Trojan.DownLoader29.51458

Technical Information

To ensure autorun and distribution

Creates the following services

[<HKLM>\System\CurrentControlSet\Services\cgxuhykr] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\cgxuhykr] 'ImagePath' = '<SYSTEM32>\cgxuhykr\uhvyaayl.exe /d"<Full path to file>"'
[<HKLM>\SYSTEM\CurrentControlSet\services\cgxuhykr] 'ImagePath' = '<SYSTEM32>\cgxuhykr\uhvyaayl.exe'

Malicious functions

Injects code into

the following system processes:

<SYSTEM32>\svchost.exe

Modifies file system

Creates the following files

%TEMP%\uhvyaayl.exe
C:\documents and settings\localservice:.repos

Moves the following files

from %TEMP%\uhvyaayl.exe to <SYSTEM32>\cgxuhykr\uhvyaayl.exe

Deletes itself.

Network activity

Connects to

'mt##.##0.yahoodns.net':25
'fr#####.#inamail.sina.com.cn':25
'mx###.##il.am0.yahoodns.net':25
'mx.#len.pl':25
'eu#.###.#rotection.outlook.com':25
'mx##.#spgateway.de':25
'gmail-smtp-in.l.google.com':25
'alt1.aspmx.l.google.com':25
'cl#######.us.messagelabs.com':25
'mx####.##il.gm0.yahoodns.net':25
'69.#1.136.5':443
'ma##.#ihonparker.in':25
'ma###.#omune.venezia.it':25
'mx#####.#ail.gm0.yahoodns.net':25
'ma##.#egister.it':25
'mx.##ra.co.nz':25
'mx#######402.gslb.pphosted.com':25
'sm####n.libero.it':25
'al######x-vip1.prodigy.net':25
'ne##lix.com':443
'mx.##lus.net':25
'mx##.#andomain.dk':25
'mx.yandex.ru':25
'mx#.#anmail.net':25
'sm##.#ail.swan.sk':25
'ma##.##oolfotografie.nl':25
'ho####decharme.nl':25
'al######x-vip2.prodigy.net':25
'mx#.##.correio.biz':25
'd1######.#ss.barracudanetworks.com':25
'ma###.eircom.net':25
'ma##.stsnet.it':25
'cl#######k.eu.messagelabs.com':25
'ms#####p-mx1.hinet.net':25
'ho#########.olc.protection.outlook.com':25
'mx#.mail.ru':25
'aspmx.l.google.com':25
'mx#.##tsolmail.net':25
'ma####1.globeop.com':25
'mx#.##axiscloud.com':25
'mx#######701.gslb.pphosted.com':25
'ma###.hostek.com':25
'mx###.in-mx.com':25
'as#.##flexion.net':25
'ki###film.sk':443
'mx.##oltoad.com':25
'tu###.web2media.sk':443
'sm###.9services.com':25
'fo###.#oogleapis.com':443
'mx.##teria.pl':25
'ba#####da.airmar.com':25
'ma##.#####-cover.trafficmanager.net':25
'sm##.##cureserver.net':25
'du###.emsergipe.com':25
'et###.#ail.tiscali.it':25
'fo###.gstatic.com':443
'cd#.#dspirit.de':443
'sp####ght.mdsnet.it':25
'alt3.gmail-smtp-in.l.google.com':25
'mx#####os1.burgo.com':25
'dn#######edge01.email.rr.com':25
'fi#######mw15.rightnowtech.com':25
'ma##.###fdistributing.com':25
'mx#######e01.gslb.pphosted.com':25
'14#.#6.108.92':483
'sm####n.eutelia.it':25
'ma##.##-productions.de':25
'sm##.a1.net':25

TCP

HTTP GET requests

http://www.google.com/

UDP

DNS ASK mi##########m.mail.protection.outlook.com
DNS ASK nb##.co.nz
DNS ASK cl#######k.eu.messagelabs.com
DNS ASK il###istro.it
DNS ASK si##.com
DNS ASK fr#####.#inamail.sina.com.cn
DNS ASK xt##.co.nz
DNS ASK mx.##ra.co.nz
DNS ASK al#######alacerestaurant.com
DNS ASK ya##o.it
DNS ASK mx###.##il.am0.yahoodns.net
DNS ASK me###pectra.com
DNS ASK sk#.com
DNS ASK o2.pl
DNS ASK mx.#len.pl
DNS ASK li#e.it
DNS ASK ar####methods.com
DNS ASK fr###ier.com
DNS ASK ku####uch-shop.de
DNS ASK mx##.#spgateway.de
DNS ASK ya###.com.ar
DNS ASK 11##tri.eu
DNS ASK ca####zeriapiave.it
DNS ASK br#####hinyobject.com
DNS ASK ms#####p-mx1.hinet.net
DNS ASK gm##l.com
DNS ASK ms#.#inet.net
DNS ASK re###iving.com
DNS ASK sp####ght.mdsnet.it
DNS ASK ho###oop.com
DNS ASK ho##law.com
DNS ASK bu#####stribuzione.com
DNS ASK mx#####os1.burgo.com
DNS ASK ha##ail.net
DNS ASK mx#.#anmail.net
DNS ASK jz####ductions.de
DNS ASK ma##.##-productions.de
DNS ASK go####il.etsu.edu
DNS ASK gu####novation.com
DNS ASK ag##e.com
DNS ASK ke###ichat.com
DNS ASK gi###inc.com
DNS ASK ch#######hopping-central.com
DNS ASK ma####.custhelp.com
DNS ASK fi#######mw15.rightnowtech.com
DNS ASK gu#####tributing.com
DNS ASK ma##.###fdistributing.com
DNS ASK fa####dollar.com
DNS ASK mx#######e01.gslb.pphosted.com
DNS ASK fr###omland.it
DNS ASK sm####n.eutelia.it
DNS ASK ma##.#####-cover.trafficmanager.net
DNS ASK al######x-vip2.prodigy.net
DNS ASK sm##.a1.net
DNS ASK alt1.aspmx.l.google.com
DNS ASK sg####otografie.nl
DNS ASK ma##.##oolfotografie.nl
DNS ASK wr####udents.org
DNS ASK go###email.com
DNS ASK alt3.gmail-smtp-in.l.google.com
DNS ASK ad##an.edu
DNS ASK bi##ys.it
DNS ASK ya##o.co.nz
DNS ASK eu##web.sk
DNS ASK sm##.#ail.swan.sk
DNS ASK yandex.ru
DNS ASK mx.yandex.ru
DNS ASK sh##ita.dk
DNS ASK mx##.#andomain.dk
DNS ASK te##s.net
DNS ASK mx.##lus.net
DNS ASK ne##lix.com
DNS ASK be###outh.net
DNS ASK al######x-vip1.prodigy.net
DNS ASK tu#.by
DNS ASK ad###hia.net
DNS ASK dn#######edge01.email.rr.com
DNS ASK a1.net
DNS ASK ho####decharme.nl
DNS ASK ma##.mdsnet.it
DNS ASK fo#####ohaus-mohr.de
DNS ASK sb###obal.net
DNS ASK ma###as.cmpc.cl
DNS ASK mo#####e.wellsfargo.com
DNS ASK cl#######.us.messagelabs.com
DNS ASK ve##zon.net
DNS ASK mx####.##il.gm0.yahoodns.net
DNS ASK ni###parker.in
DNS ASK ma##.#ihonparker.in
DNS ASK co####.venezia.it
DNS ASK ma###.#omune.venezia.it
DNS ASK ya###.com.sg
DNS ASK mx#####.#ail.gm0.yahoodns.net
DNS ASK ty##n.com
DNS ASK mx#######402.gslb.pphosted.com
DNS ASK li##ro.it
DNS ASK sm####n.libero.it
DNS ASK st##et.it
DNS ASK ma##.stsnet.it
DNS ASK ei##om.net
DNS ASK ma###.eircom.net
DNS ASK fo###rcity.org
DNS ASK d1######.#ss.barracudanetworks.com
DNS ASK ig.#om.br
DNS ASK mx#.##.correio.biz
DNS ASK gmail-smtp-in.l.google.com
DNS ASK mu####overseas.com
DNS ASK cd#.#dspirit.de
DNS ASK ma###.hostek.com
DNS ASK le###iflock.it
DNS ASK mx.###atiflock.it
DNS ASK ya##o.com
DNS ASK mt##.##0.yahoodns.net
DNS ASK ae##n.nl
DNS ASK mx#######f01.gslb.pphosted.com
DNS ASK le##line.it
DNS ASK mx###.in-mx.net
DNS ASK el##vier.nl
DNS ASK el#########.mail.protection.outlook.com
DNS ASK xp#######am12.itap.purdue.edu
DNS ASK le##rne.com
DNS ASK le###matic.it
DNS ASK aspmx.l.google.com
DNS ASK in##ria.pl
DNS ASK mx.##teria.pl
DNS ASK wa##doo.nl
DNS ASK le###rans.it
DNS ASK le###unisi.it
DNS ASK ne#####ndse-opera.nl
DNS ASK mx#####1.fortytwo.nl
DNS ASK le####riafghani.it
DNS ASK le####clubhotel.it
DNS ASK pu##ue.edu
DNS ASK mx#.mail.ru
DNS ASK in##x.ru
DNS ASK 19#.###.211.95.in-addr.arpa
DNS ASK 19#.###.#11.95.dnsbl.sorbs.net
DNS ASK le####inazioni.it
DNS ASK ma##.#egister.it
DNS ASK 19#.###.#11.95.bl.spamcop.net
DNS ASK 19#.###.#11.95.zen.spamhaus.org
DNS ASK ms#.edu
DNS ASK 19#.###.##1.95.sbl-xbl.spamhaus.org
DNS ASK mx#######801.gslb.pphosted.com
DNS ASK 19#.###.#11.95.cbl.abuseat.org
DNS ASK le####eimmobili.it
DNS ASK ma##.##vanteimmobili.it
DNS ASK fs#.edu
DNS ASK mx#######503.gslb.pphosted.com
DNS ASK le###chimica.it
DNS ASK ma##.##vanchimica.it
DNS ASK tr###.ulm.edu
DNS ASK is##ine.it
DNS ASK em###.isisecure.it
DNS ASK pl##et.nl
DNS ASK ma####.kpnmail.nl
DNS ASK ho##ail.com
DNS ASK ho#########.olc.protection.outlook.com
DNS ASK le##iero.it
DNS ASK fo###.gstatic.com
DNS ASK li##.co.uk
DNS ASK du###.emsergipe.com
DNS ASK mx###.in-mx.com
DNS ASK gi####pearls.com
DNS ASK ja#####wnpainting.com
DNS ASK as#.##flexion.net
DNS ASK ki###film.sk
DNS ASK gi###echinc.com
DNS ASK co###oad.com
DNS ASK mx.##oltoad.com
DNS ASK tu###.web2media.sk
DNS ASK qq##.com
DNS ASK km#.com
DNS ASK gr####-perrotin.com
DNS ASK sm###.9services.com
DNS ASK ma##ort.com
DNS ASK fo###.#oogleapis.com
DNS ASK ba#####da.airmar.com
DNS ASK pr#####herapeutics.com
DNS ASK pr####-presse.com
DNS ASK ib##l.com
DNS ASK sm##.##cureserver.net
DNS ASK li#t.ru
DNS ASK jp###abe.com
DNS ASK em###gipe.com
DNS ASK oa##.com
DNS ASK pi##te.ca
DNS ASK le##or.it
DNS ASK mx#######701.gslb.pphosted.com
DNS ASK ti###linet.it
DNS ASK et###.#ail.tiscali.it
DNS ASK in##co.net
DNS ASK ma####.lanaco.com
DNS ASK ho##ail.de
DNS ASK eu#.###.#rotection.outlook.com
DNS ASK ne##om.ca
DNS ASK sr##.com
DNS ASK ma#l.ru
DNS ASK dh#.nl
DNS ASK ca####onsult.com
DNS ASK cl######.eu.messagelabs.com
DNS ASK ca######.#om.mx1.greymail.rcimx.net
DNS ASK google.com
DNS ASK gl####star.com.ni
DNS ASK gl####star.com.tr
DNS ASK ou###rmland.com
DNS ASK mx#.##tsolmail.net
DNS ASK gl##eop.com
DNS ASK ma####1.globeop.com
DNS ASK cc##pa.com
DNS ASK mx#.##axiscloud.com
DNS ASK sf###onicle.com
DNS ASK ca###omm.com
DNS ASK mx#.#irate.ca
'<DNS_SERVER>':53

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cgxuhykr\uhvyaayl.exe' /d"<Full path to file>"
'<SYSTEM32>\cmd.exe' /C mkdir <SYSTEM32>\cgxuhykr\' (with hidden window)
'<SYSTEM32>\cmd.exe' /C move /Y "%TEMP%\uhvyaayl.exe" <SYSTEM32>\cgxuhykr\' (with hidden window)
'<SYSTEM32>\sc.exe' create cgxuhykr binPath= "<SYSTEM32>\cgxuhykr\uhvyaayl.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"' (with hidden window)
'<SYSTEM32>\sc.exe' description cgxuhykr "wifi internet conection"' (with hidden window)
'<SYSTEM32>\sc.exe' start cgxuhykr' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /C mkdir <SYSTEM32>\cgxuhykr\
'<SYSTEM32>\cmd.exe' /C move /Y "%TEMP%\uhvyaayl.exe" <SYSTEM32>\cgxuhykr\
'<SYSTEM32>\sc.exe' create cgxuhykr binPath= "<SYSTEM32>\cgxuhykr\uhvyaayl.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"
'<SYSTEM32>\sc.exe' description cgxuhykr "wifi internet conection"
'<SYSTEM32>\sc.exe' start cgxuhykr
'<SYSTEM32>\svchost.exe'

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial