Trojan.DownLoader13.12808

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Compatibility Level Microsoft Routing' = 'C:\zewcorypc\efjmhpc.exe'

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\Extensible Backup Player User] 'Start' = '00000002'

Malicious functions:

Creates and executes the following:

'C:\zewcorypc\azieqcwl.exe' "c:\zewcorypc\efjmhpc.exe"
'C:\zewcorypc\efjmhpc.exe'
'C:\zewcorypc\dxf3n41t9k42gdr.exe'

Modifies file system :

Creates the following files:

C:\zewcorypc\efjmhpc.exe
C:\zewcorypc\azieqcwl.exe
C:\zewcorypc\jvrkf8m7xo2a
%WINDIR%\zewcorypc\rlliqt5b65l
C:\zewcorypc\rlliqt5b65l
C:\zewcorypc\dxf3n41t9k42gdr.exe

Sets the 'hidden' attribute to the following files:

C:\zewcorypc\azieqcwl.exe
C:\zewcorypc\efjmhpc.exe

Deletes the following files:

C:\zewcorypc\dxf3n41t9k42gdr.exe
%WINDIR%\zewcorypc\rlliqt5b65l

Network activity:

Connects to:

're####ewhile.net':80
'or####uestion.net':80
're####eschool.net':80
'or###while.net':80
're#####therefore.net':80
'le####school.net':80
're####equestion.net':80
'or####herefore.net':80
'ne####arywhile.net':80
'pl#####tquestion.net':80
'ne####aryschool.net':80
'pl####ntwhile.net':80
'ne#####rytherefore.net':80
'or###school.net':80
'ne#####ryquestion.net':80
'pl#####ttherefore.net':80
'he####school.net':80
'va####sschool.net':80
're####school.net':80
'ge####question.net':80
'ge####therefore.net':80
'va####squestion.net':80
're####question.net':80
'va####swhile.net':80
're###nwhile.net':80
'le####question.net':80
'he####question.net':80
'le###rwhile.net':80
'he###nwhile.net':80
'ge####school.net':80
'ge###ewhile.net':80
'le####therefore.net':80
'he####therefore.net':80
'pl####ntschool.net':80
'fo####dschool.net':80
'de###ewhile.net':80
're####forest.net':80
'de####school.net':80
'fo####dquestion.net':80
'de####therefore.net':80
'fo####dwhile.net':80
'de####question.net':80
're###nwheat.net':80
'va####sanger.net':80
'ge####forest.net':80
'va####swheat.net':80
're####always.net':80
'va####sforest.net':80
're###nanger.net':80
'va####salways.net':80
'fo#####therefore.net':80
'di####ultwhile.net':80
'he###while.net':80
'di####ultschool.net':80
'he###school.net':80
'di#####lttherefore.net':80
'he####herefore.net':80
'di#####ltquestion.net':80
'he####uestion.net':80
'an###rwhile.net':80
'gl###while.net':80
'an####school.net':80
'gl###school.net':80
'an####therefore.net':80
'gl####herefore.net':80
'an####question.net':80
'gl####uestion.net':80

TCP:

HTTP GET requests:

http://re####ewhile.net/index.php?me########
http://or####uestion.net/index.php?me########
http://re####eschool.net/index.php?me########
http://or###while.net/index.php?me########
http://re#####therefore.net/index.php?me########
http://le####school.net/index.php?me########
http://re####equestion.net/index.php?me########
http://or####herefore.net/index.php?me########
http://ne####arywhile.net/index.php?me########
http://pl#####tquestion.net/index.php?me########
http://ne####aryschool.net/index.php?me########
http://pl####ntwhile.net/index.php?me########
http://ne#####rytherefore.net/index.php?me########
http://or###school.net/index.php?me########
http://ne#####ryquestion.net/index.php?me########
http://pl#####ttherefore.net/index.php?me########
http://he####school.net/index.php?me########
http://va####sschool.net/index.php?me########
http://re####school.net/index.php?me########
http://ge####question.net/index.php?me########
http://ge####therefore.net/index.php?me########
http://va####squestion.net/index.php?me########
http://re####question.net/index.php?me########
http://va####swhile.net/index.php?me########
http://re###nwhile.net/index.php?me########
http://le####question.net/index.php?me########
http://he####question.net/index.php?me########
http://le###rwhile.net/index.php?me########
http://he###nwhile.net/index.php?me########
http://ge####school.net/index.php?me########
http://ge###ewhile.net/index.php?me########
http://le####therefore.net/index.php?me########
http://he####therefore.net/index.php?me########
http://pl####ntschool.net/index.php?me########
http://fo####dschool.net/index.php?me########
http://de###ewhile.net/index.php?me########
http://re####forest.net/index.php?me########
http://de####school.net/index.php?me########
http://fo####dquestion.net/index.php?me########
http://de####therefore.net/index.php?me########
http://fo####dwhile.net/index.php?me########
http://de####question.net/index.php?me########
http://re###nwheat.net/index.php?me########
http://va####sanger.net/index.php?me########
http://ge####forest.net/index.php?me########
http://va####swheat.net/index.php?me########
http://re####always.net/index.php?me########
http://va####sforest.net/index.php?me########
http://re###nanger.net/index.php?me########
http://va####salways.net/index.php?me########
http://fo#####therefore.net/index.php?me########
http://di####ultwhile.net/index.php?me########
http://he###while.net/index.php?me########
http://di####ultschool.net/index.php?me########
http://he###school.net/index.php?me########
http://di#####lttherefore.net/index.php?me########
http://he####herefore.net/index.php?me########
http://di#####ltquestion.net/index.php?me########
http://he####uestion.net/index.php?me########
http://an###rwhile.net/index.php?me########
http://gl###while.net/index.php?me########
http://an####school.net/index.php?me########
http://gl###school.net/index.php?me########
http://an####therefore.net/index.php?me########
http://gl####herefore.net/index.php?me########
http://an####question.net/index.php?me########
http://gl####uestion.net/index.php?me########

UDP:

DNS ASK or####uestion.net
DNS ASK re####equestion.net
DNS ASK or###while.net
DNS ASK re####ewhile.net
DNS ASK le####school.net
DNS ASK he####school.net
DNS ASK or####herefore.net
DNS ASK re#####therefore.net
DNS ASK re####eschool.net
DNS ASK ne####arywhile.net
DNS ASK pl#####tquestion.net
DNS ASK ne####aryschool.net
DNS ASK pl####ntwhile.net
DNS ASK ne#####rytherefore.net
DNS ASK or###school.net
DNS ASK ne#####ryquestion.net
DNS ASK pl#####ttherefore.net
DNS ASK re####school.net
DNS ASK va####swhile.net
DNS ASK ge####therefore.net
DNS ASK va####sschool.net
DNS ASK re####question.net
DNS ASK va#####therefore.net
DNS ASK re###nwhile.net
DNS ASK va####squestion.net
DNS ASK ge####question.net
DNS ASK le####question.net
DNS ASK he####question.net
DNS ASK le###rwhile.net
DNS ASK he###nwhile.net
DNS ASK ge####school.net
DNS ASK ge###ewhile.net
DNS ASK le####therefore.net
DNS ASK he####therefore.net
DNS ASK de###ewhile.net
DNS ASK fo####dwhile.net
DNS ASK de####school.net
DNS ASK fo####dschool.net
DNS ASK de####therefore.net
DNS ASK fo#####therefore.net
DNS ASK de####question.net
DNS ASK fo####dquestion.net
DNS ASK re####forest.net
DNS ASK re###nwheat.net
DNS ASK va####sanger.net
DNS ASK ge####forest.net
DNS ASK va####swheat.net
DNS ASK re####always.net
DNS ASK va####sforest.net
DNS ASK re###nanger.net
DNS ASK va####salways.net
DNS ASK he###while.net
DNS ASK di#####ltquestion.net
DNS ASK he###school.net
DNS ASK di####ultwhile.net
DNS ASK he####herefore.net
DNS ASK pl####ntschool.net
DNS ASK he####uestion.net
DNS ASK di#####lttherefore.net
DNS ASK di####ultschool.net
DNS ASK an###rwhile.net
DNS ASK gl###while.net
DNS ASK an####school.net
DNS ASK gl###school.net
DNS ASK an####therefore.net
DNS ASK gl####herefore.net
DNS ASK an####question.net
DNS ASK gl####uestion.net

Miscellaneous:

Searches for the following windows:

ClassName: 'Shell_TrayWnd' WindowName: ''

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial