Trojan.Inject1.23100

Technical Information

Malicious functions:

Executes the following:

'<SYSTEM32>\net1.exe' /pid=2492
'<SYSTEM32>\net1.exe' user admin16wd /add
'<SYSTEM32>\net1.exe' /pid=788
'<SYSTEM32>\net1.exe' user admin17d /add
'<SYSTEM32>\net1.exe' /pid=248
'<SYSTEM32>\net1.exe' user admi14ef /add
'<SYSTEM32>\net1.exe' /pid=1408
'<SYSTEM32>\net1.exe' user admin15dwq /add
'<SYSTEM32>\net1.exe' /pid=1804
'<SYSTEM32>\net1.exe' user admin225235w /add
'<SYSTEM32>\net1.exe' user admin223525w /add
'<SYSTEM32>\net1.exe' user admin246325w /add
'<SYSTEM32>\net1.exe' user admin262325w /add
'<SYSTEM32>\net1.exe' user admin19w /add
'<SYSTEM32>\net1.exe' user admin18w /add
'<SYSTEM32>\net1.exe' user admin223425w /add
'<SYSTEM32>\net1.exe' user admin20q /add
'<SYSTEM32>\net1.exe' /pid=4040
'<SYSTEM32>\net1.exe' /pid=3652
'<SYSTEM32>\net1.exe' user admin7e /add
'<SYSTEM32>\net1.exe' /pid=3720
'<SYSTEM32>\net1.exe' user admin8wt /add
'<SYSTEM32>\net1.exe' /pid=2888
'<SYSTEM32>\net1.exe' user admin5rt /add
'<SYSTEM32>\net1.exe' /pid=3588
'<SYSTEM32>\net1.exe' user admin6rt /add
'<SYSTEM32>\net1.exe' user admin9r /add
'<SYSTEM32>\net1.exe' user admin12efq /add
'<SYSTEM32>\net1.exe' /pid=3908
'<SYSTEM32>\net1.exe' user admin13w /add
'<SYSTEM32>\net1.exe' /pid=3972
'<SYSTEM32>\net1.exe' user admin10tg /add
'<SYSTEM32>\net1.exe' /pid=3780
'<SYSTEM32>\net1.exe' user admin11efw /add
'<SYSTEM32>\net1.exe' /pid=3844
'<SYSTEM32>\net1.exe' /pid=2948
'<SYSTEM32>\net1.exe' user admin2w365725 /add
'<SYSTEM32>\net1.exe' user admin25w6425 /add
'<SYSTEM32>\net1.exe' user admin2w6573425 /add
'<SYSTEM32>\net1.exe' /pid=2688
'<SYSTEM32>\net1.exe' user admin22w5675 /add
'<SYSTEM32>\net1.exe' /pid=2808
'<SYSTEM32>\net1.exe' user admin2w546325 /add
'<SYSTEM32>\net1.exe' /pid=3304
'<SYSTEM32>\net1.exe' /pid=3176
'<SYSTEM32>\net1.exe' user admin2w53225 /add
'<SYSTEM32>\net1.exe' user admin2w876825 /add
'<SYSTEM32>\net1.exe' user adminw22755 /add
'<SYSTEM32>\net1.exe' /pid=728
'<SYSTEM32>\net1.exe' user admin2w25725 /add
'<SYSTEM32>\net1.exe' user admin2w22435 /add
'<SYSTEM32>\net1.exe' user admin2w2765765 /add
'<SYSTEM32>\net1.exe' user admin24w77425 /add
'<SYSTEM32>\net1.exe' user admin24w5225 /add
'<SYSTEM32>\net1.exe' user admin22w5645 /add
'<SYSTEM32>\net1.exe' /pid=3696
'<SYSTEM32>\net1.exe' user admin26w3425 /add
'<SYSTEM32>\net1.exe' user admin273w425 /add
'<SYSTEM32>\net1.exe' user admin23462w5 /add
'<SYSTEM32>\net1.exe' user admin24w3525 /add
'<SYSTEM32>\net1.exe' user admin224w375 /add
'<SYSTEM32>\net1.exe' user admin23w5645625 /add
'<SYSTEM32>\net1.exe' user admin25w464525 /add
'<SYSTEM32>\net1.exe' user admin22w8975 /add
'<SYSTEM32>\net1.exe' user admin27w6425 /add
'<SYSTEM32>\net1.exe' user admin24w655425 /add
'<SYSTEM32>\net1.exe' user admin28w7825 /add
'<SYSTEM32>\net1.exe' user admin22w34625 /add
'<SYSTEM32>\net1.exe' user admin29w625 /add
'<SYSTEM32>\net1.exe' user admin26w825 /add
'<SYSTEM32>\net1.exe' user admineyr /add
'<SYSTEM32>\net1.exe' user admin225235 /add
'<SYSTEM32>\net1.exe' user admin223525 /add
'<SYSTEM32>\net1.exe' user admin246325 /add
'<SYSTEM32>\net1.exe' user admin262325 /add
'<SYSTEM32>\net1.exe' user admin19 /add
'<SYSTEM32>\net1.exe' user admin18 /add
'<SYSTEM32>\net1.exe' user admin223425 /add
'<SYSTEM32>\net1.exe' user admin20 /add
'<SYSTEM32>\net1.exe' user admin234625 /add
'<SYSTEM32>\net1.exe' user admin245225 /add
'<SYSTEM32>\net1.exe' user admin225645 /add
'<SYSTEM32>\net1.exe' user admin263425 /add
'<SYSTEM32>\net1.exe' user admin234525 /add
'<SYSTEM32>\net1.exe' user admin224375 /add
'<SYSTEM32>\net1.exe' user admin273425 /add
'<SYSTEM32>\net1.exe' user admin2256545 /add
'<SYSTEM32>\net1.exe' user admin243525 /add
'<SYSTEM32>\net1.exe' user admin17 /add
'<SYSTEM32>\net1.exe' user admin5 /add
'<SYSTEM32>\net1.exe' user admin4 /add
'<SYSTEM32>\net1.exe' user admin7 /add
'<SYSTEM32>\net1.exe' user admin6 /add
'<SYSTEM32>\net1.exe' user admin1 /add
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\1.tmp\1.bat" "
'<SYSTEM32>\net1.exe' user admin3 /add
'<SYSTEM32>\net1.exe' user admin2 /add
'<SYSTEM32>\net1.exe' user admin8 /add
'<SYSTEM32>\net1.exe' user admi14 /add
'<SYSTEM32>\net1.exe' user admin13 /add
'<SYSTEM32>\net1.exe' user admin16 /add
'<SYSTEM32>\net1.exe' user admin15/add
'<SYSTEM32>\net1.exe' user admin10 /add
'<SYSTEM32>\net1.exe' user admin9 /add
'<SYSTEM32>\net1.exe' user admin12 /add
'<SYSTEM32>\net1.exe' user admin11 /add
'<SYSTEM32>\net1.exe' user admin245665325 /add
'<SYSTEM32>\net1.exe' user admin2876825 /add
'<SYSTEM32>\net1.exe' /pid=3044
'<SYSTEM32>\net1.exe' user admin245625 /add
'<SYSTEM32>\net1.exe' user admin253225 /add
'<SYSTEM32>\net1.exe' user admin222435 /add
'<SYSTEM32>\net1.exe' user admin22755 /add
'<SYSTEM32>\net1.exe' user admin2286785 /add
'<SYSTEM32>\net1.exe' user admin25647925 /add
'<SYSTEM32>\net1.exe' user admine4t /add
'<SYSTEM32>\net1.exe' /pid=3236
'<SYSTEM32>\net1.exe' user adminteye /add
'<SYSTEM32>\net1.exe' /pid=3332
'<SYSTEM32>\net1.exe' user admin209725 /add
'<SYSTEM32>\net1.exe' /pid=3108
'<SYSTEM32>\net1.exe' user admin229896785 /add
'<SYSTEM32>\net1.exe' /pid=3172
'<SYSTEM32>\net1.exe' user admin22765765 /add
'<SYSTEM32>\net1.exe' user admin228975 /add
'<SYSTEM32>\net1.exe' user admin29625 /add
'<SYSTEM32>\net1.exe' user admin24655425 /add
'<SYSTEM32>\net1.exe' user admin25464525 /add
'<SYSTEM32>\net1.exe' user admin2234625 /add
'<SYSTEM32>\net1.exe' user admin235645625 /add
'<SYSTEM32>\net1.exe' user admin26825 /add
'<SYSTEM32>\net1.exe' user admin287825 /add
'<SYSTEM32>\net1.exe' user admin276425 /add
'<SYSTEM32>\net1.exe' user admin22356355 /add
'<SYSTEM32>\net1.exe' user admin26573425 /add
'<SYSTEM32>\net1.exe' user admin225725 /add
'<SYSTEM32>\net1.exe' user admin256425 /add
'<SYSTEM32>\net1.exe' user admin225675 /add
'<SYSTEM32>\net1.exe' user admin2477425 /add
'<SYSTEM32>\net1.exe' user admin2365725 /add
'<SYSTEM32>\net1.exe' user admin2546325 /add

Injects code into

the following system processes:

<SYSTEM32>\net.exe

Modifies file system :

Creates the following files:

%TEMP%\1.tmp\1.bat

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial