Trojan.Encoder.350

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] '*CryptoLocker' = '<LS_APPDATA>\Oonofhfghahtjdtr.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'CryptoLocker' = '<LS_APPDATA>\Oonofhfghahtjdtr.exe'

Malicious functions:

Creates and executes the following:

'<LS_APPDATA>\Oonofhfghahtjdtr.exe' -w108
'<LS_APPDATA>\Oonofhfghahtjdtr.exe' "-r<Full path to virus>"

Executes the following:

'<SYSTEM32>\wermgr.exe' "-outproc" "836" "4124"
'<SYSTEM32>\wermgr.exe' -queuereporting

Modifies file system :

Creates the following files:

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_80072f78_805ff6e6daf5fedbb13daf2b1d56b5cbd7ea195_cab_0dcca0e0\client_manifest.txt
%WINDIR%\Temp\OutofProcReport1090937.txt
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_7.6.7600.256_d2caf64b7dbca2d781154d2562964c262846251_cab_0df4a784\Report.wer
<LS_APPDATA>\Oonofhfghahtjdtr.exe
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\home[1].htm

Sets the 'hidden' attribute to the following files:

<LS_APPDATA>\Oonofhfghahtjdtr.exe

Deletes the following files:

%WINDIR%\Temp\OutofProcReport1090937.txt
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\home[1].htm

Deletes itself.

Network activity:

Connects to:

'nk####ogaspb.net':80
'pp####gatlva.biz':80
'mu####ibglen.com':80
'km####udadvm.co.uk':80
'lc####bitkha.info':80
'th####vulujw.info':80
'hj####jcyfvk.com':80
'ew####ofiwyk.co.uk':80
'dr###uthhvin.ru':80
'qu####bxummw.org':80
'px####iamgot.co.uk':80
'ec####rkysxd.info':80
'ct####emskpc.org':80
'ce####qpfuwx.biz':80
'pi###fudyqvp.ru':80
'kw###ohgmndi.ru':80
'lm####nlguov.org':80
'je####anamgu.biz':80
'rg####vxsowu.com':80
'io####tigfuh.net':80
'20#.#6.232.182':80
'xm####bbkfwa.info':80
'jg####kepste.co.uk':80
've####gqloli.org':80
'download.windowsupdate.com':80
'ce###bqvcokw.ru':80
'pg####ujgsss.org':80
'nx####ayhchb.biz':80
'lo####foojfv.com':80
'av####vldxyf.net':80
'ui####qdgbtj.org':80
'ua####vytetk.co.uk':80
'tu###bbbsddn.ru':80
'um####qsmvat.net':80
'io####eaagmh.biz':80
'yr####ltlnhh.biz':80
'af###nbvylxd.ru':80
'ya####gxxkhg.net':80
'vn####lbhckg.info':80
'xm####qvkmqk.com':80
'na####hfsino.net':80
'bh####eymjjp.biz':80
'ol###mimgfih.ru':80
'md####nchowp.net':80
'kt####fsiufj.info':80
'yy####jonsxx.com':80
'gx####xbpyxp.com':80
'hr####afulei.net':80
'fi####rvvrmc.info':80
'da####wlwbbk.org':80
'ep####dqqimx.co.uk':80
'bd####aajbmt.info':80
'cs####pcadgl.com':80
'yg####hgdttk.co.uk':80
'gt####vkdxricgl.biz':80
'xq####remras.org':80
'il####kijetr.org':80
'wp####bfoygr.co.uk':80
'uh###qgupiua.ru':80
'ci####uxkcdq.net':80
'dx####kabewi.biz':80
'df####hrdltn.net':80
'eu####wttnnf.biz':80
'dp####jclytr.com':80
'ko####frghna.co.uk':80
'ca####tauwaa.info':80
'gs####xonlok.info':80
'av####drymow.com':80
'fd####imwjus.co.uk':80
'ex###vuuoubf.ru':80
'fn####kwfwuw.org':80
'th####dxnect.co.uk':80
'hl####qfeush.info':80
'kp####bunjbn.org':80
'ih####gkospv.biz':80
'ja###vuptcpa.ru':80
'jj###praxstm.ru':80
'wk####rkpqwm.org':80
'vf####eshcdy.biz':80
'um####qpvsvh.com':80
'iq####ewmjmu.net':80

UDP:

DNS ASK nk####ogaspb.net
DNS ASK pp####gatlva.biz
DNS ASK mu####ibglen.com
DNS ASK km####udadvm.co.uk
DNS ASK lc####bitkha.info
DNS ASK th####vulujw.info
DNS ASK hj####jcyfvk.com
DNS ASK ew####ofiwyk.co.uk
DNS ASK dr###uthhvin.ru
DNS ASK qu####bxummw.org
DNS ASK px####iamgot.co.uk
DNS ASK ec####rkysxd.info
DNS ASK ct####emskpc.org
DNS ASK ce####qpfuwx.biz
DNS ASK pi###fudyqvp.ru
DNS ASK kw###ohgmndi.ru
DNS ASK lm####nlguov.org
DNS ASK je####anamgu.biz
DNS ASK rg####vxsowu.com
DNS ASK io####tigfuh.net
DNS ASK um####qsmvat.net
DNS ASK xm####bbkfwa.info
DNS ASK lo####foojfv.com
DNS ASK do#####d.microsoft.com
DNS ASK download.windowsupdate.com
DNS ASK jg####kepste.co.uk
DNS ASK ce###bqvcokw.ru
DNS ASK pg####ujgsss.org
DNS ASK nx####ayhchb.biz
DNS ASK www.up####.microsoft.com
DNS ASK av####vldxyf.net
DNS ASK ua####vytetk.co.uk
DNS ASK vn####lbhckg.info
DNS ASK ui####qdgbtj.org
DNS ASK io####eaagmh.biz
DNS ASK tu###bbbsddn.ru
DNS ASK af###nbvylxd.ru
DNS ASK ve####gqloli.org
DNS ASK yr####ltlnhh.biz
DNS ASK xm####qvkmqk.com
DNS ASK ya####gxxkhg.net
DNS ASK bh####eymjjp.biz
DNS ASK ol###mimgfih.ru
DNS ASK md####nchowp.net
DNS ASK kt####fsiufj.info
DNS ASK yy####jonsxx.com
DNS ASK gx####xbpyxp.com
DNS ASK hr####afulei.net
DNS ASK fi####rvvrmc.info
DNS ASK da####wlwbbk.org
DNS ASK ep####dqqimx.co.uk
DNS ASK bd####aajbmt.info
DNS ASK cs####pcadgl.com
DNS ASK yg####hgdttk.co.uk
DNS ASK gt####vkdxricgl.biz
DNS ASK xq####remras.org
DNS ASK il####kijetr.org
DNS ASK wp####bfoygr.co.uk
DNS ASK uh###qgupiua.ru
DNS ASK ci####uxkcdq.net
DNS ASK dx####kabewi.biz
DNS ASK ih####gkospv.biz
DNS ASK eu####wttnnf.biz
DNS ASK ex###vuuoubf.ru
DNS ASK df####hrdltn.net
DNS ASK ca####tauwaa.info
DNS ASK dp####jclytr.com
DNS ASK av####drymow.com
DNS ASK na####hfsino.net
DNS ASK gs####xonlok.info
DNS ASK fn####kwfwuw.org
DNS ASK fd####imwjus.co.uk
DNS ASK hl####qfeush.info
DNS ASK um####qpvsvh.com
DNS ASK th####dxnect.co.uk
DNS ASK ja###vuptcpa.ru
DNS ASK kp####bunjbn.org
DNS ASK wk####rkpqwm.org
DNS ASK ko####frghna.co.uk
DNS ASK jj###praxstm.ru
DNS ASK iq####ewmjmu.net
DNS ASK vf####eshcdy.biz

Miscellaneous:

Searches for the following windows:

ClassName: 'Indicator' WindowName: '(null)'

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial