Trojan.SMSSend.1785

Technical Information

Malicious functions:

Executes the following:

<SYSTEM32>\attrib.exe -H -R "%TEMP%\mdmxa$$$$.bat"
<SYSTEM32>\cmd.exe /c %TEMP%\mdmxa$$$$.bat

Modifies file system :

Creates the following files:

%HOMEPATH%\Favorites\CJON mart.url
%HOMEPATH%\Favorites\CJON마트.url
%HOMEPATH%\Favorites\cjon.url
%HOMEPATH%\Favorites\cj쇼핑.url
%HOMEPATH%\Favorites\CJmall.url
%HOMEPATH%\Favorites\GS SHOP.url
%HOMEPATH%\Favorites\GS샵.url
%HOMEPATH%\Favorites\gmarket.url
%HOMEPATH%\Favorites\G마캣.url
%HOMEPATH%\Favorites\G마켓.url
%HOMEPATH%\Favorites\지에스숍.url
%HOMEPATH%\Favorites\지에스이샵.url
%HOMEPATH%\Favorites\지에스샵.url
%HOMEPATH%\Favorites\이마트인터넷쇼핑몰.url
%HOMEPATH%\Favorites\지마켓.url
%HOMEPATH%\Favorites\assacom.url
%HOMEPATH%\Favorites\cj마트.url
%HOMEPATH%\Favorites\AK몰.url
%HOMEPATH%\Favorites\지에스이숍.url
%HOMEPATH%\Favorites\지에스홈쇼핑.url
%HOMEPATH%\Favorites\GSSHOP.url
%WINDIR%\gmarket_favicon.ico
%HOMEPATH%\Favorites\Links\G마켓.url
%HOMEPATH%\Favorites\rmfnvhs.url
%HOMEPATH%\Favorites\그루폰.url
%HOMEPATH%\Favorites\groupon.url
%HOMEPATH%\Favorites\Links\11번가.url
%TEMP%\mdmxa$$$$.bat
%WINDIR%\11st_favicon.ico
%WINDIR%\auction_favicon.ico
%HOMEPATH%\Favorites\Links\옥션.url
%HOMEPATH%\Favorites\LG패션샵.url
%HOMEPATH%\Favorites\NS이숍.url
%HOMEPATH%\Favorites\Hmall.url
%HOMEPATH%\Favorites\gseshop.url
%HOMEPATH%\Favorites\H몰.url
%HOMEPATH%\Favorites\티켓몬스터.url
%HOMEPATH%\Favorites\티몬.url
%HOMEPATH%\Favorites\플라이워치.url
%HOMEPATH%\Favorites\wlakzpt.url
%HOMEPATH%\Favorites\YES24.url
%HOMEPATH%\Favorites\롯데인터넷면세점.url
%HOMEPATH%\Favorites\롯데홈쇼핑.url
%HOMEPATH%\Favorites\롯데마트인터넷쇼핑몰.url
%HOMEPATH%\Favorites\롯데마트.url
%HOMEPATH%\Favorites\롯데마트쇼핑몰.url
%HOMEPATH%\Favorites\신라인터넷면세점.url
%HOMEPATH%\Favorites\신세계.url
%HOMEPATH%\Favorites\신라면세점.url
%HOMEPATH%\Favorites\면세점.url
%HOMEPATH%\Favorites\명품관.url
%HOMEPATH%\Favorites\1300k.url
%HOMEPATH%\Favorites\가방팝.url
%HOMEPATH%\Favorites\11st.url
%HOMEPATH%\Favorites\11qjsrk.url
%HOMEPATH%\Favorites\11번가.url
%HOMEPATH%\Favorites\더페이스샵.url
%HOMEPATH%\Favorites\디앤샵.url
%HOMEPATH%\Favorites\대출.url
%HOMEPATH%\Favorites\꽃배달.url
%HOMEPATH%\Favorites\농수산홈쇼핑.url
%HOMEPATH%\Favorites\신세계몰.url
%HOMEPATH%\Favorites\옥션.url
%HOMEPATH%\Favorites\우체국쇼핑.url
%HOMEPATH%\Favorites\예스이십사.url
%HOMEPATH%\Favorites\연예인디씨.url
%HOMEPATH%\Favorites\예스24.url
%HOMEPATH%\Favorites\이마트.url
%HOMEPATH%\Favorites\이마트상품.url
%HOMEPATH%\Favorites\웹하드.url
%HOMEPATH%\Favorites\워커힐면세점.url
%HOMEPATH%\Favorites\원어데이.url
%HOMEPATH%\Favorites\씨제이오쇼핑.url
%HOMEPATH%\Favorites\씨제이온마트.url
%HOMEPATH%\Favorites\씨제이쇼핑.url
%HOMEPATH%\Favorites\씨제이마트.url
%HOMEPATH%\Favorites\씨제이몰.url
%HOMEPATH%\Favorites\아이스타일24.url
%HOMEPATH%\Favorites\엔조이뉴욕.url
%HOMEPATH%\Favorites\아이스타일.url
%HOMEPATH%\Favorites\씨제이.url
%HOMEPATH%\Favorites\아싸컴.url

Sets the 'hidden' attribute to the following files:

%HOMEPATH%\Favorites\assacom.url
%HOMEPATH%\Favorites\cj마트.url
%HOMEPATH%\Favorites\지에스이숍.url
%HOMEPATH%\Favorites\지에스홈쇼핑.url
%HOMEPATH%\Favorites\CJON mart.url
%HOMEPATH%\Favorites\CJON마트.url
%HOMEPATH%\Favorites\cj쇼핑.url
%HOMEPATH%\Favorites\cjon.url
%HOMEPATH%\Favorites\이마트.url
%HOMEPATH%\Favorites\이마트상품.url
%HOMEPATH%\Favorites\원어데이.url
%HOMEPATH%\Favorites\웹하드.url
%HOMEPATH%\Favorites\지에스숍.url
%HOMEPATH%\Favorites\지에스이샵.url
%HOMEPATH%\Favorites\이마트인터넷쇼핑몰.url
%HOMEPATH%\Favorites\지에스샵.url
%HOMEPATH%\Favorites\G마캣.url
%HOMEPATH%\Favorites\플라이워치.url
%HOMEPATH%\Favorites\티몬.url
%HOMEPATH%\Favorites\wlakzpt.url
%HOMEPATH%\Favorites\YES24.url
%HOMEPATH%\Favorites\rmfnvhs.url
%TEMP%\mdmxa$$$$.bat
%HOMEPATH%\Favorites\그루폰.url
%HOMEPATH%\Favorites\groupon.url
%HOMEPATH%\Favorites\GS SHOP.url
%HOMEPATH%\Favorites\GS샵.url
%HOMEPATH%\Favorites\G마켓.url
%HOMEPATH%\Favorites\gmarket.url
%HOMEPATH%\Favorites\LG패션샵.url
%HOMEPATH%\Favorites\NS이숍.url
%HOMEPATH%\Favorites\gseshop.url
%HOMEPATH%\Favorites\H몰.url
%HOMEPATH%\Favorites\롯데마트쇼핑몰.url
%HOMEPATH%\Favorites\롯데마트인터넷쇼핑몰.url
%HOMEPATH%\Favorites\디앤샵.url
%HOMEPATH%\Favorites\롯데마트.url
%HOMEPATH%\Favorites\면세점.url
%HOMEPATH%\Favorites\명품관.url
%HOMEPATH%\Favorites\롯데인터넷면세점.url
%HOMEPATH%\Favorites\롯데홈쇼핑.url
%HOMEPATH%\Favorites\1300k.url
%HOMEPATH%\Favorites\가방팝.url
%HOMEPATH%\Favorites\11qjsrk.url
%HOMEPATH%\Favorites\11st.url
%HOMEPATH%\Favorites\대출.url
%HOMEPATH%\Favorites\더페이스샵.url
%HOMEPATH%\Favorites\꽃배달.url
%HOMEPATH%\Favorites\농수산홈쇼핑.url
%HOMEPATH%\Favorites\신라면세점.url
%HOMEPATH%\Favorites\아이스타일24.url
%HOMEPATH%\Favorites\연예인디씨.url
%HOMEPATH%\Favorites\아싸컴.url
%HOMEPATH%\Favorites\아이스타일.url
%HOMEPATH%\Favorites\우체국쇼핑.url
%HOMEPATH%\Favorites\워커힐면세점.url
%HOMEPATH%\Favorites\예스24.url
%HOMEPATH%\Favorites\예스이십사.url
%HOMEPATH%\Favorites\씨제이마트.url
%HOMEPATH%\Favorites\씨제이몰.url
%HOMEPATH%\Favorites\신라인터넷면세점.url
%HOMEPATH%\Favorites\신세계.url
%HOMEPATH%\Favorites\씨제이온마트.url
%HOMEPATH%\Favorites\씨제이.url
%HOMEPATH%\Favorites\씨제이쇼핑.url
%HOMEPATH%\Favorites\씨제이오쇼핑.url

Deletes itself.

Network activity:

Connects to:

'www.go###va.co.kr':80

TCP:

HTTP POST requests:

www.go###va.co.kr/pops/logs.v/set/end.php
www.go###va.co.kr/pops/logs.v/set/begin.php

UDP:

DNS ASK www.go###va.co.kr
'<Private IP address>':1034

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial