Trojan.DownLoader11.20003

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'xapkexhydyha' = '%HOMEPATH%\xapkexhydyha.exe'

Modifies file system :

Creates the following files:

%APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\Preferred
%APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\c54b73b5-5416-49d7-90be-1209a977b4df
%APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\d20ac8c5-dc0b-4828-989b-cb9d64324b38
%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\ec702f375e1b12d218f67ab9ef19ca23_23ef5514-3059-436f-a4a7-4cefaab20eb1
%APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\6ba3f41a-1615-4f9d-bfdd-13274fcfb67d
%APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\99c11e38-13fa-46ea-96a9-8a78fe87cbcc
%APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\e0e0ac3d-eb03-46c5-a460-e850cb50e3ed
%APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\310d4f76-486c-43e0-a452-28762a32eb28
%HOMEPATH%\xapkexhydyha.exe
%APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\c1817398-9eae-4e3c-99aa-7a2a43d0bc3c
%APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\c01c6664-311f-41ef-bf80-317054e8a463
%APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\2ee5b171-3a16-401e-b614-467bfdfb59aa

Sets the 'hidden' attribute to the following files:

%HOMEPATH%\xapkexhydyha.exe

Network activity:

Connects to:

'sm##.live.com':25

UDP:

DNS ASK cs##.com
DNS ASK fu#####okconsulting.com
DNS ASK wh###pbell.com
DNS ASK ci###tokyo.com
DNS ASK ho####oyfull.com
DNS ASK sy#######ic-technologies.com
DNS ASK do###siding.com
DNS ASK se###-porn.com
DNS ASK bu######entrum-engelshof.de
DNS ASK na####currin.com
DNS ASK mm###ytek.cz
DNS ASK fl##hf.com
DNS ASK ru###-home.net
DNS ASK so#####erica-photo.com
DNS ASK tu###s.anv.pl
DNS ASK vi####iamonds.com
DNS ASK og##ust.jp
DNS ASK am#####ngeriatrics.org
DNS ASK os#f.ca
DNS ASK ny##k55.com
DNS ASK in###-lock.com
DNS ASK os####vogado.com.br
DNS ASK we###orlds.com
DNS ASK ih#.com.jo
DNS ASK ra###agym.com
DNS ASK di###onic.es
DNS ASK gr###power.es
DNS ASK pc###dingmy.com
DNS ASK ec###jp.co.jp
DNS ASK we##.co.jp
DNS ASK pe####-kirche.ch
DNS ASK pr####lubonline.com
DNS ASK pu####3.sta.net.cn
DNS ASK 1b###ope.com
DNS ASK 10###old.com
DNS ASK mi###ni.com.au
DNS ASK im######ioncelebration.org
DNS ASK al######canprintinginc.com
DNS ASK dh###tate.com
DNS ASK ke###tech.com
DNS ASK ed###ost.com
DNS ASK da##ho.info
DNS ASK bl###voib.com
DNS ASK oc###rgos.org
DNS ASK yl##and.com
DNS ASK of###e-gita.com
DNS ASK ma####-shirasu.com
DNS ASK fi####ousepr.com
DNS ASK ba###kulele.com
DNS ASK be####stisdead.com
DNS ASK al####riginals.com
DNS ASK ru###rnail.com
DNS ASK ch####nternet.com
DNS ASK bo####nder4u.com
DNS ASK le###quare.com
DNS ASK pr###sign.com
DNS ASK zo####siness.com
DNS ASK bi####etours.com
DNS ASK ma####toms.com.au
DNS ASK co###ryday.org
DNS ASK ea###rnbulk.com
DNS ASK tb#.com.mx
DNS ASK ka##ax.com
DNS ASK lo###ttages.com
DNS ASK kw###puters.com
DNS ASK ra##inc.com
DNS ASK co###abass.org
DNS ASK ar####tcreative.com
DNS ASK ta###hichi.com
DNS ASK rb##des.com
DNS ASK pa###ship.com
DNS ASK as###-gomu.com
DNS ASK y3###ans.com
DNS ASK na###olar.com
DNS ASK an####agency.com
DNS ASK ax####nceshoes.com
DNS ASK st#####ter.brightok.net
DNS ASK bc##ex.com
DNS ASK bc##aw.com
DNS ASK da####lsresort.com
DNS ASK ch##i-o.com
DNS ASK si###flex.com
DNS ASK te####edical.com
DNS ASK ra##as.com
DNS ASK er##z.org
DNS ASK mu###online.vn
DNS ASK he##ann.cz
DNS ASK tb##oft.com
DNS ASK hi###nika.pl
DNS ASK lj#######.com.didtheyreadit.com
DNS ASK bo####services.com
DNS ASK ma####shaven.com
DNS ASK ar##e.net
DNS ASK re###k.co.uk
DNS ASK oi###.com.pl
DNS ASK uh##.edu.ag
DNS ASK ha###achiro.com
DNS ASK mi##a.com
DNS ASK st####plus.com.au
DNS ASK ia##id.org
DNS ASK su####golfhomes.com
DNS ASK im###alaton.com
DNS ASK rc##nc.biz
DNS ASK te###o.com.tw
DNS ASK cr####rldmarine.com
DNS ASK ho###tinc.com
DNS ASK ei##s.net
DNS ASK ci####indhorn.org
DNS ASK au###us.qc.ca
DNS ASK ho####otrada.com
DNS ASK in###napt.com
DNS ASK ag###pro.com
DNS ASK ta###oyu.net
DNS ASK se###biente.it
DNS ASK le##cy.com
DNS ASK ba####ehotel.com
DNS ASK bo###oil.com
DNS ASK bu####gton.co.uk
DNS ASK ws##w.com
DNS ASK mi###ral.com.au
DNS ASK 1c###mere.com
DNS ASK ba###h-biz.com
DNS ASK bl######hcommunications.com
DNS ASK zo####corisana.com
DNS ASK br######websitedesign.com
DNS ASK cd##i.com
DNS ASK ro###chind.com
DNS ASK m-##in.ru
DNS ASK dr###sis.org
DNS ASK la#####mhorserugs.com
DNS ASK pi###ecassi.com
DNS ASK ha####nproton.org
DNS ASK yo##mfg.com
DNS ASK ma##.#irmail.net
DNS ASK nj###r.com.au
DNS ASK be###aire.org
DNS ASK ha###d.com.au
DNS ASK kh##don.net
DNS ASK wi###edapts.com
DNS ASK ko###ogi.net
DNS ASK in#######undhandelsverlag.de
DNS ASK fh##.com
DNS ASK cj###den.com
DNS ASK th#####ntingcenter.org
DNS ASK he#####onranchprop.com
DNS ASK kg###heslaw.com
DNS ASK sm##.###global.yahoo.com
DNS ASK sm##.#ail.yahoo.com
DNS ASK sm##.live.com
DNS ASK mp####tainment.com
DNS ASK so###dev.com
DNS ASK si###serv.com
DNS ASK bu#####-altamaremma.com
DNS ASK sm##.#irectcon.net
DNS ASK he####provider.com
DNS ASK 7-###irx.com
DNS ASK be#####alutheran.org
DNS ASK gr###ahouse.it
DNS ASK wi###p-pt.com
DNS ASK sq##g.com
DNS ASK 3c###s.com.br
DNS ASK po####wisconsin.com
DNS ASK e-###bainu.com
DNS ASK mo####stfriend.com
DNS ASK na####ziowiec.com
DNS ASK so###ack.com
DNS ASK ow#####nd.library.on.ca
DNS ASK le###.com.my
DNS ASK br#####olmarketing.com
DNS ASK pe###day.co.uk
DNS ASK we####ericas.com
DNS ASK at##-sk.ca
DNS ASK bo##hon.de
DNS ASK wi###amsphc.com
DNS ASK li####ineline.co.nz
DNS ASK dt##k.com
DNS ASK cl###-tokai.com
DNS ASK se####uspeha.com
DNS ASK ka##oft.cz
DNS ASK fo#h.cz
DNS ASK fj#####rkfestivalen.com
DNS ASK ma#####rretora.com.br
DNS ASK su##.edu
DNS ASK ch#####efesta.com.br
DNS ASK so#o.nl
DNS ASK mj####uson.co.uk
DNS ASK eu###ilms.com
DNS ASK hz###hai.com
DNS ASK gg#.ch
DNS ASK ev####chaels.net
DNS ASK ca###oloaks.com
DNS ASK pe####p-pinky.com
DNS ASK ma######.midwestlabs.com
DNS ASK tu####awa-soba.com
DNS ASK de#####arborrealty.com
DNS ASK am#######ourguesthouse.co.uk
DNS ASK wo####fesupport.com
DNS ASK sm##.#ompuserve.com
DNS ASK al##as.org
DNS ASK fv###et.co.jp
DNS ASK tv##ols.fi
DNS ASK co####uhouses.com
DNS ASK im###lac.com
DNS ASK co####erprose.com
DNS ASK ho###-museum.de
DNS ASK dt.#om.pl
DNS ASK id##p.com
DNS ASK sh####yatkinson.com
DNS ASK ss##os.com
DNS ASK hi###e-aa.com
DNS ASK im###ible.com
DNS ASK un###lse.com
DNS ASK hs###iguel.com
DNS ASK in##mex.com
DNS ASK wn##.org
DNS ASK ca###olina.com
DNS ASK ma####aresort.com
DNS ASK ro####farlane.com
DNS ASK la####manzana.es
DNS ASK ca#####acionypnd.com
DNS ASK co####appoint.co.uk
DNS ASK ac###escorp.com

Miscellaneous:

Searches for the following windows:

ClassName: 'Indicator' WindowName: '(null)'

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial