Trojan.DownLoad4.8995

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'SPP' = '%WINDIR%\winsxx\srnss.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'SPP' = '%WINDIR%\winsxx\srnss.exe'

Malicious functions:

To complicate detection of its presence in the operating system,

blocks the following features:

User Account Control (UAC)

Executes the following:

'<SYSTEM32>\taskkill.exe' /f /im hproc64.exe

Injects code into

the following system processes:

<SYSTEM32>\ctfmon.exe

Modifies file system:

Creates the following files:

%WINDIR%\msic.dll
%WINDIR%\mmc.dll
%WINDIR%\AeroS.exe
%ProgramFiles%\newgdi32.dll
%WINDIR%\mtemp.db
%WINDIR%\kmon.dll

Network activity:

Connects to:

'10#.#.250.149':8889
'ta###.kro.kr':80
'localhost':1036

TCP:

HTTP GET requests:

http://ta###.kro.kr/

UDP:

DNS ASK ta###.kro.kr

Miscellaneous:

Searches for the following windows:

ClassName: '' WindowName: '???? ??????????'
ClassName: '' WindowName: 'ЗЗёБ ·Оїм№ЩµПАМ'
ClassName: '' WindowName: '???? 7????'
ClassName: '' WindowName: 'ЗС°ФАУ ёВЖчДї'
ClassName: '' WindowName: '?????? ????????'
ClassName: '' WindowName: 'ЗС°ФАУ ЖДЖјИЗ¶у'
ClassName: '' WindowName: 'ЗЗёБ 7ЖчДї'
ClassName: '' WindowName: 'ЗЗёБ ЗПАМ·Оїм'
ClassName: '' WindowName: '???? ????'
ClassName: '' WindowName: 'ЗЗёБ ИЗ¶у'
ClassName: '' WindowName: '???? ??????'
ClassName: '' WindowName: 'ЗЗёБ ґєЖчДї'
ClassName: '' WindowName: '???? ????????'
ClassName: 'IEFrame' WindowName: ''
ClassName: '' WindowName: '?????? ??????????'
ClassName: '' WindowName: 'ЗС°ФАУ ·Оїм№ЩµПАМ'
ClassName: '' WindowName: '????? ???'
ClassName: '' WindowName: '팟스타게임 대기실'
ClassName: '' WindowName: '바이크게임'
ClassName: '' WindowName: '?????? 7????'
ClassName: '' WindowName: '????????2'
ClassName: '' WindowName: 'ЗПАМ·Оїм2'
ClassName: '' WindowName: '?????? ??????'
ClassName: '' WindowName: 'ЗС°ФАУ 7ЖчДї'
ClassName: '' WindowName: '?????? ?????????? ????'
ClassName: '' WindowName: 'ЗС°ФАУ ¶уЅєєЈ°ЎЅє ЖчДї'
ClassName: '' WindowName: 'ЗЗёБ ёВ°н'
ClassName: '' WindowName: '?????????? ??????'
ClassName: '' WindowName: 'ЖМЅєЕё°ФАУ ґл±вЅЗ'
ClassName: '' WindowName: '????????'
ClassName: '' WindowName: 'ЖчДї°ФАУ'
ClassName: '' WindowName: 'ёВ°н°ФАУ'
ClassName: '' WindowName: '???????? ????'
ClassName: '' WindowName: 'ЖчДї'
ClassName: '#32770' WindowName: '??????'
ClassName: '#32770' WindowName: 'ёЮёрАе'
ClassName: '' WindowName: 'їГЅєЕёБо °ФАУ'
ClassName: '' WindowName: '·Оїм №ЩµПАМ'
ClassName: '' WindowName: 'ёВ°н'
ClassName: '' WindowName: 'іЭё¶єн 7ЖчДї'
ClassName: '' WindowName: 'іЭё¶єн ·Оїм№ЩµПАМ'
ClassName: '' WindowName: 'іЭё¶єн ґєЖчДї'
ClassName: '' WindowName: 'ЗЗёБ ґєёВ°н'
ClassName: '' WindowName: 'ЗЗёБ јёґЩ'
ClassName: '' WindowName: 'ЗЗёБ °нЅєЕй'
ClassName: '' WindowName: 'іЭё¶єн ЗПАМ·Оїм'
ClassName: '' WindowName: '°ФАУ Е¬¶уАМѕрЖ®'
ClassName: '' WindowName: '??????????'
ClassName: '' WindowName: '№ЩµПАМ°ФАУ'
ClassName: '' WindowName: '?????? ????'
ClassName: '' WindowName: 'іЭё¶єн јёґЩ'
ClassName: '' WindowName: 'іЭё¶єн ИЗ¶у'
ClassName: '' WindowName: '피망 7포커'
ClassName: '' WindowName: '?? ???'
ClassName: '' WindowName: '피망 뉴포커'
ClassName: '' WindowName: '?? ?????'
ClassName: '' WindowName: '피망 로우바둑이'
ClassName: '' WindowName: '?? 7??'
ClassName: '' WindowName: '?? ????'
ClassName: '' WindowName: '피망 맞고'
ClassName: '' WindowName: '피망 뉴맞고'
ClassName: '' WindowName: '피망 섯다'
ClassName: '' WindowName: '피망 하이로우'
ClassName: '' WindowName: '?? ??'
ClassName: '' WindowName: '피망 훌라'
ClassName: '' WindowName: '??? 7??'
ClassName: '' WindowName: '한게임 7포커'
ClassName: '' WindowName: '??? ????? ??'
ClassName: '' WindowName: ''
ClassName: '' WindowName: '??? ?????'
ClassName: '' WindowName: '한게임 로우바둑이'
ClassName: '' WindowName: '한게임 라스베가스 포커'
ClassName: '' WindowName: '한게임 맞포커'
ClassName: '' WindowName: '??? ????'
ClassName: '' WindowName: '한게임 파티훌라'
ClassName: '' WindowName: '????2'
ClassName: '' WindowName: '하이로우2'
ClassName: '' WindowName: '??? ???'
ClassName: '' WindowName: '피망 고스톱'
ClassName: '' WindowName: 'Baduki'
ClassName: '' WindowName: 'PlusPoker'
ClassName: '' WindowName: 'Matgo'
ClassName: '' WindowName: '맞고게임'
ClassName: '' WindowName: 'NEW VONGVONG BADUKI'
ClassName: '' WindowName: 'NEW VONGVONG MATGO'
ClassName: '' WindowName: 'Vanilla'
ClassName: '' WindowName: '??'
ClassName: '' WindowName: '맞고'
ClassName: '' WindowName: '포커'
ClassName: '' WindowName: '???? ??'
ClassName: '' WindowName: '올스타즈 게임'
ClassName: '' WindowName: '로우 바둑이'
ClassName: '' WindowName: '넷마블 하이로우'
ClassName: '' WindowName: '??? ??'
ClassName: '' WindowName: '넷마블 섯다'
ClassName: '' WindowName: '넷마블 7포커'
ClassName: '' WindowName: '넷마블 로우바둑이'
ClassName: '' WindowName: '넷마블 뉴포커'
ClassName: '' WindowName: '넷마블 훌라'
ClassName: '' WindowName: '바둑이게임'
ClassName: '' WindowName: '????'
ClassName: '' WindowName: '포커게임'
ClassName: '' WindowName: '게임 클라이언트'
ClassName: 'CXG_WNDCLASS' WindowName: ''
ClassName: '' WindowName: '?????'

Executes the following:

'<SYSTEM32>\ipconfig.exe' /all
'<SYSTEM32>\ctfmon.exe'

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial