Trojan.DownLoader30.4201

Technical Information

To ensure autorun and distribution

Creates the following services

[<HKLM>\System\CurrentControlSet\Services\aleimeqy] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\aleimeqy] 'ImagePath' = '<SYSTEM32>\aleimeqy\bivvyjbw.exe /d"<Full path to file>"'
[<HKLM>\SYSTEM\CurrentControlSet\services\aleimeqy] 'ImagePath' = '<SYSTEM32>\aleimeqy\bivvyjbw.exe'

Malicious functions

Injects code into

the following system processes:

<SYSTEM32>\svchost.exe

Modifies file system

Creates the following files

%TEMP%\bivvyjbw.exe
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib\009
C:\documents and settings\localservice:.repos

Moves the following files

from %TEMP%\bivvyjbw.exe to <SYSTEM32>\aleimeqy\bivvyjbw.exe

Deletes itself.

Network activity

Connects to

'eu#.###.#rotection.outlook.com':25
'a6#####.mx.mailhop.org':25
'95.##1.178.17':486
'ms#####p-mx1.hinet.net':25
'sm##.tin.it':25
'mx#.###edhits-mail.com':25
'mx######91d01.pphosted.com':25
'mx.####iciodecorreo.es':25
'mx#.#sgo.net':25
'mx###.##il.am0.yahoodns.net':25
'sm####n.inwind.it':25
'et###.#ail.tiscali.it':25
'mx##.lolipop.jp':25
'ge####neequity.com':25
'fu####ofmagic.com':25
'fw#########.mail.protection.outlook.com':25
'mx.##.#etgate.com.uy':25
'fa##ns.com':25
'd3#####.##s.barracudanetworks.com':25
'ga######n.com.1.arsmtp.com':25
'mx#######001.gslb.pphosted.com':25
'ga###ouseuk.com':25
'mx#.#ianet.ca':25
'ma##.#cronline.com':25
'mx#######901.gslb.pphosted.com':25
'mx####.##il.gm0.yahoodns.net':25
'mx#.#omcast.net':25
'mx#####.#ail.gm0.yahoodns.net':25
'in###nd.gci.net':25
'mx##.#eykjavik.is':25
'aspmx.l.google.com':25
'gmail-smtp-in.l.google.com':25
'wi#######5.hostmanagement.net':25
'ho#########.olc.protection.outlook.com':25
'mt##.##0.yahoodns.net':25
'fo#####il.samskip.is':25
'ma####.mailtwo.com':25
'mx.###.##mail.iss.as9143.net':25
're###.fujikon.com':25
'ls####1.esc11.net':25
'sm##.renault.fr':25
'ou####k.bfpcorp.com':25
'fu#####pphotography.com':25
'sm##.gta.sk':25
'mx####.carrierzone.com':25
'na#.###.#rotection.outlook.com':25
'ol####.woodforest.com':443
'we#####-038.cafe24.com':25
'ma##.sesby.com':25
'd1######.#ss.barracudanetworks.com':25
'10##.zoner.com':25
'mx##.zoznam.sk':25
'ma#####.triptravel.sk':25
'ma#####rtual.gwtc.net':25
'cx#.##.#.cloudfilter.net':25

TCP

HTTP GET requests

http://www.google.com/
http://ap#.##-cy.ru:35000/

UDP

DNS ASK mi##########m.mail.protection.outlook.com
DNS ASK gt#.sk
DNS ASK sm##.gta.sk
DNS ASK el####oodsales.com
DNS ASK fu##ko.com
DNS ASK we#####-038.cafe24.com
DNS ASK we##v.net
DNS ASK na#.###.#rotection.outlook.com
DNS ASK ol####.woodforest.com
DNS ASK se##y.com
DNS ASK ma##.sesby.com
DNS ASK bf###tners.com
DNS ASK d1######.#ss.barracudanetworks.com
DNS ASK in##il.sk
DNS ASK 10##.zoner.com
DNS ASK zo##am.sk
DNS ASK mx##.zoznam.sk
DNS ASK tr###ravel.sk
DNS ASK ma#####.triptravel.sk
DNS ASK bf##orp.com
DNS ASK ou####k.bfpcorp.com
DNS ASK va###ytel.net
DNS ASK sm##.renault.fr
DNS ASK ma#####rtual.gwtc.net
DNS ASK re##ult.com
DNS ASK fu####umicro.com
DNS ASK ap#.#r-cy.ru
DNS ASK le###kolar.is
DNS ASK mx##.#eykjavik.is
DNS ASK fr#####sesynergies.com
DNS ASK fr###omig.com
DNS ASK fr#####chwatkins.com
DNS ASK fr##a.com
DNS ASK wi#######5.hostmanagement.net
DNS ASK it#.is
DNS ASK sa##kip.is
DNS ASK fo#####il.samskip.is
DNS ASK nt###rld.com
DNS ASK mx.###.##mail.iss.as9143.net
DNS ASK ho##ail.de
DNS ASK fu##kon.com
DNS ASK re###.fujikon.com
DNS ASK rh##.rvk.is
DNS ASK es##i.net
DNS ASK ls####1.esc11.net
DNS ASK gc#.net
DNS ASK in###nd.gci.net
DNS ASK fu#####pphotography.com
DNS ASK ya##o.co.th
DNS ASK mx#####.#ail.gm0.yahoodns.net
DNS ASK ve##zon.net
DNS ASK d3#####.##s.barracudanetworks.com
DNS ASK ga######adoptionstories.com
DNS ASK ga###ritics.com
DNS ASK ga###rson.com
DNS ASK ga######n.com.1.arsmtp.com
DNS ASK re###rvices.com
DNS ASK mx#######001.gslb.pphosted.com
DNS ASK ga###ouseuk.com
DNS ASK ma##n.com
DNS ASK co#.net
DNS ASK mx#.#ianet.ca
DNS ASK gc###line.com
DNS ASK ma##.#cronline.com
DNS ASK ne###ape.net
DNS ASK ph#.co.uk
DNS ASK mx#######901.gslb.pphosted.com
DNS ASK gc####gecoach.com
DNS ASK ge####neequity.com
DNS ASK ms##.hinet.net
DNS ASK gm##m.com
DNS ASK fw##a.com
DNS ASK ga###alink.com
DNS ASK fa##ns.com
DNS ASK mx.##.#etgate.com.uy
DNS ASK ab###dos.com.uy
DNS ASK be####yassoc.com
DNS ASK a6#####.mx.mailhop.org
DNS ASK be###eyav.com
DNS ASK in####its-mail.com
DNS ASK mx#.###edhits-mail.com
DNS ASK be###outh.com
DNS ASK mx######91d01.pphosted.com
DNS ASK ar##kis.es
DNS ASK mx.####iciodecorreo.es
DNS ASK sm####n.inwind.it
DNS ASK mx#.#sgo.net
DNS ASK us###ily.net
DNS ASK mx###.##il.am0.yahoodns.net
DNS ASK co##ast.net
DNS ASK mx#.#omcast.net
DNS ASK fu####ofmagic.com
DNS ASK ho###il.co.uk
DNS ASK fu##ndo.com
DNS ASK mx##.lolipop.jp
DNS ASK fw##inc.com
DNS ASK fw#########.mail.protection.outlook.com
DNS ASK mx####.##il.gm0.yahoodns.net
DNS ASK ya##o.it
DNS ASK gc##s.com
DNS ASK in##nd.it
DNS ASK fl###studio.com
DNS ASK t-##line.de
DNS ASK mx##.#-online.de
DNS ASK ti###li-dsl.de
DNS ASK ma##.##irdechelon.net
DNS ASK ti###linet.it
DNS ASK et###.#ail.tiscali.it
DNS ASK sp#####se-bodensee.de
DNS ASK g0###.mail.s-web.de
DNS ASK ci###twork.de
DNS ASK mx##.#spgateway.de
DNS ASK ho##ail.fr
DNS ASK eu#.###.#rotection.outlook.com
DNS ASK fa###mail.com
DNS ASK fa###ncr.com
DNS ASK sm##.##cureserver.net
DNS ASK ha###roeder.de
DNS ASK mx#######e03.gslb.pphosted.com
DNS ASK ku####-pflege.de
DNS ASK fa#####restcapital.com
DNS ASK go###email.com
DNS ASK gmail-smtp-in.l.google.com
DNS ASK mx####.carrierzone.com
DNS ASK fa###gfish.com
DNS ASK ex####nkcargo.com
DNS ASK f2##0.com
DNS ASK 19#.###.211.95.in-addr.arpa
DNS ASK fa###ebnet.it
DNS ASK 19#.###.#11.95.dnsbl.sorbs.net
DNS ASK 19#.###.#11.95.bl.spamcop.net
DNS ASK mx#.##stwebnet.it
DNS ASK 19#.###.#11.95.zen.spamhaus.org
DNS ASK 19#.###.##1.95.sbl-xbl.spamhaus.org
DNS ASK li##ro.it
DNS ASK sm####n.libero.it
DNS ASK 19#.###.#11.95.cbl.abuseat.org
DNS ASK ad##ess.com
DNS ASK ma####.mailtwo.com
DNS ASK ya##o.com
DNS ASK mt##.##0.yahoodns.net
DNS ASK fr##net.de
DNS ASK em##.freenet.de
DNS ASK ho##ail.com
DNS ASK ho#########.olc.protection.outlook.com
DNS ASK vi##ilio.it
DNS ASK sm####n.virgilio.it
DNS ASK ex####ntware.com
DNS ASK alt2.aspmx.l.google.com
DNS ASK fo##########.mail.protection.outlook.com
DNS ASK fa##hon.com
DNS ASK fa####nassoc.com
DNS ASK fi####arwheels.com
DNS ASK ma##.##vestarwheels.com
DNS ASK ca###one.net
DNS ASK mx.##bleone.net
DNS ASK fj###cedes.com
DNS ASK mx#.###733-5.iphmx.com
DNS ASK gr####annoni.com
DNS ASK cl#####an3.ilger.com
DNS ASK gm##l.com
DNS ASK fo###tle.com
DNS ASK fl###elec.com
DNS ASK fl###dabt.com
DNS ASK fl##########m.mail.protection.outlook.com
DNS ASK ti##ali.it
DNS ASK ti#.it
DNS ASK sm##.tin.it
DNS ASK ho##ail.it
DNS ASK fl#####oglipranch.com
DNS ASK fo#####nconsulting.com
DNS ASK fo####sssteel.com
DNS ASK ms#####p-mx1.hinet.net
DNS ASK fi#####oicelocators.com
DNS ASK cl######.eu.messagelabs.com
DNS ASK ms#.#inet.net
DNS ASK fi###orp.com
DNS ASK bb###ugsburg.de
DNS ASK mx##.##ndenserver.de
DNS ASK al##oper.de
DNS ASK ma###n1.rmx.de
DNS ASK fd##.com
DNS ASK mx###.in-mx.com
DNS ASK cp.###meketa.edu
DNS ASK aspmx.l.google.com
DNS ASK ma##.b-io.co
DNS ASK fe####.port5.com
DNS ASK cx#.##.#.cloudfilter.net
DNS ASK sp.#####sonconstruction.com
DNS ASK d9#####.##s.barracudanetworks.com
DNS ASK pb##ail.org
DNS ASK mx##.1and1.com
DNS ASK google.com
DNS ASK fh##and.com
DNS ASK mx#.####bridge.iphmx.com
DNS ASK fi###rlando.com
DNS ASK fi##########com.mail.protection.outlook.com
DNS ASK fe######construction.com
DNS ASK ma##.##ubionassoc.com
DNS ASK ff.com
'<DNS_SERVER>':53

Miscellaneous

Creates and executes the following

'<SYSTEM32>\aleimeqy\bivvyjbw.exe' /d"<Full path to file>"
'<SYSTEM32>\cmd.exe' /C mkdir <SYSTEM32>\aleimeqy\' (with hidden window)
'<SYSTEM32>\cmd.exe' /C move /Y "%TEMP%\bivvyjbw.exe" <SYSTEM32>\aleimeqy\' (with hidden window)
'<SYSTEM32>\sc.exe' create aleimeqy binPath= "<SYSTEM32>\aleimeqy\bivvyjbw.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"' (with hidden window)
'<SYSTEM32>\sc.exe' description aleimeqy "wifi internet conection"' (with hidden window)
'<SYSTEM32>\sc.exe' start aleimeqy' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /C mkdir <SYSTEM32>\aleimeqy\
'<SYSTEM32>\cmd.exe' /C move /Y "%TEMP%\bivvyjbw.exe" <SYSTEM32>\aleimeqy\
'<SYSTEM32>\sc.exe' create aleimeqy binPath= "<SYSTEM32>\aleimeqy\bivvyjbw.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"
'<SYSTEM32>\sc.exe' description aleimeqy "wifi internet conection"
'<SYSTEM32>\sc.exe' start aleimeqy
'<SYSTEM32>\svchost.exe'

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial