Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '5cd8f17f4086744065eb0992a09e05a2' = '"%TEMP%\Trojan.exe" ..'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '5cd8f17f4086744065eb0992a09e05a2' = '"%TEMP%\Trojan.exe" ..'
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\5cd8f17f4086744065eb0992a09e05a2.exe
Malicious functions:
Creates and executes the following:
- '%TEMP%\283.exe'
- '%TEMP%\Trojan.exe'
- '%TEMP%\2.exe'
- '%TEMP%\1.exe'
Executes the following:
- '<SYSTEM32>\netsh.exe' firewall add allowedprogram "%TEMP%\Trojan.exe" "Trojan.exe" ENABLE
Modifies file system :
Creates the following files:
- %TEMP%\283.exe
- %TEMP%\Trojan.exe
- %TEMP%\2.cfg
- %TEMP%\1.exe
- %TEMP%\2.exe
Network activity:
UDP:
- DNS ASK 80.#.#.10.in-addr.arpa
- DNS ASK 81.#.#.10.in-addr.arpa
- DNS ASK 82.#.#.10.in-addr.arpa
- DNS ASK 77.#.#.10.in-addr.arpa
- DNS ASK 78.#.#.10.in-addr.arpa
- DNS ASK 79.#.#.10.in-addr.arpa
- DNS ASK 83.#.#.10.in-addr.arpa
- DNS ASK 89.#.#.10.in-addr.arpa
- DNS ASK 87.#.#.10.in-addr.arpa
- DNS ASK 84.#.#.10.in-addr.arpa
- DNS ASK 86.#.#.10.in-addr.arpa
- DNS ASK 88.#.#.10.in-addr.arpa
- DNS ASK 85.#.#.10.in-addr.arpa
- DNS ASK 67.#.#.10.in-addr.arpa
- DNS ASK 70.#.#.10.in-addr.arpa
- DNS ASK 68.#.#.10.in-addr.arpa
- DNS ASK 65.#.#.10.in-addr.arpa
- DNS ASK 63.#.#.10.in-addr.arpa
- DNS ASK 66.#.#.10.in-addr.arpa
- DNS ASK 72.#.#.10.in-addr.arpa
- DNS ASK 74.#.#.10.in-addr.arpa
- DNS ASK 75.#.#.10.in-addr.arpa
- DNS ASK 76.#.#.10.in-addr.arpa
- DNS ASK 71.#.#.10.in-addr.arpa
- DNS ASK 69.#.#.10.in-addr.arpa
- DNS ASK 73.#.#.10.in-addr.arpa
- DNS ASK 90.#.#.10.in-addr.arpa
- DNS ASK 14#.#.#.10.in-addr.arpa
- DNS ASK 20#.#.#.10.in-addr.arpa
- DNS ASK 18#.#.#.10.in-addr.arpa
- DNS ASK 16#.#.#.10.in-addr.arpa
- DNS ASK 17#.#.#.10.in-addr.arpa
- DNS ASK 15#.#.#.10.in-addr.arpa
- DNS ASK 19#.#.#.10.in-addr.arpa
- DNS ASK 24#.#.#.10.in-addr.arpa
- DNS ASK 25#.#.#.10.in-addr.arpa
- DNS ASK ki#.#o-ip.biz
- DNS ASK 21#.#.#.10.in-addr.arpa
- DNS ASK 22#.#.#.10.in-addr.arpa
- DNS ASK 23#.#.#.10.in-addr.arpa
- DNS ASK 94.#.#.10.in-addr.arpa
- DNS ASK 95.#.#.10.in-addr.arpa
- DNS ASK 96.#.#.10.in-addr.arpa
- DNS ASK 91.#.#.10.in-addr.arpa
- DNS ASK 92.#.#.10.in-addr.arpa
- DNS ASK 93.#.#.10.in-addr.arpa
- DNS ASK 97.#.#.10.in-addr.arpa
- DNS ASK 11#.#.#.10.in-addr.arpa
- DNS ASK 12#.#.#.10.in-addr.arpa
- DNS ASK 13#.#.#.10.in-addr.arpa
- DNS ASK 98.#.#.10.in-addr.arpa
- DNS ASK 99.#.#.10.in-addr.arpa
- DNS ASK 10#.#.#.10.in-addr.arpa
- DNS ASK 18.#.#.10.in-addr.arpa
- DNS ASK 24.#.#.10.in-addr.arpa
- DNS ASK 56.#.#.10.in-addr.arpa
- DNS ASK 49.#.#.10.in-addr.arpa
- DNS ASK 5.#.#.#0.in-addr.arpa
- DNS ASK 30.#.#.10.in-addr.arpa
- DNS ASK 39.#.#.10.in-addr.arpa
- DNS ASK 27.#.#.10.in-addr.arpa
- DNS ASK 34.#.#.10.in-addr.arpa
- DNS ASK 25.#.#.10.in-addr.arpa
- DNS ASK 29.#.#.10.in-addr.arpa
- DNS ASK 19.#.#.10.in-addr.arpa
- DNS ASK 47.#.#.10.in-addr.arpa
- DNS ASK 3.#.#.#0.in-addr.arpa
- DNS ASK 13.#.#.10.in-addr.arpa
- DNS ASK 4.#.#.#0.in-addr.arpa
- DNS ASK 11.#.#.10.in-addr.arpa
- DNS ASK 6.#.#.#0.in-addr.arpa
- DNS ASK 10.#.#.10.in-addr.arpa
- DNS ASK 1.#.#.#0.in-addr.arpa
- DNS ASK 21.#.#.10.in-addr.arpa
- DNS ASK 53.#.#.10.in-addr.arpa
- DNS ASK 12.#.#.10.in-addr.arpa
- DNS ASK 22.#.#.10.in-addr.arpa
- DNS ASK 9.#.#.#0.in-addr.arpa
- DNS ASK 14.#.#.10.in-addr.arpa
- DNS ASK 48.#.#.10.in-addr.arpa
- DNS ASK 43.#.#.10.in-addr.arpa
- DNS ASK 44.#.#.10.in-addr.arpa
- DNS ASK 41.#.#.10.in-addr.arpa
- DNS ASK 32.#.#.10.in-addr.arpa
- DNS ASK 52.#.#.10.in-addr.arpa
- DNS ASK 31.#.#.10.in-addr.arpa
- DNS ASK 57.#.#.10.in-addr.arpa
- DNS ASK 61.#.#.10.in-addr.arpa
- DNS ASK 62.#.#.10.in-addr.arpa
- DNS ASK 64.#.#.10.in-addr.arpa
- DNS ASK 60.#.#.10.in-addr.arpa
- DNS ASK 58.#.#.10.in-addr.arpa
- DNS ASK 59.#.#.10.in-addr.arpa
- DNS ASK 23.#.#.10.in-addr.arpa
- DNS ASK 28.#.#.10.in-addr.arpa
- DNS ASK 55.#.#.10.in-addr.arpa
- DNS ASK 36.#.#.10.in-addr.arpa
- DNS ASK 20.#.#.10.in-addr.arpa
- DNS ASK 35.#.#.10.in-addr.arpa
- DNS ASK 26.#.#.10.in-addr.arpa
- DNS ASK 45.#.#.10.in-addr.arpa
- DNS ASK 40.#.#.10.in-addr.arpa
- DNS ASK 38.#.#.10.in-addr.arpa
- DNS ASK 33.#.#.10.in-addr.arpa
- DNS ASK 37.#.#.10.in-addr.arpa
- DNS ASK 17.#.#.10.in-addr.arpa
Miscellaneous:
Searches for the following windows:
- ClassName: 'Indicator' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'EDIT' WindowName: '(null)'
