Trojan.DownLoader19.57221

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Player CardSpace Helper Panel Remote Resource' = '<SYSTEM32>\rbkisvhlizxu.exe'

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\Detection Shell Interactive Audio RPC] 'ImagePath' = '<SYSTEM32>\rbkisvhlizxu.exe'
[<HKLM>\SYSTEM\ControlSet001\Services\Detection Shell Interactive Audio RPC] 'Start' = '00000002'

Malicious functions:

To complicate detection of its presence in the operating system,

blocks the following features:

Windows Security Center

Creates and executes the following:

'<SYSTEM32>\wtvqxohdqc.exe' "<SYSTEM32>\rbkisvhlizxu.exe"
'%WINDIR%\Temp\fv7kzdzb32w6lre.exe' -r 41880 tcp
'%TEMP%\fv7kzdzb2sbjlrenjfyidda.exe'
'<SYSTEM32>\rbkisvhlizxu.exe'

Modifies file system:

Creates the following files:

<SYSTEM32>\cvplfrzclu\run
<SYSTEM32>\cvplfrzclu\rng
%WINDIR%\Temp\fv7kzdzb32w6lre.exe
<SYSTEM32>\cvplfrzclu\cfg
<SYSTEM32>\wtvqxohdqc.exe
%TEMP%\fv7kzdzb2sbjlrenjfyidda.exe
<SYSTEM32>\cvplfrzclu\tst
<SYSTEM32>\rbkisvhlizxu.exe
<SYSTEM32>\cvplfrzclu\etc

Sets the 'hidden' attribute to the following files:

<SYSTEM32>\wtvqxohdqc.exe
<SYSTEM32>\rbkisvhlizxu.exe

Deletes the following files:

%WINDIR%\Temp\fv7kzdzb32w6lre.exe
<DRIVERS>\etc\hosts
%TEMP%\fv7kzdzb2sbjlrenjfyidda.exe

Substitutes the HOSTS file.

Network activity:

Connects to:

'we###ther.net':80
'fe###all.net':80
'we###orty.net':80
'fe###ther.net':80
'le###ree.net':80
'ta###forty.net':80
'we###all.net':80
'ta###free.net':80
'li###ther.net':80
'th###wall.net':80
'li###orty.net':80
'th###other.net':80
'we###ree.net':80
'fe###orty.net':80
'li###all.net':80
'fe###ree.net':80
'le###orty.net':80
'po###wall.net':80
'ca###all.net':80
'po###other.net':80
'ca###ther.net':80
'no###ther.net':80
'no###all.net':80
'no###ree.net':80
'no###orty.net':80
'ta###wall.net':80
'le###all.net':80
'ta###other.net':80
'le###ther.net':80
'po###forty.net':80
'ca###orty.net':80
'po###free.net':80
'ca###ree.net':80
'we###tudy.net':80
'no###tudy.net':80
'we###ncle.net':80
'no###ncle.net':80
'ri###ncle.net':80
'fa###uncle.net':80
'we###oss.net':80
'we###nce.net':80
'be##lxc.com':80
'de###lxc.com':80
'ri###nstorm.net':80
'af###sllc.com':80
'no###nce.net':80
'li###nce.net':80
'no###oss.net':80
'li###oss.net':80
'ri###tudy.net':80
'fi###other.net':80
'so###wall.net':80
'fi###forty.net':80
'so###other.net':80
'li###ree.net':80
'th###forty.net':80
'fi###wall.net':80
'th###free.net':80
'fa###loss.net':80
'ri###nce.net':80
'fa###study.net':80
'ri###oss.net':80
'fi###free.net':80
'so###forty.net':80
'fa###once.net':80
'so###free.net':80

TCP:

HTTP GET requests:

http://we###ther.net/index.php
http://fe###all.net/index.php
http://we###orty.net/index.php
http://fe###ther.net/index.php
http://le###ree.net/index.php
http://ta###forty.net/index.php
http://we###all.net/index.php
http://ta###free.net/index.php
http://li###ther.net/index.php
http://th###wall.net/index.php
http://li###orty.net/index.php
http://th###other.net/index.php
http://we###ree.net/index.php
http://fe###orty.net/index.php
http://li###all.net/index.php
http://fe###ree.net/index.php
http://le###orty.net/index.php
http://po###wall.net/index.php
http://ca###all.net/index.php
http://po###other.net/index.php
http://ca###ther.net/index.php
http://no###ther.net/index.php
http://no###all.net/index.php
http://no###ree.net/index.php
http://no###orty.net/index.php
http://ta###wall.net/index.php
http://le###all.net/index.php
http://ta###other.net/index.php
http://le###ther.net/index.php
http://po###forty.net/index.php
http://ca###orty.net/index.php
http://po###free.net/index.php
http://ca###ree.net/index.php
http://we###tudy.net/index.php
http://no###tudy.net/index.php
http://we###ncle.net/index.php
http://no###ncle.net/index.php
http://ri###ncle.net/index.php
http://fa###uncle.net/index.php
http://we###oss.net/index.php
http://we###nce.net/index.php
http://be##lxc.com/index.php
http://de###lxc.com/index.php
http://ri###nstorm.net/index.php
http://af###sllc.com/index.php
http://no###nce.net/index.php
http://li###nce.net/index.php
http://no###oss.net/index.php
http://li###oss.net/index.php
http://ri###tudy.net/index.php
http://fi###other.net/index.php
http://so###wall.net/index.php
http://fi###forty.net/index.php
http://so###other.net/index.php
http://li###ree.net/index.php
http://th###forty.net/index.php
http://fi###wall.net/index.php
http://th###free.net/index.php
http://fa###loss.net/index.php
http://ri###nce.net/index.php
http://fa###study.net/index.php
http://ri###oss.net/index.php
http://fi###free.net/index.php
http://so###forty.net/index.php
http://fa###once.net/index.php
http://so###free.net/index.php

UDP:

DNS ASK we###ther.net
DNS ASK fe###all.net
DNS ASK we###orty.net
DNS ASK fe###ther.net
DNS ASK le###ree.net
DNS ASK ta###forty.net
DNS ASK we###all.net
DNS ASK ta###free.net
DNS ASK li###ther.net
DNS ASK th###wall.net
DNS ASK li###orty.net
DNS ASK th###other.net
DNS ASK we###ree.net
DNS ASK fe###orty.net
DNS ASK li###all.net
DNS ASK fe###ree.net
DNS ASK le###orty.net
DNS ASK po###wall.net
DNS ASK ca###all.net
DNS ASK po###other.net
DNS ASK ca###ther.net
DNS ASK no###ther.net
DNS ASK no###all.net
DNS ASK no###ree.net
DNS ASK no###orty.net
DNS ASK ta###wall.net
DNS ASK le###all.net
DNS ASK ta###other.net
DNS ASK le###ther.net
DNS ASK po###forty.net
DNS ASK ca###orty.net
DNS ASK po###free.net
DNS ASK ca###ree.net
DNS ASK th###forty.net
DNS ASK we###tudy.net
DNS ASK no###tudy.net
DNS ASK we###ncle.net
DNS ASK no###ncle.net
DNS ASK ri###ncle.net
DNS ASK fa###uncle.net
DNS ASK we###oss.net
DNS ASK we###nce.net
DNS ASK be##lxc.com
DNS ASK de###lxc.com
DNS ASK ri###nstorm.net
DNS ASK af###sllc.com
DNS ASK no###nce.net
DNS ASK li###nce.net
DNS ASK no###oss.net
DNS ASK li###oss.net
DNS ASK so###other.net
DNS ASK fi###other.net
DNS ASK so###forty.net
DNS ASK fi###forty.net
DNS ASK th###free.net
DNS ASK li###ree.net
DNS ASK so###wall.net
DNS ASK fi###wall.net
DNS ASK ri###oss.net
DNS ASK fa###loss.net
DNS ASK ri###tudy.net
DNS ASK fa###study.net
DNS ASK so###free.net
DNS ASK fi###free.net
DNS ASK ri###nce.net
DNS ASK fa###once.net
'23#.#55.255.250':1900

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial