Trojan.DownLoader16.50243

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Counter Presentation Media Offline iSCSI Socket' = '<SYSTEM32>\guohbykr.exe'

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\Profile Discovery Access UserMode Filtering] 'Start' = '00000002'

Malicious functions:

To complicate detection of its presence in the operating system,

blocks the following features:

Windows Security Center

Creates and executes the following:

'<SYSTEM32>\dyswyjgcjaqx.exe' "<SYSTEM32>\guohbykr.exe"
'%WINDIR%\Temp\kt8qwiv3mgmv5.exe' -r 30046 tcp
'%TEMP%\kt8qwiv3gucv5f0echl.exe'
'<SYSTEM32>\guohbykr.exe'

Modifies file system :

Creates the following files:

<SYSTEM32>\tzshpyyxef\run
<SYSTEM32>\tzshpyyxef\rng
%WINDIR%\Temp\kt8qwiv3mgmv5.exe
<SYSTEM32>\tzshpyyxef\cfg
<SYSTEM32>\dyswyjgcjaqx.exe
%TEMP%\kt8qwiv3gucv5f0echl.exe
<SYSTEM32>\tzshpyyxef\tst
<SYSTEM32>\guohbykr.exe
<SYSTEM32>\tzshpyyxef\etc

Sets the 'hidden' attribute to the following files:

<SYSTEM32>\dyswyjgcjaqx.exe
<SYSTEM32>\guohbykr.exe

Deletes the following files:

%WINDIR%\Temp\kt8qwiv3mgmv5.exe
<DRIVERS>\etc\hosts
%TEMP%\kt8qwiv3gucv5f0echl.exe

Substitutes the HOSTS file.

Network activity:

Connects to:

'th###house.net':80
'si###house.net':80
'wi###eace.net':80
'du###eace.net':80
'th###gift.net':80
'si####uesday.net':80
'th###peace.net':80
'si###gift.net':80
'th####uesday.net':80
'tr###peace.net':80
'wi###ouse.net':80
'tr####uesday.net':80
'mi###eace.net':80
'du###ouse.net':80
'wi###uesday.net':80
'du###uesday.net':80
'wi###ift.net':80
'du###ift.net':80
'qu###gift.net':80
'th###ift.net':80
'qu###house.net':80
'th###ouse.net':80
'qu####uesday.net':80
'th###eace.net':80
'su###yhouse.net':80
'th###uesday.net':80
'qu###peace.net':80
'he###ouse.net':80
'ca###ift.net':80
'si###peace.net':80
'ca###ouse.net':80
'he###ift.net':80
'ca###eace.net':80
'he###eace.net':80
'ca###uesday.net':80
'he###uesday.net':80
'mi###uesday.net':80
'mo###ine.net':80
'su###ylive.net':80
'mo###ello.net':80
'su###ymine.net':80
'mo###ive.net':80
'me###ello.net':80
'si###ello.net':80
'su###yserve.net':80
'mo###erve.net':80
'be##lxc.com':80
'de###lxc.com':80
'ri###nstorm.net':80
'af###sllc.com':80
'qu###live.net':80
'th###erve.net':80
'su###yhello.net':80
'th###ive.net':80
'qu###serve.net':80
'da###ive.net':80
'cl###serve.net':80
'da###ine.net':80
'cl###live.net':80
'da###erve.net':80
'mi###ift.net':80
'tr###gift.net':80
'mi###ouse.net':80
'tr###house.net':80
'me###ive.net':80
'si###ive.net':80
'me###ine.net':80
'si###ine.net':80
'me###erve.net':80
'da###ello.net':80
'cl###mine.net':80
'si###erve.net':80
'cl###hello.net':80

TCP:

HTTP GET requests:

http://th###house.net/index.php
http://si###house.net/index.php
http://wi###eace.net/index.php
http://du###eace.net/index.php
http://th###gift.net/index.php
http://si####uesday.net/index.php
http://th###peace.net/index.php
http://si###gift.net/index.php
http://th####uesday.net/index.php
http://tr###peace.net/index.php
http://wi###ouse.net/index.php
http://tr####uesday.net/index.php
http://mi###eace.net/index.php
http://du###ouse.net/index.php
http://wi###uesday.net/index.php
http://du###uesday.net/index.php
http://wi###ift.net/index.php
http://du###ift.net/index.php
http://qu###gift.net/index.php
http://th###ift.net/index.php
http://qu###house.net/index.php
http://th###ouse.net/index.php
http://qu####uesday.net/index.php
http://th###eace.net/index.php
http://su###yhouse.net/index.php
http://th###uesday.net/index.php
http://qu###peace.net/index.php
http://he###ouse.net/index.php
http://ca###ift.net/index.php
http://si###peace.net/index.php
http://ca###ouse.net/index.php
http://he###ift.net/index.php
http://ca###eace.net/index.php
http://he###eace.net/index.php
http://ca###uesday.net/index.php
http://he###uesday.net/index.php
http://mi###uesday.net/index.php
http://mo###ine.net/index.php
http://su###ylive.net/index.php
http://mo###ello.net/index.php
http://su###ymine.net/index.php
http://mo###ive.net/index.php
http://me###ello.net/index.php
http://si###ello.net/index.php
http://su###yserve.net/index.php
http://mo###erve.net/index.php
http://be##lxc.com/index.php
http://de###lxc.com/index.php
http://ri###nstorm.net/index.php
http://af###sllc.com/index.php
http://qu###live.net/index.php
http://th###erve.net/index.php
http://su###yhello.net/index.php
http://th###ive.net/index.php
http://qu###serve.net/index.php
http://da###ive.net/index.php
http://cl###serve.net/index.php
http://da###ine.net/index.php
http://cl###live.net/index.php
http://da###erve.net/index.php
http://mi###ift.net/index.php
http://tr###gift.net/index.php
http://mi###ouse.net/index.php
http://tr###house.net/index.php
http://me###ive.net/index.php
http://si###ive.net/index.php
http://me###ine.net/index.php
http://si###ine.net/index.php
http://me###erve.net/index.php
http://da###ello.net/index.php
http://cl###mine.net/index.php
http://si###erve.net/index.php
http://cl###hello.net/index.php

UDP:

DNS ASK th###house.net
DNS ASK si###house.net
DNS ASK wi###eace.net
DNS ASK du###eace.net
DNS ASK th###gift.net
DNS ASK si####uesday.net
DNS ASK th###peace.net
DNS ASK si###gift.net
DNS ASK th####uesday.net
DNS ASK tr###peace.net
DNS ASK wi###ouse.net
DNS ASK tr####uesday.net
DNS ASK mi###eace.net
DNS ASK du###ouse.net
DNS ASK wi###uesday.net
DNS ASK du###uesday.net
DNS ASK wi###ift.net
DNS ASK du###ift.net
DNS ASK si###peace.net
DNS ASK th###ift.net
DNS ASK qu####uesday.net
DNS ASK th###ouse.net
DNS ASK qu###gift.net
DNS ASK th###uesday.net
DNS ASK su###yhouse.net
DNS ASK mo###ouse.net
DNS ASK qu###peace.net
DNS ASK th###eace.net
DNS ASK ca###ift.net
DNS ASK he###ift.net
DNS ASK ca###ouse.net
DNS ASK he###ouse.net
DNS ASK ca###uesday.net
DNS ASK he###eace.net
DNS ASK qu###house.net
DNS ASK he###uesday.net
DNS ASK ca###eace.net
DNS ASK mi###uesday.net
DNS ASK mo###ine.net
DNS ASK su###ylive.net
DNS ASK mo###ello.net
DNS ASK su###ymine.net
DNS ASK mo###ive.net
DNS ASK me###ello.net
DNS ASK si###ello.net
DNS ASK su###yserve.net
DNS ASK mo###erve.net
DNS ASK be##lxc.com
DNS ASK de###lxc.com
DNS ASK ri###nstorm.net
DNS ASK af###sllc.com
DNS ASK qu###live.net
DNS ASK th###erve.net
DNS ASK su###yhello.net
DNS ASK th###ive.net
DNS ASK qu###serve.net
DNS ASK da###ive.net
DNS ASK cl###serve.net
DNS ASK da###ine.net
DNS ASK cl###live.net
DNS ASK da###erve.net
DNS ASK mi###ift.net
DNS ASK tr###gift.net
DNS ASK mi###ouse.net
DNS ASK tr###house.net
DNS ASK me###ive.net
DNS ASK si###ive.net
DNS ASK me###ine.net
DNS ASK si###ine.net
DNS ASK me###erve.net
DNS ASK da###ello.net
DNS ASK cl###mine.net
DNS ASK si###erve.net
DNS ASK cl###hello.net
'23#.#55.255.250':1900

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial