Trojan.DownLoader35.6038

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKCU>\software\microsoft\windows\currentversion\run] 'porizegfipo' = '%HOMEPATH%\porizegfipo.exe'
[<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'Regedit32' = '<SYSTEM32>\regedit.exe'

Malicious functions

Injects code into

the following system processes:

%WINDIR%\syswow64\svchost.exe

Modifies file system

Creates the following files

%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\c5d8393293ce2ba62f117b2c2d55bc3e_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%HOMEPATH%\porizegfipo.exe

Sets the 'hidden' attribute to the following files

%HOMEPATH%\porizegfipo.exe

Network activity

Connects to

'zu##eil.com':80

TCP

HTTP POST requests

http://www.sy##tik.net/
http://www.hu##er.hu/
http://www.ab##.com/
http://www.da##o.com/
http://www.fe##auer.de/
http://ho##-ai.com/
http://www.11##chi.net/
http://ge##l.com/
http://cp##b.com/
http://ka##am.com/
http://www.yu###skor.kz/
http://www.pd###mes.com/
http://www.xa##om.es/
http://dy###eng.com/
http://www.me##us.si/
http://www.ex###ive.com/
http://da###nir.com/
http://www.cr##i.org/
http://ze###mot.net/
http://mc###rope.nl/
http://xi##ui.net/
http://ca###nly.com/
http://www.tc##.com/
http://ha##ker.net/
http://sh###gts.net/
http://www.it##-pr.com/
http://www.st##c.co.uk/
http://mk##gr.com/
http://li###l.co.jp/
http://pe###s.co.uk/
http://www.ot##spm.com/
http://fd##mca.org/
http://www.h-#.net/
http://cp##eam.com/
http://am##e.com/
http://www.jc##sk.com/
http://60##88.com/
http://no##esse.be/
http://www.c9##.com/
http://t-##ust.jp/
http://oo###anj.com/
http://www.2p##nt.com/
http://ca###fix.com/
http://av#e.hu/
http://k-##kko.com/
http://to##do.net/
http://ds##ars.com/
http://www.tv##ols.fi/
http://h-##-l.com/
http://www.pb###mes.com/
http://hc##.org/
http://un##i.it/
http://vi###tay.com/
http://bg##.com/
http://un##us.jp/
http://as###eum.com/
http://oa##h.ca/
http://bi##e.org/
http://re###dia.net/
http://ku##avto.ru/
http://ne##le.pl/
http://www.ne##r.com/
http://to##hfam.ca/
http://ai###s-sa.gr/
http://www.cr###.edu.pl/
http://do##jog.net/
http://cy##ad.pl/
http://bi##oll.com/
http://www.fi##.com/
http://si###ann.com/
http://yo###sut.com/
http://www.dg##a.com/
http://cb##en.com/
http://www.co##sit.com/
http://gr##wcc.com/
http://so##wan.net/
http://jo###yon.org/
http://www.ph##o4b.com/
http://sh##tas.com/
http://wv##net.de/
http://www.de##lo.com/
http://us##r.com/
http://www.mq#.com.br/
http://www.do##n.com/
http://www.ab##t.pl/
http://www.ot##a.com/
http://www.co###oko.com/
http://www.pu#i.cz/
http://www.tr###sib.com/
http://www.nq##.com/
http://www.wa##i.pl/
http://www.va##r.se/
http://www.ol##s.com/
http://www.ja##mfg.com/
http://www.sj##.org/
http://www.sn##pak.com/
http://www.ev##a.com/
http://www.gp##ink.com/
http://www.va###lit.com/
http://www.nu###ira.com/
http://www.sc###er3.com/
http://www.wi##4all.nl/
http://www.ka###-me.com/
http://www.ed##art.hu/
http://www.po###ood.com/
http://www.ty##s.com/
http://www.or##ito.com/
http://www.my##pcb.com/
http://www.va##al.com/
http://www.fc##vt.org/
http://www.sp##esi.com/
http://www.yo###sut.com/
http://www.lr##k.com/
http://www.na##-a.com/
http://www.rs##g.com/
http://www.al##or.cl/
http://www.fi##bc.com/
http://www.ke###afe.com/
http://www.or#.#cnet.jp/
http://www.sp###hal.net/
http://www.t-##e.com/
http://www.ba##aku.com/
http://sl###port.ru/
http://www.wk##.net/
http://bt##.com.ph/
http://ne##no.net/
http://ao##ko.net/
http://ht##x.net/
http://se##k.com/
http://ok###imo.com/
http://www.me##sa.info/
http://sh##fit.com/
http://sa###tek.net/
http://cv##l.org/
http://sh###ble.com/
http://so###zer.com/
http://to##oil.com/
http://gy##ozo.ru/
http://wa##apc.net/
http://ak##niz.nl/
http://e-##mi.net/
http://fu##eo.com/
http://ca##mat.com/
http://nr##.com/
http://www.fn##s.org/
http://www.ce##cpa.com/
http://www.fn#.us/
http://www.st##um.com/
http://www.ma###axx.com/
http://www.ho##eman.us/
http://www.ae##a.com/
http://www.ia##irt.com/
http://www.x0#.com/
http://wa##a.com/
http://th##ark.org/
http://pl##ke.ua/
http://cu###own.com/
http://jn#.at/
http://cc##inc.com/
http://pc##.net/
http://www.pw#.org/
http://ko##e.com/
http://ba##ari.com/

'un##i.it':25

's5#.com':25

'ho#t.do':25

'ne##.co.uk':25

'bg##.com':25

'pa##ski.org':25

'am###for.com':25

'dz#.cz':25

'cn##.krsn.ru':25

'ze###mot.net':25

'ep#.com.au':25

'pe###s.co.uk':25

'nm#.co.jp':25

UDP

DNS ASK sy##tik.net
DNS ASK es##ke.net
DNS ASK ha##ker.net
DNS ASK re##ntl.org
DNS ASK st##c.co.uk
DNS ASK pe###s.co.uk
DNS ASK no##esse.be
DNS ASK 60##88.com
DNS ASK ot##spm.com
DNS ASK ai###s-sa.gr
DNS ASK cp##eam.com
DNS ASK ci##sc.com
DNS ASK sl###port.ru
DNS ASK am##e.com
DNS ASK jc##sk.com
DNS ASK xi##ui.net
DNS ASK ze###mot.net
DNS ASK to##do.net
DNS ASK mc###rope.nl
DNS ASK cp##b.com
DNS ASK ho##-ai.com
DNS ASK 11##chi.net
DNS ASK eo##i.com
DNS ASK ge##l.com
DNS ASK ab##.com
DNS ASK wv##net.de
DNS ASK tc##.com
DNS ASK sh###gts.net
DNS ASK us##r.com
DNS ASK re##oar.com
DNS ASK bt##.com.ph
DNS ASK se##k.com
DNS ASK ds##ars.com
DNS ASK do##jog.net
DNS ASK e-##mi.net
DNS ASK sa###tek.net
DNS ASK cv##l.org
DNS ASK ak##niz.nl
DNS ASK ft##at.com
DNS ASK ac##in.com
DNS ASK ow##orts.ca
DNS ASK hu##er.hu
DNS ASK h-#.net
DNS ASK wa##apc.net
DNS ASK si###ath.com
DNS ASK as###eum.com
DNS ASK so###zer.com
DNS ASK li###l.co.jp
DNS ASK ag###.com.br
DNS ASK ag###tex.com
DNS ASK ko##e.com
DNS ASK ul##bax.org
DNS ASK gy##ozo.ru
DNS ASK ca###nly.com
DNS ASK ar##x.com
DNS ASK me##sa.info
DNS ASK cn##.krsn.ru
DNS ASK jo###yon.org
DNS ASK da##o.com
DNS ASK fe##auer.de
DNS ASK oh##ya.com
DNS ASK so##wan.net
DNS ASK gp###dit.org
DNS ASK av#.com.sa
DNS ASK ac##loc.com
DNS ASK ph##o4b.com
DNS ASK ne##le.pl
DNS ASK ka##man.net
DNS ASK ku##avto.ru
DNS ASK pb###mes.com
DNS ASK h-##-l.com
DNS ASK k-##kko.com
DNS ASK av#e.hu
DNS ASK ud##ign.biz
DNS ASK tv##ols.fi
DNS ASK re###dia.net
DNS ASK 10##est.com
DNS ASK ru##e.com
DNS ASK we##y.com
DNS ASK vi###tay.com
DNS ASK un##us.jp
DNS ASK cq###oup.com
DNS ASK oa##h.ca
DNS ASK oo###anj.com
DNS ASK li###gds.com
DNS ASK ba##ari.com
DNS ASK co##sit.com
DNS ASK jr##.net
DNS ASK ak#.co.id
DNS ASK ne##r.com
DNS ASK ex###ive.com
DNS ASK t-##ust.jp
DNS ASK da###nir.com
DNS ASK ka##am.com
DNS ASK pd###mes.com
DNS ASK yu###skor.kz
DNS ASK cr##i.org
DNS ASK dy###eng.com
DNS ASK xa##om.es
DNS ASK me##us.si
DNS ASK c9##.com
DNS ASK de##lo.com
DNS ASK zu##eil.com
DNS ASK cb##en.com
DNS ASK 2p##nt.com
DNS ASK to##hfam.ca
DNS ASK si###ann.com
DNS ASK cr###.edu.pl
DNS ASK bi##e.org
DNS ASK ra##ich.de
DNS ASK fi##.com
DNS ASK bi##oll.com
DNS ASK ms###ock.com
DNS ASK ep#.com.au
DNS ASK nm#.co.jp
DNS ASK cl##ma.com
DNS ASK dg##a.com
DNS ASK vi###ndu.com
DNS ASK ht##x.net
DNS ASK to##oil.com
DNS ASK va##r.se
DNS ASK nu###ira.com
DNS ASK va###lit.com
DNS ASK ja##mfg.com
DNS ASK sj##.org
DNS ASK ol##s.com
DNS ASK gp##ink.com
DNS ASK sn##pak.com
DNS ASK us##ig.com
DNS ASK ev##a.com
DNS ASK t-##e.com
DNS ASK lr##k.com
DNS ASK pe##fan.com
DNS ASK it##-pr.com
DNS ASK mq#.com.br
DNS ASK ko##.net
DNS ASK wk##.net
DNS ASK ia##irt.com
DNS ASK fn##s.org
DNS ASK ce##cpa.com
DNS ASK st##um.com
DNS ASK fn#.us
DNS ASK ma###axx.com
DNS ASK ae##a.com
DNS ASK ot##a.com
DNS ASK tr###sib.com
DNS ASK ab##t.pl
DNS ASK pu#i.cz
DNS ASK do##n.com
DNS ASK ty##s.com
DNS ASK po###ood.com
DNS ASK sp##esi.com
DNS ASK ed##art.hu
DNS ASK or##ito.com
DNS ASK ve##om.com
DNS ASK va##al.com
DNS ASK fc##vt.org
DNS ASK yo###sut.com
DNS ASK na##-a.com
DNS ASK ra###ook.net
DNS ASK ho##eman.us
DNS ASK ba##aku.com
DNS ASK sp###hal.net
DNS ASK fi##bc.com
DNS ASK or#.#cnet.jp
DNS ASK ka###-me.com
DNS ASK al##or.cl
DNS ASK ke###afe.com
DNS ASK el##o.si
DNS ASK nq##.com
DNS ASK sc###er3.com
DNS ASK wa##i.pl
DNS ASK wi##4all.nl
DNS ASK co###oko.com
DNS ASK my##pcb.com
DNS ASK rs##g.com
DNS ASK x0#.com
DNS ASK mx#.mail.ru
DNS ASK alt4.gmail-smtp-in.l.google.com
DNS ASK ra#t.se
DNS ASK gr##wcc.com
DNS ASK ne##no.net
DNS ASK nb##wis.com
DNS ASK ma##ek.com
DNS ASK th##ark.org
DNS ASK ao##ko.net
DNS ASK fu##eo.com
DNS ASK pl##ke.ua
DNS ASK av##win.com
DNS ASK we##and.com
DNS ASK cc##inc.com
DNS ASK jn#.at
DNS ASK cy##ad.pl
DNS ASK nr##.com
DNS ASK cu###own.com
DNS ASK mk##gr.com
DNS ASK tc##a.com
DNS ASK ok###imo.com
DNS ASK ca##ore.com
DNS ASK mo##opp.net
DNS ASK an##ph.org
DNS ASK pc##.net
DNS ASK sh##tas.com
DNS ASK ca##mat.com
DNS ASK sh###ble.com
DNS ASK nt##at.com
DNS ASK ca###fix.com
DNS ASK wa##a.com
DNS ASK am###for.com
DNS ASK pw#.org
DNS ASK gmail-smtp-in.l.google.com
DNS ASK in#.####.messagingengine.com
DNS ASK ma###.##gitalwaves.co.nz
DNS ASK un##i.it
DNS ASK zu##aha.cz
DNS ASK sh##fit.com
DNS ASK ik##ani.com
DNS ASK ho#t.do
DNS ASK mi##sh3.com
DNS ASK an##s.net
DNS ASK s5#.com
DNS ASK fl##pis.com
DNS ASK mi##nue.com
DNS ASK ym##15.net
DNS ASK sl##er.it
DNS ASK n2###ina.com
DNS ASK hc##.org
DNS ASK rk##gg.com
DNS ASK an##ran.com
DNS ASK ne##.co.uk
DNS ASK sm##ko.net
DNS ASK bg##.com
DNS ASK pa##ski.org
DNS ASK fd##mca.org
DNS ASK dz#.cz
DNS ASK li##c.co.uk
DNS ASK fi###ews.com

Miscellaneous

Executes the following

'%WINDIR%\syswow64\svchost.exe'

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial