach.net/index.php
http://hi###eet.net/index.php
http://wh###eet.net/index.php
http://hi###edge.net/index.php
http://wh###edge.net/index.php
http://hi####sterday.net/index.php
http://wh####sterday.net/index.php
http://ju###edge.net/index.php
http://ju###eet.net/index.php
http://mo###ach.net/index.php
http://si###edge.net/index.php
http://mo###eet.net/index.php
http://ju####sterday.net/index.php
http://mo###edge.net/index.php
http://ju###ach.net/index.php
http://mo####sterday.net/index.php

UDP:

DNS ASK dr###feet.net
DNS ASK wi###eet.net
DNS ASK th####esterday.net
DNS ASK th###wedge.net
DNS ASK dr###each.net
DNS ASK wi####sterday.net
DNS ASK dr###wedge.net
DNS ASK wi###ach.net
DNS ASK dr####esterday.net
DNS ASK lo###ach.net
DNS ASK fe####sterday.net
DNS ASK lo###eet.net
DNS ASK fe###ach.net
DNS ASK lo####sterday.net
DNS ASK th###feet.net
DNS ASK th###each.net
DNS ASK fe###edge.net
DNS ASK lo###edge.net
DNS ASK pi###pril.net
DNS ASK so###pril.net
DNS ASK pi###ray.net
DNS ASK so###ray.net
DNS ASK pi###rmy.net
DNS ASK so###dge.net
DNS ASK ro###ray.net
DNS ASK so###rmy.net
DNS ASK pi###dge.net
DNS ASK ab###ray.net
DNS ASK kn###pril.net
DNS ASK wi###edge.net
DNS ASK kn###ray.net
DNS ASK ab###pril.net
DNS ASK kn###dge.net
DNS ASK ab###dge.net
DNS ASK kn###rmy.net
DNS ASK ab###rmy.net
DNS ASK fe###eet.net
DNS ASK al###being.net
DNS ASK ri###nstorm.net
DNS ASK pr####tbottom.net
DNS ASK ca####nbring.net
DNS ASK ro####sterday.net
DNS ASK si####sterday.net
DNS ASK ro###ach.net
DNS ASK si###ach.net
DNS ASK mo###olor.net
DNS ASK jo####ymeasure.net
DNS ASK cr#####onaraminta.net
DNS ASK ef###tbuilt.net
DNS ASK th###while.net
DNS ASK mi###hown.net
DNS ASK ab###ell.net
DNS ASK le###form.net
DNS ASK mo###ugust.net
DNS ASK ro###edge.net
DNS ASK hi###ach.net
DNS ASK wh###ach.net
DNS ASK hi###eet.net
DNS ASK wh###eet.net
DNS ASK hi###edge.net
DNS ASK wh###edge.net
DNS ASK hi####sterday.net
DNS ASK wh####sterday.net
DNS ASK ju###edge.net
DNS ASK ju###eet.net
DNS ASK mo###ach.net
DNS ASK si###edge.net
DNS ASK mo###eet.net
DNS ASK ju####sterday.net
DNS ASK mo###edge.net
DNS ASK ju###ach.net
DNS ASK mo####sterday.net
'23#.#55.255.250':1900

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial