Trojan.DownLoader16.48887

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'COM Studio Client Compatibility Computer' = '<SYSTEM32>\ydkjhnq.exe'

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\Detection Encrypting Portable Font] 'Start' = '00000002'

Malicious functions:

To complicate detection of its presence in the operating system,

blocks the following features:

Windows Security Center

Creates and executes the following:

'<SYSTEM32>\dzkajkjhong.exe' "<SYSTEM32>\ydkjhnq.exe"
'%WINDIR%\Temp\l5rgih36vfybbgl.exe' -r 46397 tcp
'%TEMP%\l5rgih2xjwybbglopah6g7.exe'
'<SYSTEM32>\ydkjhnq.exe'

Modifies file system :

Creates the following files:

<SYSTEM32>\yuudayaoxd\run
<SYSTEM32>\yuudayaoxd\rng
%WINDIR%\Temp\l5rgih36vfybbgl.exe
<SYSTEM32>\yuudayaoxd\cfg
<SYSTEM32>\dzkajkjhong.exe
%TEMP%\l5rgih2xjwybbglopah6g7.exe
<SYSTEM32>\yuudayaoxd\tst
<SYSTEM32>\ydkjhnq.exe
<SYSTEM32>\yuudayaoxd\etc

Sets the 'hidden' attribute to the following files:

<SYSTEM32>\dzkajkjhong.exe
<SYSTEM32>\ydkjhnq.exe

Deletes the following files:

%WINDIR%\Temp\l5rgih36vfybbgl.exe
<DRIVERS>\etc\hosts
%TEMP%\l5rgih2xjwybbglopah6g7.exe

Substitutes the HOSTS file.

Network activity:

Connects to:

'mi###eight.net':80
'tr###height.net':80
'tr###sleep.net':80
'da####portant.net':80
'mi###leep.net':80
'tr###rain.net':80
'wi###leep.net':80
'mi###ain.net':80
'mi###eld.net':80
'tr###held.net':80
'cl####mportant.net':80
'si####portant.net':80
'cl###fine.net':80
'me####portant.net':80
'me###lse.net':80
'si###lse.net':80
'cl###else.net':80
'da###lse.net':80
'da###ice.net':80
'da###ine.net':80
'cl###nice.net':80
'si###rain.net':80
'ca###leep.net':80
'th###rain.net':80
'th###held.net':80
'si###held.net':80
'ca###eld.net':80
'he###eld.net':80
'he###eight.net':80
'he###leep.net':80
'ca###eight.net':80
'si###height.net':80
'wi###eld.net':80
'du###eld.net':80
'du###eight.net':80
'du###leep.net':80
'wi###eight.net':80
'si###sleep.net':80
'th###height.net':80
'th###sleep.net':80
'wi###ain.net':80
'du###ain.net':80
'si###ice.net':80
'si####mportant.net':80
'ca###ine.net':80
'th####mportant.net':80
'th###else.net':80
'si###else.net':80
'ca###lse.net':80
'he###lse.net':80
'he###ice.net':80
'he###ine.net':80
'ca###ice.net':80
'si###nice.net':80
'de###lxc.com':80
'du###lse.net':80
'be##lxc.com':80
'ri###nstorm.net':80
'af###sllc.com':80
'si###fine.net':80
'th###nice.net':80
'th###fine.net':80
'wi####portant.net':80
'du####portant.net':80
'su###yelse.net':80
'mo###lse.net':80
'mo###ice.net':80
'mo###ine.net':80
'su###ynice.net':80
'si###ine.net':80
'me###ice.net':80
'me###ine.net':80
'su####important.net':80
'mo####portant.net':80
'su###yfine.net':80
'th###ine.net':80
'qu###nice.net':80
'qu###fine.net':80
'ca####portant.net':80
'he####portant.net':80
'qu####mportant.net':80
'th####portant.net':80
'th###lse.net':80
'th###ice.net':80
'qu###else.net':80

TCP:

HTTP GET requests:

http://mi###eight.net/index.php
http://tr###height.net/index.php
http://tr###sleep.net/index.php
http://da####portant.net/index.php
http://mi###leep.net/index.php
http://tr###rain.net/index.php
http://wi###leep.net/index.php
http://mi###ain.net/index.php
http://mi###eld.net/index.php
http://tr###held.net/index.php
http://cl####mportant.net/index.php
http://si####portant.net/index.php
http://cl###fine.net/index.php
http://me####portant.net/index.php
http://me###lse.net/index.php
http://si###lse.net/index.php
http://cl###else.net/index.php
http://da###lse.net/index.php
http://da###ice.net/index.php
http://da###ine.net/index.php
http://cl###nice.net/index.php
http://si###rain.net/index.php
http://ca###leep.net/index.php
http://th###rain.net/index.php
http://th###held.net/index.php
http://si###held.net/index.php
http://ca###eld.net/index.php
http://he###eld.net/index.php
http://he###eight.net/index.php
http://he###leep.net/index.php
http://ca###eight.net/index.php
http://si###height.net/index.php
http://wi###eld.net/index.php
http://du###eld.net/index.php
http://du###eight.net/index.php
http://du###leep.net/index.php
http://wi###eight.net/index.php
http://si###sleep.net/index.php
http://th###height.net/index.php
http://th###sleep.net/index.php
http://wi###ain.net/index.php
http://du###ain.net/index.php
http://si###ice.net/index.php
http://si####mportant.net/index.php
http://ca###ine.net/index.php
http://th####mportant.net/index.php
http://th###else.net/index.php
http://si###else.net/index.php
http://ca###lse.net/index.php
http://he###lse.net/index.php
http://he###ice.net/index.php
http://he###ine.net/index.php
http://ca###ice.net/index.php
http://si###nice.net/index.php
http://de###lxc.com/index.php
http://du###lse.net/index.php
http://be##lxc.com/index.php
http://ri###nstorm.net/index.php
http://af###sllc.com/index.php
http://si###fine.net/index.php
http://th###nice.net/index.php
http://th###fine.net/index.php
http://wi####portant.net/index.php
http://du####portant.net/index.php
http://su###yelse.net/index.php
http://mo###lse.net/index.php
http://mo###ice.net/index.php
http://mo###ine.net/index.php
http://su###ynice.net/index.php
http://si###ine.net/index.php
http://me###ice.net/index.php
http://me###ine.net/index.php
http://su####important.net/index.php
http://mo####portant.net/index.php
http://su###yfine.net/index.php
http://th###ine.net/index.php
http://qu###nice.net/index.php
http://qu###fine.net/index.php
http://ca####portant.net/index.php
http://he####portant.net/index.php
http://qu####mportant.net/index.php
http://th####portant.net/index.php
http://th###lse.net/index.php
http://th###ice.net/index.php
http://qu###else.net/index.php

UDP:

DNS ASK mi###eight.net
DNS ASK tr###height.net
DNS ASK tr###sleep.net
DNS ASK da####portant.net
DNS ASK mi###leep.net
DNS ASK tr###rain.net
DNS ASK wi###leep.net
DNS ASK mi###ain.net
DNS ASK mi###eld.net
DNS ASK tr###held.net
DNS ASK cl####mportant.net
DNS ASK si####portant.net
DNS ASK cl###fine.net
DNS ASK me####portant.net
DNS ASK me###lse.net
DNS ASK si###lse.net
DNS ASK cl###else.net
DNS ASK da###lse.net
DNS ASK da###ice.net
DNS ASK da###ine.net
DNS ASK cl###nice.net
DNS ASK du###leep.net
DNS ASK ca###leep.net
DNS ASK he###leep.net
DNS ASK si###rain.net
DNS ASK si###held.net
DNS ASK th###rain.net
DNS ASK he###eld.net
DNS ASK ca###ain.net
DNS ASK ca###eld.net
DNS ASK ca###eight.net
DNS ASK he###eight.net
DNS ASK th###held.net
DNS ASK du###eld.net
DNS ASK wi###ain.net
DNS ASK wi###eld.net
DNS ASK wi###eight.net
DNS ASK du###eight.net
DNS ASK th###height.net
DNS ASK si###height.net
DNS ASK si###sleep.net
DNS ASK du###ain.net
DNS ASK th###sleep.net
DNS ASK si###ice.net
DNS ASK si####mportant.net
DNS ASK ca###ine.net
DNS ASK th####mportant.net
DNS ASK th###else.net
DNS ASK si###else.net
DNS ASK ca###lse.net
DNS ASK he###lse.net
DNS ASK he###ice.net
DNS ASK he###ine.net
DNS ASK ca###ice.net
DNS ASK si###nice.net
DNS ASK de###lxc.com
DNS ASK du###lse.net
DNS ASK be##lxc.com
DNS ASK ri###nstorm.net
DNS ASK af###sllc.com
DNS ASK si###fine.net
DNS ASK th###nice.net
DNS ASK th###fine.net
DNS ASK wi####portant.net
DNS ASK du####portant.net
DNS ASK su###yelse.net
DNS ASK mo###lse.net
DNS ASK mo###ice.net
DNS ASK mo###ine.net
DNS ASK su###ynice.net
DNS ASK si###ine.net
DNS ASK me###ice.net
DNS ASK me###ine.net
DNS ASK su####important.net
DNS ASK mo####portant.net
DNS ASK su###yfine.net
DNS ASK th###ine.net
DNS ASK qu###nice.net
DNS ASK qu###fine.net
DNS ASK ca####portant.net
DNS ASK he####portant.net
DNS ASK qu####mportant.net
DNS ASK th####portant.net
DNS ASK th###lse.net
DNS ASK th###ice.net
DNS ASK qu###else.net
'23#.#55.255.250':1900

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial