Trojan.DownLoader10.14028

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'CryptoLocker' = '%APPDATA%\Roaming\{251D6684-2103-0713-3D1A-143F3922242B}.exe'

Malicious functions:

Creates and executes the following:

'%APPDATA%\Roaming\{251D6684-2103-0713-3D1A-143F3922242B}.exe' /w000000A0
'%APPDATA%\Roaming\{251D6684-2103-0713-3D1A-143F3922242B}.exe' "/r<Full path to virus>"

Modifies file system :

Creates the following files:

%APPDATA%\Roaming\{251D6684-2103-0713-3D1A-143F3922242B}.exe

Sets the 'hidden' attribute to the following files:

%APPDATA%\Roaming\{251D6684-2103-0713-3D1A-143F3922242B}.exe

Deletes itself.

Network activity:

Connects to:

'we####hbdqno.co.uk':80
'vq####rvppxb.org':80
'xf####inrtkp.com':80
'wr####siesuc.info':80
'hd####xfjaeh.net':80
'tb####krvjql.com':80
'ie###byrxdbi.ru':80
'uc####lekmnm.biz':80
'tv####aohkrf.info':80
'gt####vhkntr.co.uk':80
'va####bntfrs.net':80
'ix####wgwitf.com':80
'yt####xmgwou.biz':80
'xg####ihsvyh.net':80
'au####yyualv.org':80
'yh###ijthyvi.ru':80
'go####iguwac.info':80
'lq####inxfdsn.net':80
'bs####egwmoum.com':80
'mr####dowokfn.ru':80
'ys####vjhkobn.biz':80
'xy####klfxein.org':80
'yd####dlpgcxi.ru':80
'ad####xmyjrqe.info':80
'yo####qfdbbmm.co.uk':80
'rl###itgsdpf.ru':80
'du####lyakcu.biz':80
'sm####ushgmg.co.uk':80
'fn####htgtdb.org':80
'pa####xifrqxr.co.uk':80
'at####qkgtvne.org':80
'ch####fwddwy.net':80
'bq####dmhfhp.com':80
'fc####jplmktok.ru':80
'fm####kbbxsqwp.biz':80
'io#####fyfvrsm.co.uk':80
'gr####fycyjnna.org':80
'bk####tbryjyam.info':80
'nj#####rhewrsf.co.uk':80
'ew####orkltwoq.net':80
'oo####npifnoqt.com':80
'ek####sqmfijvx.org':80
'pg####ibhaplvn.ru':80
'gt####ytciymxd.info':80
'ro#####lgqbdve.co.uk':80
'jt####kdagmoay.com':80
'je####loprulbs.info':80
'cc####xgnowrfq.biz':80
'kj####gmqsliyv.net':80
'af####ydqxscsl.org':80
'lm####akehrb.com':80
'ky####tihamf.info':80
'nq####bjqcro.biz':80
'md####uhtums.net':80
'vl###iqakqsl.ru':80
'ij####msntux.biz':80
'xp####rywlsy.co.uk':80
'kn####nraoul.org':80
'jr####reskuwai.net':80
'vn####xpceqhav.com':80
'kw####mctlltqe.ru':80
'ws####sndfheae.biz':80
'nc####qvhnsh.org':80
'mo###sktkgnl.ru':80
'pg####rutisu.info':80
'os####lswbny.co.uk':80
'xn####wrrdfta.biz':80
'xw####adrsdpk.com':80
'xl####upfgopl.info':80
'ys####xpsrvxw.biz':80
'ym####pqepvcj.net':80
'tn####wjgdvjy.ru':80
'tc####rvtqhjh.biz':80
'wv####fcsjvdd.co.uk':80
'ud####mwsaovx.org':80
'fg####vqbgtdn.net':80
'qg####ficidqg.com':80
'hl####vfqmwkl.ru':80
'sk####apyhtpn.biz':80
'bw####swpqmwn.org':80
'mw####coqsvkn.ru':80
'dc####bjehdep.info':80
'ob####wvnrmjn.co.uk':80
'sm####cihtowy.net':80
'tg####aoxbpbg.org':80
'ss####tjtjunh.ru':80
'vo####npmpirg.info':80
'ub####hkixnex.co.uk':80
'rq####igupjdg.com':80
'18#.#64.136.134':80
'ty####vhjectn.biz':80
'sl####pcfmhgf.net':80
'ch####uthjuda.co.uk':80
'od####hxuoqya.org':80
'di####pugscpx.com':80
'pe####cytxxlh.info':80
'xx####ravtnwh.net':80
'kt####eejyjsh.com':80
'yy####mbudujx.ru':80
'lu####yfiiqfh.biz':80
'lq####ttevvvk.co.uk':80
'kb####egrydjl.org':80
'bu####paxxqle.com':80
'nq####lbawqyn.info':80
'jb####sywpjyg.net':80
'il####dlksqmh.com':80
'kp####gfielst.ru':80
'ja####qrvhsgl.biz':80
'fo####evypqqe.info':80
'rk####awboqee.co.uk':80
'wy####pkvuopb.net':80
'vj####jqxrrlc.com':80
'dy####dbrjetl.biz':80
'pu####yctiehl.net':80
'dk####qufedie.org':80
'pg####mvhddvn.ru':80
'ia####fkbxyvi.info':80
'ny####tgybupn.biz':80
'mk####fsafbuo.net':80
'yr####rsqgbfi.org':80
'oo####aawertv.ru':80
'jp####qmnlnjc.co.uk':80
'ib####cyoptok.org':80
'lu####yycceqp.com':80
'kf####wgloknk.info':80
'ci####gctexfi.ru':80
'ol####gjkhrgi.biz':80
'hk####pwobgja.co.uk':80
'pm####txgycjy.org':80
'as####fhmxlip.info':80
'mv####fodbfji.co.uk':80
'bh####snxmnci.net':80
'nw####sdyspmg.com':80

UDP:

DNS ASK we####hbdqno.co.uk
DNS ASK vq####rvppxb.org
DNS ASK xf####inrtkp.com
DNS ASK wr####siesuc.info
DNS ASK hd####xfjaeh.net
DNS ASK tb####krvjql.com
DNS ASK ie###byrxdbi.ru
DNS ASK uc####lekmnm.biz
DNS ASK tv####aohkrf.info
DNS ASK gt####vhkntr.co.uk
DNS ASK va####bntfrs.net
DNS ASK ix####wgwitf.com
DNS ASK yt####xmgwou.biz
DNS ASK xg####ihsvyh.net
DNS ASK au####yyualv.org
DNS ASK yh###ijthyvi.ru
DNS ASK go####iguwac.info
DNS ASK lq####inxfdsn.net
DNS ASK bs####egwmoum.com
DNS ASK mr####dowokfn.ru
DNS ASK ys####vjhkobn.biz
DNS ASK xy####klfxein.org
DNS ASK yd####dlpgcxi.ru
DNS ASK ad####xmyjrqe.info
DNS ASK yo####qfdbbmm.co.uk
DNS ASK rl###itgsdpf.ru
DNS ASK du####lyakcu.biz
DNS ASK sm####ushgmg.co.uk
DNS ASK fn####htgtdb.org
DNS ASK pa####xifrqxr.co.uk
DNS ASK at####qkgtvne.org
DNS ASK ch####fwddwy.net
DNS ASK bq####dmhfhp.com
DNS ASK fc####jplmktok.ru
DNS ASK fm####kbbxsqwp.biz
DNS ASK io#####fyfvrsm.co.uk
DNS ASK gr####fycyjnna.org
DNS ASK bk####tbryjyam.info
DNS ASK nj#####rhewrsf.co.uk
DNS ASK ew####orkltwoq.net
DNS ASK oo####npifnoqt.com
DNS ASK ek####sqmfijvx.org
DNS ASK pg####ibhaplvn.ru
DNS ASK gt####ytciymxd.info
DNS ASK ro#####lgqbdve.co.uk
DNS ASK jt####kdagmoay.com
DNS ASK je####loprulbs.info
DNS ASK cc####xgnowrfq.biz
DNS ASK kj####gmqsliyv.net
DNS ASK af####ydqxscsl.org
DNS ASK lm####akehrb.com
DNS ASK ky####tihamf.info
DNS ASK nq####bjqcro.biz
DNS ASK md####uhtums.net
DNS ASK vl###iqakqsl.ru
DNS ASK ij####msntux.biz
DNS ASK xp####rywlsy.co.uk
DNS ASK kn####nraoul.org
DNS ASK jr####reskuwai.net
DNS ASK vn####xpceqhav.com
DNS ASK kw####mctlltqe.ru
DNS ASK ws####sndfheae.biz
DNS ASK nc####qvhnsh.org
DNS ASK mo###sktkgnl.ru
DNS ASK pg####rutisu.info
DNS ASK os####lswbny.co.uk
DNS ASK ym####pqepvcj.net
DNS ASK xw####adrsdpk.com
DNS ASK mw####coqsvkn.ru
DNS ASK ys####xpsrvxw.biz
DNS ASK ud####mwsaovx.org
DNS ASK tn####wjgdvjy.ru
DNS ASK xl####upfgopl.info
DNS ASK wv####fcsjvdd.co.uk
DNS ASK sk####apyhtpn.biz
DNS ASK fg####vqbgtdn.net
DNS ASK ib####cyoptok.org
DNS ASK hl####vfqmwkl.ru
DNS ASK ob####wvnrmjn.co.uk
DNS ASK bw####swpqmwn.org
DNS ASK qg####ficidqg.com
DNS ASK dc####bjehdep.info
DNS ASK tc####rvtqhjh.biz
DNS ASK ub####hkixnex.co.uk
DNS ASK tg####aoxbpbg.org
DNS ASK kt####eejyjsh.com
DNS ASK vo####npmpirg.info
DNS ASK sl####pcfmhgf.net
DNS ASK rq####igupjdg.com
DNS ASK ss####tjtjunh.ru
DNS ASK ty####vhjectn.biz
DNS ASK pe####cytxxlh.info
DNS ASK ch####uthjuda.co.uk
DNS ASK sm####cihtowy.net
DNS ASK di####pugscpx.com
DNS ASK lu####yfiiqfh.biz
DNS ASK xx####ravtnwh.net
DNS ASK od####hxuoqya.org
DNS ASK yy####mbudujx.ru
DNS ASK nq####lbawqyn.info
DNS ASK lq####ttevvvk.co.uk
DNS ASK pu####yctiehl.net
DNS ASK bu####paxxqle.com
DNS ASK ja####qrvhsgl.biz
DNS ASK jb####sywpjyg.net
DNS ASK kb####egrydjl.org
DNS ASK kp####gfielst.ru
DNS ASK vj####jqxrrlc.com
DNS ASK fo####evypqqe.info
DNS ASK xn####wrrdfta.biz
DNS ASK wy####pkvuopb.net
DNS ASK pg####mvhddvn.ru
DNS ASK dy####dbrjetl.biz
DNS ASK rk####awboqee.co.uk
DNS ASK dk####qufedie.org
DNS ASK il####dlksqmh.com
DNS ASK oo####aawertv.ru
DNS ASK ny####tgybupn.biz
DNS ASK mv####fodbfji.co.uk
DNS ASK yr####rsqgbfi.org
DNS ASK kf####wgloknk.info
DNS ASK jp####qmnlnjc.co.uk
DNS ASK mk####fsafbuo.net
DNS ASK lu####yycceqp.com
DNS ASK pm####txgycjy.org
DNS ASK ci####gctexfi.ru
DNS ASK ia####fkbxyvi.info
DNS ASK hk####pwobgja.co.uk
DNS ASK nw####sdyspmg.com
DNS ASK as####fhmxlip.info
DNS ASK ol####gjkhrgi.biz
DNS ASK bh####snxmnci.net

Miscellaneous:

Searches for the following windows:

ClassName: 'Indicator' WindowName: '(null)'

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial