Trojan.DownLoader12.5277

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Registry Helper' = '"%PROGRAM_FILES%\Registry Helper\RegistryHelper.Exe" /boot'

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\Registry Helper Service] 'Start' = '00000002'

Malicious functions:

Creates and executes the following:

'%PROGRAM_FILES%\Registry Helper\RegistryHelperService.exe'
'%PROGRAM_FILES%\Registry Helper\RegistryHelper.exe' /Install /Freeze /delay5
'%PROGRAM_FILES%\Registry Helper\RegistryHelperService.exe' /i
'%PROGRAM_FILES%\Registry Helper\Starter.exe'

Modifies file system :

Creates the following files:

%PROGRAM_FILES%\Registry Helper\Help\images\activation_successful.jpg
%PROGRAM_FILES%\Registry Helper\Help\images\activation_incorrect.jpg
%PROGRAM_FILES%\Registry Helper\Help\images\ignore_list.jpg
%PROGRAM_FILES%\Registry Helper\Help\images\background.gif
%PROGRAM_FILES%\Registry Helper\Help\images\about.jpg
%PROGRAM_FILES%\Registry Helper\Help\Updates.htm
%PROGRAM_FILES%\Registry Helper\Help\images\activate_now.jpg
%PROGRAM_FILES%\Registry Helper\Help\images\activate.jpg
%PROGRAM_FILES%\Registry Helper\Help\images\restore.jpg
%PROGRAM_FILES%\Registry Helper\Help\images\program_settings.jpg
%PROGRAM_FILES%\Registry Helper\Help\images\scan_options.jpg
%PROGRAM_FILES%\Registry Helper\Help\images\scan_now.jpg
%PROGRAM_FILES%\Registry Helper\Help\images\internet_speed_optimizer.jpg
%PROGRAM_FILES%\Registry Helper\Help\images\index_16.gif
%PROGRAM_FILES%\Registry Helper\Help\images\logo.gif
%PROGRAM_FILES%\Registry Helper\Help\images\invalid_entries_detected.jpg
%PROGRAM_FILES%\Registry Helper\Help\Restore.htm
%PROGRAM_FILES%\Registry Helper\Help\Program Settings.htm
%PROGRAM_FILES%\Registry Helper\Help\Scan Now.htm
%PROGRAM_FILES%\Registry Helper\Help\Retrieve Lost Activation Key.htm
%PROGRAM_FILES%\Registry Helper\Help\Invalid Entries Detected.htm
%PROGRAM_FILES%\Registry Helper\Help\Internet Optimizer.htm
%PROGRAM_FILES%\Registry Helper\Help\Overview.htm
%PROGRAM_FILES%\Registry Helper\Help\License Agreement.htm
%PROGRAM_FILES%\Registry Helper\Help\System Requirements.htm
%PROGRAM_FILES%\Registry Helper\Help\Startup Manager.htm
%PROGRAM_FILES%\Registry Helper\Help\Uninstall.htm
%PROGRAM_FILES%\Registry Helper\Help\Technical Support.htm
%PROGRAM_FILES%\Registry Helper\Help\Scanning.htm
%PROGRAM_FILES%\Registry Helper\Help\Scan Options.htm
%PROGRAM_FILES%\Registry Helper\Help\Splash Screen.htm
%PROGRAM_FILES%\Registry Helper\Help\Scheduler.htm
%PROGRAM_FILES%\Registry Helper\Registry Helper.url
%ALLUSERSPROFILE%\Desktop\Registry Helper.lnk
%PROGRAM_FILES%\Registry Helper\uninst.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Registry Helper\Visit our Website.lnk
<SYSTEM32>\msflxgrd.ocx
<SYSTEM32>\dhRichClient3.dll
%ALLUSERSPROFILE%\Start Menu\Programs\Registry Helper\Registry Helper.lnk
%ALLUSERSPROFILE%\Application Data\Registry Helper\Settings\BackupOptions.efs
%ALLUSERSPROFILE%\Application Data\Registry Helper\Settings\StatusInfo.efs
%ALLUSERSPROFILE%\Application Data\Registry Helper\Settings\RegistryHelper.ini
%ALLUSERSPROFILE%\Application Data\Registry Helper\Settings\Ignored.efs
%ALLUSERSPROFILE%\Application Data\Registry Helper\Service\Service Log.txt
%ALLUSERSPROFILE%\Application Data\Registry Helper\Service\SentData.dat
%ALLUSERSPROFILE%\Application Data\Registry Helper\Settings\Options.efs
%ALLUSERSPROFILE%\Application Data\Registry Helper\Settings\Settings.efs
%PROGRAM_FILES%\Registry Helper\Help\include\footer.js
%PROGRAM_FILES%\Registry Helper\Help\images\updates.jpg
<SYSTEM32>\mscomct2.ocx
%PROGRAM_FILES%\Registry Helper\Help\include\jsfunctions.js
%PROGRAM_FILES%\Registry Helper\Help\images\scheduler.jpg
%PROGRAM_FILES%\Registry Helper\Help\images\scanning.jpg
%PROGRAM_FILES%\Registry Helper\Help\images\startup_manager.jpg
%PROGRAM_FILES%\Registry Helper\Help\images\splash_screen.jpg
<SYSTEM32>\RegistryHelperLM.ocx
<SYSTEM32>\NTSVC.ocx
<SYSTEM32>\sqlite36_engine.dll
<SYSTEM32>\DirectCOM.dll
<SYSTEM32>\SYSINFO.OCX
<SYSTEM32>\mscomctl.ocx
<SYSTEM32>\MSINET.OCX
<SYSTEM32>\RICHTX32.OCX
%PROGRAM_FILES%\Registry Helper\Advisor Letters\Letter9.htm
%PROGRAM_FILES%\Registry Helper\Advisor Letters\Letter8.htm
%PROGRAM_FILES%\Registry Helper\Advisor Letters\Letter11.htm
%PROGRAM_FILES%\Registry Helper\Advisor Letters\Letter10.htm
%PROGRAM_FILES%\Registry Helper\Advisor Letters\Letter5.htm
%PROGRAM_FILES%\Registry Helper\Advisor Letters\Letter4.htm
%PROGRAM_FILES%\Registry Helper\Advisor Letters\Letter7.htm
%PROGRAM_FILES%\Registry Helper\Advisor Letters\Letter6.htm
%PROGRAM_FILES%\Registry Helper\Advisor Letters\Letter17.htm
%PROGRAM_FILES%\Registry Helper\Advisor Letters\Letter16.htm
%PROGRAM_FILES%\Registry Helper\Advisor Letters\Letter19.htm
%PROGRAM_FILES%\Registry Helper\Advisor Letters\Letter18.htm
%PROGRAM_FILES%\Registry Helper\Advisor Letters\Letter13.htm
%PROGRAM_FILES%\Registry Helper\Advisor Letters\Letter12.htm
%PROGRAM_FILES%\Registry Helper\Advisor Letters\Letter15.htm
%PROGRAM_FILES%\Registry Helper\Advisor Letters\Letter14.htm
%PROGRAM_FILES%\Registry Helper\RegistryHelper.exe
%PROGRAM_FILES%\Registry Helper\ErrorFound.wav
%PROGRAM_FILES%\Registry Helper\Starter.exe
%PROGRAM_FILES%\Registry Helper\RegistryHelperService.exe
%TEMP%\nsc3.tmp\System.dll
%TEMP%\nsn2.tmp
%PROGRAM_FILES%\Registry Helper\msxml6.msi
%PROGRAM_FILES%\Registry Helper\RegistryHelperSetupTR.exe
%PROGRAM_FILES%\Registry Helper\Advisor Letters\Letter1.htm
%PROGRAM_FILES%\Registry Helper\AdvisorLetters.exe
%PROGRAM_FILES%\Registry Helper\Advisor Letters\Letter3.htm
%PROGRAM_FILES%\Registry Helper\Advisor Letters\Letter2.htm
%PROGRAM_FILES%\Registry Helper\vbrun60sp5.exe
%PROGRAM_FILES%\Registry Helper\RegistryHelperUninstaller.exe
%PROGRAM_FILES%\Registry Helper\Registry Helper Screen Saver Setup.exe
%PROGRAM_FILES%\Registry Helper\RegistryHelperSetupCB.exe
%PROGRAM_FILES%\Registry Helper\Advisor Letters\include\header.js
%PROGRAM_FILES%\Registry Helper\Advisor Letters\include\footer_short.js
%PROGRAM_FILES%\Registry Helper\logo.gif
%PROGRAM_FILES%\Registry Helper\Advisor Letters\include\jsfunctions.js
%PROGRAM_FILES%\Registry Helper\Advisor Letters\images\get_activation_key.gif
%PROGRAM_FILES%\Registry Helper\Advisor Letters\images\update_computer_grey.jpg
%PROGRAM_FILES%\Registry Helper\Advisor Letters\include\footer.js
%PROGRAM_FILES%\Registry Helper\Advisor Letters\images\index_16.gif
%PROGRAM_FILES%\Registry Helper\Help\Help_index.htm
%PROGRAM_FILES%\Registry Helper\Help\Help_header.htm
%PROGRAM_FILES%\Registry Helper\Help\Ignore List.htm
%PROGRAM_FILES%\Registry Helper\Help\How To Order.htm
%PROGRAM_FILES%\Registry Helper\Help\About.htm
%PROGRAM_FILES%\Registry Helper\background.gif
%PROGRAM_FILES%\Registry Helper\Help\Help.htm
%PROGRAM_FILES%\Registry Helper\Help\Activate Now.htm
%PROGRAM_FILES%\Registry Helper\Advisor Letters\images\delete_invalid_entries_grey.jpg
%PROGRAM_FILES%\Registry Helper\Advisor Letters\images\computerupdater_box.jpg
%PROGRAM_FILES%\Registry Helper\Advisor Letters\images\diskcleaner_box.jpg
%PROGRAM_FILES%\Registry Helper\Advisor Letters\images\delete_junk_files_grey.jpg
%PROGRAM_FILES%\Registry Helper\Advisor Letters\Letter21.htm
%PROGRAM_FILES%\Registry Helper\Advisor Letters\Letter20.htm
%PROGRAM_FILES%\Registry Helper\Advisor Letters\00_Advisor Letters Index.htm
%PROGRAM_FILES%\Registry Helper\Advisor Letters\Letter22.htm
%PROGRAM_FILES%\Registry Helper\Advisor Letters\images\print_16.gif
%PROGRAM_FILES%\Registry Helper\Advisor Letters\images\livedrive.gif
%PROGRAM_FILES%\Registry Helper\Advisor Letters\images\startup_manager.jpg
%PROGRAM_FILES%\Registry Helper\Advisor Letters\images\signature.jpg
%PROGRAM_FILES%\Registry Helper\Advisor Letters\images\header.gif
%PROGRAM_FILES%\Registry Helper\Advisor Letters\images\get_discount.gif
%PROGRAM_FILES%\Registry Helper\Advisor Letters\images\iPad_Video_Lessons.jpg
%PROGRAM_FILES%\Registry Helper\Advisor Letters\images\internet_speed_optimizer.jpg

Deletes the following files:

%ALLUSERSPROFILE%\Application Data\Registry Helper\Settings\BackupOptions.efs
%TEMP%\~DF1817.tmp
%ALLUSERSPROFILE%\Application Data\Registry Helper\Settings\StatusInfo.efs
%ALLUSERSPROFILE%\Application Data\Registry Helper\Settings\Options.efs
%TEMP%\nsc3.tmp\System.dll
%ALLUSERSPROFILE%\Application Data\Registry Helper\Service\SentData.dat
%ALLUSERSPROFILE%\Application Data\Registry Helper\Settings\Settings.efs

Network activity:

Connects to:

'www.re###lper.com':80
'www.sa####psoftware.com':80
'localhost':1036

TCP:

HTTP GET requests:

www.re###lper.com/rh/tr.asp?so#######################################################################################################################################################################################################################################################################################
www.sa####psoftware.com/sa/SIError.asp?ex#########################################################################################################

UDP:

DNS ASK www.re###lper.com
DNS ASK www.sa####psoftware.com

Miscellaneous:

Searches for the following windows:

ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebcheckMonitor' WindowName: ''
ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: 'ThunderRT6FormDC' WindowName: 'Registry Helper (SafeApp Software, LLC)'
ClassName: 'ThunderRT6FormDC' WindowName: 'Registry Helper Advisor'
ClassName: 'ThunderRT6FormDC' WindowName: 'Registry Helper Bundle Starter'

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial