Trojan.PWS.Turist.158

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] 'UeLDwwBIrwI_QtizZrzjwUJXsW' = '<SYSTEM32>\FdDttQYRsYxGpS.exe'

Creates or modifies the following files:

%HOMEPATH%\Start Menu\Programs\Startup\System Check.lnk

Malicious functions:

Executes the following:

'<SYSTEM32>\wbem\wmiadap.exe' /R /T

Injects code into

the following system processes:

%WINDIR%\Explorer.EXE

Modifies file system :

Creates the following files:

<SYSTEM32>\FdDttQYRsYxGpS.exe

Deletes the following files:

<SYSTEM32>\PerfStringBackup.TMP
<SYSTEM32>\wbem\Performance\WmiApRpl.ini

Deletes itself.

Network activity:

Connects to:

'ou####lyhrefdb.com':80
'ev####opsfyajc.in':80
'hr####urmuvltr.tw':80
'uu####iarqojsy.net':80
'yo####glldhmdj.cc':80
'yr####qpbhstje.com':80
'fe####ndwinrmm.in':80
'lg####usudtdvu.tw':80
'mc####ipvkmykh.net':80
'ui####tnqfxmin.cc':80
'ty####vyvropqk.cc':80
'dq####eckjkwkj.com':80
'pm####wqohorbx.in':80
'dw####pwhmdpxl.tw':80
'dk####daufdfyo.in':80
'vd####orjjgeea.cc':80
'ym####wqggamrl.net':80
'rw####jvexihbb.com':80
'jp####fhhnejdt.cc':80
'sa####rxwppmxn.tw':80
'wn####gxoylqvt.com':80
'qy####iemqrlvx.in':80
'fc####obaakdet.net':80
'ku####etuwcboe.cc':80
'od####eboqqffr.tw':80
'on####ahcctktf.com':80
'ou####vkiehpqn.in':80
'ni####rrnwerid.net':80
'ih####rxcxbiju.com':80
'fm####nvfeuggg.cc':80
'pw####glygfneo.tw':80
'aa####splxepbb.in':80
'ii####shyqvucs.tw':80
'cu####adaonihw.net':80
'lr####dimhydmr.in':80
'ma####mschxgqj.cc':80
'to####npynbmhi.net':80
'cr####butvloox.com':80
'qh####ldtaqxte.in':80
'pu####qldjfnav.tw':80
'wv####gjadgsvu.net':80
'nf####omgsyauw.cc':80
'ub####cpkcxxry.com':80
'xg####madccvuy.in':80
'xk####phphcjnd.tw':80
'sm####kgwlvqyj.net':80
'xb####dlpypjhx.in':80
'ef####ovtjslcb.cc':80
'pb####auixkaev.net':80
'xs####enhempwp.com':80
'dd####smhattnn.tw':80
'sb####qdahvdfx.in':80
'ru####ahwllirl.cc':80
'po####cnxvlgai.net':80
'dg####rbckgxwe.com':80
'hf####ropkxuga.cc':80
'ck####bctjwdpm.tw':80
'uf####yiofwpel.com':80
'yl####fnyhvryt.in':80
'wl####slppybwp.net':80
'ag####pefjhccd.cc':80
'yt####ocnlwuns.tw':80
'ms####trfyqbuu.com':80
'mi####jrunefcx.in':80
'nf####alamthns.tw':80
'is####gdokurnj.net':80
'oj####wtmwwpua.cc':80
'kk####tqtvwdcr.tw':80
'ab####uwhakowy.com':80
'bp####btodpicv.tw':80
'bb####pwwdhqwb.net':80
'qn####pmgwshrs.in':80
'lu####nbelmgcd.cc':80

TCP:

HTTP POST requests:

ou####lyhrefdb.com/
ev####opsfyajc.in/
hr####urmuvltr.tw/
uu####iarqojsy.net/
yo####glldhmdj.cc/
yr####qpbhstje.com/
fe####ndwinrmm.in/
lg####usudtdvu.tw/
mc####ipvkmykh.net/
ui####tnqfxmin.cc/
ty####vyvropqk.cc/
dq####eckjkwkj.com/
pm####wqohorbx.in/
dw####pwhmdpxl.tw/
dk####daufdfyo.in/
vd####orjjgeea.cc/
ym####wqggamrl.net/
rw####jvexihbb.com/
jp####fhhnejdt.cc/
sa####rxwppmxn.tw/
wn####gxoylqvt.com/
qy####iemqrlvx.in/
fc####obaakdet.net/
ku####etuwcboe.cc/
od####eboqqffr.tw/
on####ahcctktf.com/
ou####vkiehpqn.in/
ni####rrnwerid.net/
ih####rxcxbiju.com/
fm####nvfeuggg.cc/
pw####glygfneo.tw/
aa####splxepbb.in/
ii####shyqvucs.tw/
cu####adaonihw.net/
lr####dimhydmr.in/
ma####mschxgqj.cc/
to####npynbmhi.net/
cr####butvloox.com/
qh####ldtaqxte.in/
pu####qldjfnav.tw/
wv####gjadgsvu.net/
nf####omgsyauw.cc/
ub####cpkcxxry.com/
xg####madccvuy.in/
xk####phphcjnd.tw/
sm####kgwlvqyj.net/
xb####dlpypjhx.in/
ef####ovtjslcb.cc/
pb####auixkaev.net/
xs####enhempwp.com/
dd####smhattnn.tw/
sb####qdahvdfx.in/
ru####ahwllirl.cc/
po####cnxvlgai.net/
dg####rbckgxwe.com/
hf####ropkxuga.cc/
ck####bctjwdpm.tw/
uf####yiofwpel.com/
yl####fnyhvryt.in/
wl####slppybwp.net/
ag####pefjhccd.cc/
yt####ocnlwuns.tw/
ms####trfyqbuu.com/
mi####jrunefcx.in/
nf####alamthns.tw/
is####gdokurnj.net/
oj####wtmwwpua.cc/
kk####tqtvwdcr.tw/
ab####uwhakowy.com/
bp####btodpicv.tw/
bb####pwwdhqwb.net/
qn####pmgwshrs.in/
lu####nbelmgcd.cc/

UDP:

DNS ASK uu####iarqojsy.net
DNS ASK ou####lyhrefdb.com
DNS ASK vd####orjjgeea.cc
DNS ASK hr####urmuvltr.tw
DNS ASK ev####opsfyajc.in
DNS ASK mc####ipvkmykh.net
DNS ASK yr####qpbhstje.com
DNS ASK yo####glldhmdj.cc
DNS ASK lg####usudtdvu.tw
DNS ASK pm####wqohorbx.in
DNS ASK ui####tnqfxmin.cc
DNS ASK to####npynbmhi.net
DNS ASK dq####eckjkwkj.com
DNS ASK ty####vyvropqk.cc
DNS ASK rw####jvexihbb.com
DNS ASK dk####daufdfyo.in
DNS ASK dw####pwhmdpxl.tw
DNS ASK ym####wqggamrl.net
DNS ASK fe####ndwinrmm.in
DNS ASK jp####fhhnejdt.cc
DNS ASK sa####rxwppmxn.tw
DNS ASK wn####gxoylqvt.com
DNS ASK qy####iemqrlvx.in
DNS ASK fc####obaakdet.net
DNS ASK ku####etuwcboe.cc
DNS ASK od####eboqqffr.tw
DNS ASK on####ahcctktf.com
DNS ASK ou####vkiehpqn.in
DNS ASK ni####rrnwerid.net
DNS ASK ih####rxcxbiju.com
DNS ASK fm####nvfeuggg.cc
DNS ASK pw####glygfneo.tw
DNS ASK aa####splxepbb.in
DNS ASK ii####shyqvucs.tw
DNS ASK cu####adaonihw.net
DNS ASK lr####dimhydmr.in
DNS ASK ma####mschxgqj.cc
DNS ASK wv####gjadgsvu.net
DNS ASK cr####butvloox.com
DNS ASK ru####ahwllirl.cc
DNS ASK pu####qldjfnav.tw
DNS ASK qh####ldtaqxte.in
DNS ASK sm####kgwlvqyj.net
DNS ASK ub####cpkcxxry.com
DNS ASK nf####omgsyauw.cc
DNS ASK xk####phphcjnd.tw
DNS ASK xs####enhempwp.com
DNS ASK xb####dlpypjhx.in
DNS ASK google.com
DNS ASK pb####auixkaev.net
DNS ASK ef####ovtjslcb.cc
DNS ASK dg####rbckgxwe.com
DNS ASK sb####qdahvdfx.in
DNS ASK dd####smhattnn.tw
DNS ASK po####cnxvlgai.net
DNS ASK xg####madccvuy.in
DNS ASK hf####ropkxuga.cc
DNS ASK ck####bctjwdpm.tw
DNS ASK uf####yiofwpel.com
DNS ASK yl####fnyhvryt.in
DNS ASK wl####slppybwp.net
DNS ASK ag####pefjhccd.cc
DNS ASK yt####ocnlwuns.tw
DNS ASK ms####trfyqbuu.com
DNS ASK mi####jrunefcx.in
DNS ASK nf####alamthns.tw
DNS ASK is####gdokurnj.net
DNS ASK oj####wtmwwpua.cc
DNS ASK kk####tqtvwdcr.tw
DNS ASK ab####uwhakowy.com
DNS ASK bp####btodpicv.tw
DNS ASK bb####pwwdhqwb.net
DNS ASK qn####pmgwshrs.in
DNS ASK lu####nbelmgcd.cc

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial