Trojan.DownLoader13.10731

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'PnP-X COM Instrumentation Procedure Modules' = 'C:\zyjifwgrcgfhq\cohdbdxxb.exe'

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\Shadow List Registrar Color] 'Start' = '00000002'

Malicious functions:

Creates and executes the following:

'C:\zyjifwgrcgfhq\gvzwtlc.exe' "c:\zyjifwgrcgfhq\cohdbdxxb.exe"
'C:\zyjifwgrcgfhq\cohdbdxxb.exe'
'C:\zyjifwgrcgfhq\bisg2qmsklroicui.exe'

Modifies file system :

Creates the following files:

C:\zyjifwgrcgfhq\cohdbdxxb.exe
C:\zyjifwgrcgfhq\gvzwtlc.exe
C:\zyjifwgrcgfhq\zf5hdf
%WINDIR%\zyjifwgrcgfhq\w2fbdjfv
C:\zyjifwgrcgfhq\w2fbdjfv
C:\zyjifwgrcgfhq\bisg2qmsklroicui.exe

Sets the 'hidden' attribute to the following files:

C:\zyjifwgrcgfhq\gvzwtlc.exe
C:\zyjifwgrcgfhq\cohdbdxxb.exe

Deletes the following files:

C:\zyjifwgrcgfhq\bisg2qmsklroicui.exe
%WINDIR%\zyjifwgrcgfhq\w2fbdjfv

Network activity:

Connects to:

'be####school.net':80
'ri###nwhile.net':80
'li####therefore.net':80
'ri####school.net':80
'be###gwhile.net':80
'ri####therefore.net':80
'be####therefore.net':80
'ri####question.net':80
'be####question.net':80
'de#####therefore.net':80
'hu#####therefore.net':80
'de####yschool.net':80
'hu####dquestion.net':80
'jo#####therefore.net':80
'li####school.net':80
'de####yquestion.net':80
'li####question.net':80
'de####ywhile.net':80
'li###ewhile.net':80
'ch###school.net':80
'su####question.net':80
'wi####therefore.net':80
'su###rwhile.net':80
'wi####question.net':80
'su####therefore.net':80
'ef###twhile.net':80
'th####hwhile.net':80
'ef####school.net':80
'th####hschool.net':80
'wi###nwhile.net':80
'th###while.net':80
'ch####uestion.net':80
'th###school.net':80
'ch###while.net':80
'th####uestion.net':80
'wi####school.net':80
'su####school.net':80
'ch####herefore.net':80
'th####herefore.net':80
'jo####yquestion.net':80
'th####hwheat.net':80
'ef###tanger.net':80
'su####forest.net':80
'ef###twheat.net':80
'th####hanger.net':80
'ef####forest.net':80
'th####hforest.net':80
'ef####always.net':80
'th####halways.net':80
'wi####forest.net':80
'th###forest.net':80
'wi###nwheat.net':80
'th###always.net':80
'ch###forest.net':80
'su###rwheat.net':80
'wi####always.net':80
'su####always.net':80
'wi###nanger.net':80
'su###ranger.net':80
'fo###twheat.net':80
're####eralways.net':80
'wo###forest.net':80
're####eranger.net':80
'wo###always.net':80
're####erforest.net':80
'jo####ywhile.net':80
'hu####dwhile.net':80
'jo####yschool.net':80
'hu####dschool.net':80
'wo###anger.net':80
'in####seanger.net':80
'fo####always.net':80
'in####sewheat.net':80
'fo###tanger.net':80
'in####sealways.net':80
'wo###wheat.net':80
're####erwheat.net':80
'fo####forest.net':80
'in####seforest.net':80

TCP:

HTTP GET requests:

http://be####school.net/index.php?me########
http://ri###nwhile.net/index.php?me########
http://li####therefore.net/index.php?me########
http://ri####school.net/index.php?me########
http://be###gwhile.net/index.php?me########
http://ri####therefore.net/index.php?me########
http://be####therefore.net/index.php?me########
http://ri####question.net/index.php?me########
http://be####question.net/index.php?me########
http://de#####therefore.net/index.php?me########
http://hu#####therefore.net/index.php?me########
http://de####yschool.net/index.php?me########
http://hu####dquestion.net/index.php?me########
http://jo#####therefore.net/index.php?me########
http://li####school.net/index.php?me########
http://de####yquestion.net/index.php?me########
http://li####question.net/index.php?me########
http://de####ywhile.net/index.php?me########
http://li###ewhile.net/index.php?me########
http://ch###school.net/index.php?me########
http://su####question.net/index.php?me########
http://wi####therefore.net/index.php?me########
http://su###rwhile.net/index.php?me########
http://wi####question.net/index.php?me########
http://su####therefore.net/index.php?me########
http://ef###twhile.net/index.php?me########
http://th####hwhile.net/index.php?me########
http://ef####school.net/index.php?me########
http://th####hschool.net/index.php?me########
http://wi###nwhile.net/index.php?me########
http://th###while.net/index.php?me########
http://ch####uestion.net/index.php?me########
http://th###school.net/index.php?me########
http://ch###while.net/index.php?me########
http://th####uestion.net/index.php?me########
http://wi####school.net/index.php?me########
http://su####school.net/index.php?me########
http://ch####herefore.net/index.php?me########
http://th####herefore.net/index.php?me########
http://jo####yquestion.net/index.php?me########
http://th####hwheat.net/index.php?me########
http://ef###tanger.net/index.php?me########
http://su####forest.net/index.php?me########
http://ef###twheat.net/index.php?me########
http://th####hanger.net/index.php?me########
http://ef####forest.net/index.php?me########
http://th####hforest.net/index.php?me########
http://ef####always.net/index.php?me########
http://th####halways.net/index.php?me########
http://wi####forest.net/index.php?me########
http://th###forest.net/index.php?me########
http://wi###nwheat.net/index.php?me########
http://th###always.net/index.php?me########
http://ch###forest.net/index.php?me########
http://su###rwheat.net/index.php?me########
http://wi####always.net/index.php?me########
http://su####always.net/index.php?me########
http://wi###nanger.net/index.php?me########
http://su###ranger.net/index.php?me########
http://fo###twheat.net/index.php?me########
http://re####eralways.net/index.php?me########
http://wo###forest.net/index.php?me########
http://re####eranger.net/index.php?me########
http://wo###always.net/index.php?me########
http://re####erforest.net/index.php?me########
http://jo####ywhile.net/index.php?me########
http://hu####dwhile.net/index.php?me########
http://jo####yschool.net/index.php?me########
http://hu####dschool.net/index.php?me########
http://wo###anger.net/index.php?me########
http://in####seanger.net/index.php?me########
http://fo####always.net/index.php?me########
http://in####sewheat.net/index.php?me########
http://fo###tanger.net/index.php?me########
http://in####sealways.net/index.php?me########
http://wo###wheat.net/index.php?me########
http://re####erwheat.net/index.php?me########
http://fo####forest.net/index.php?me########
http://in####seforest.net/index.php?me########

UDP:

DNS ASK ri###nwhile.net
DNS ASK be###gwhile.net
DNS ASK be####school.net
DNS ASK li####therefore.net
DNS ASK ri####school.net
DNS ASK be####therefore.net
DNS ASK ch###school.net
DNS ASK ri####therefore.net
DNS ASK ri####question.net
DNS ASK be####question.net
DNS ASK de####yschool.net
DNS ASK li####school.net
DNS ASK hu#####therefore.net
DNS ASK hu####dquestion.net
DNS ASK jo#####therefore.net
DNS ASK li####question.net
DNS ASK de#####therefore.net
DNS ASK de####yquestion.net
DNS ASK de####ywhile.net
DNS ASK li###ewhile.net
DNS ASK wi####therefore.net
DNS ASK su####therefore.net
DNS ASK su####question.net
DNS ASK su###rwhile.net
DNS ASK wi####question.net
DNS ASK th####hwhile.net
DNS ASK ef####question.net
DNS ASK ef###twhile.net
DNS ASK ef####school.net
DNS ASK th####hschool.net
DNS ASK ch####uestion.net
DNS ASK th####uestion.net
DNS ASK th###while.net
DNS ASK th###school.net
DNS ASK ch###while.net
DNS ASK su####school.net
DNS ASK wi###nwhile.net
DNS ASK wi####school.net
DNS ASK ch####herefore.net
DNS ASK th####herefore.net
DNS ASK ef###tanger.net
DNS ASK th####hanger.net
DNS ASK th####hwheat.net
DNS ASK su####forest.net
DNS ASK ef###twheat.net
DNS ASK th####hforest.net
DNS ASK fo###twheat.net
DNS ASK ef####forest.net
DNS ASK ef####always.net
DNS ASK th####halways.net
DNS ASK wi###nwheat.net
DNS ASK su###rwheat.net
DNS ASK th###forest.net
DNS ASK th###always.net
DNS ASK ch###forest.net
DNS ASK su####always.net
DNS ASK wi####forest.net
DNS ASK wi####always.net
DNS ASK wi###nanger.net
DNS ASK su###ranger.net
DNS ASK wo###forest.net
DNS ASK re####erforest.net
DNS ASK re####eralways.net
DNS ASK re####eranger.net
DNS ASK wo###always.net
DNS ASK hu####dwhile.net
DNS ASK jo####yquestion.net
DNS ASK jo####ywhile.net
DNS ASK jo####yschool.net
DNS ASK hu####dschool.net
DNS ASK fo####always.net
DNS ASK in####sealways.net
DNS ASK in####seanger.net
DNS ASK in####sewheat.net
DNS ASK fo###tanger.net
DNS ASK re####erwheat.net
DNS ASK wo###anger.net
DNS ASK wo###wheat.net
DNS ASK fo####forest.net
DNS ASK in####seforest.net

Miscellaneous:

Searches for the following windows:

ClassName: 'Shell_TrayWnd' WindowName: ''

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial