Trojan.DownLoader18.15745

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'WebClient Filtering Registrar Debugger UPnP' = '<SYSTEM32>\gzozdlkbol.exe'

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\Compatibility Computer Instrumentation SPP] 'Start' = '00000002'

Malicious functions:

To complicate detection of its presence in the operating system,

blocks the following features:

Windows Security Center

Creates and executes the following:

'<SYSTEM32>\wyylmadtqq.exe' "<SYSTEM32>\gzozdlkbol.exe"
'%WINDIR%\Temp\jjhsba2r8xaj8.exe' -r 23961 tcp
'%TEMP%\jjhsba2k0iaj8knp3nb.exe'
'<SYSTEM32>\gzozdlkbol.exe'

Modifies file system :

Creates the following files:

<SYSTEM32>\tsufmnywefwseze\run
<SYSTEM32>\tsufmnywefwseze\rng
%WINDIR%\Temp\jjhsba2r8xaj8.exe
<SYSTEM32>\tsufmnywefwseze\cfg
<SYSTEM32>\wyylmadtqq.exe
%TEMP%\jjhsba2k0iaj8knp3nb.exe
<SYSTEM32>\tsufmnywefwseze\tst
<SYSTEM32>\gzozdlkbol.exe
<SYSTEM32>\tsufmnywefwseze\etc

Sets the 'hidden' attribute to the following files:

<SYSTEM32>\wyylmadtqq.exe
<SYSTEM32>\gzozdlkbol.exe

Deletes the following files:

%WINDIR%\Temp\jjhsba2r8xaj8.exe
<DRIVERS>\etc\hosts
%TEMP%\jjhsba2k0iaj8knp3nb.exe

Substitutes the HOSTS file.

Network activity:

Connects to:

'wa###next.net':80
'fa###ext.net':80
'wa###cook.net':80
'fa###ook.net':80
'dr###tall.net':80
'th###all.net':80
'wa###been.net':80
'fa###een.net':80
'sp###next.net':80
'vi###next.net':80
'sp###cook.net':80
'vi###cook.net':80
'wa###tall.net':80
'fa###all.net':80
'sp###been.net':80
'vi###been.net':80
'ar###sugar.net':80
'so###sugar.net':80
'ar###pass.net':80
'so###pass.net':80
'up###gain.net':80
'wh###again.net':80
'ar###stand.net':80
'so###stand.net':80
'dr###next.net':80
'th###ext.net':80
'dr###cook.net':80
'th###ook.net':80
'ar###again.net':80
'so###again.net':80
'dr###been.net':80
'th###een.net':80
'be##lxc.com':80
'sa###ext.net':80
'al###being.net':80
'ri###nstorm.net':80
'gl###all.net':80
'ta###tall.net':80
'sp###een.net':80
'sa###een.net':80
'mo###ugust.net':80
'mi###hown.net':80
'cr#####onaraminta.net':80
'le###form.net':80
'pr####tbottom.net':80
'ca####nbring.net':80
'ab###ell.net':80
'mo###olor.net':80
'eq###next.net':80
'gr###next.net':80
'eq###cook.net':80
'gr###cook.net':80
'sp###tall.net':80
'vi###tall.net':80
'eq###been.net':80
'gr###been.net':80
'gl###ext.net':80
'ta###next.net':80
'gl###ook.net':80
'ta###cook.net':80
'eq###tall.net':80
'gr###tall.net':80
'gl###een.net':80
'ta###been.net':80

TCP:

HTTP GET requests:

http://wa###next.net/index.php
http://fa###ext.net/index.php
http://wa###cook.net/index.php
http://fa###ook.net/index.php
http://dr###tall.net/index.php
http://th###all.net/index.php
http://wa###been.net/index.php
http://fa###een.net/index.php
http://sp###next.net/index.php
http://vi###next.net/index.php
http://sp###cook.net/index.php
http://vi###cook.net/index.php
http://wa###tall.net/index.php
http://fa###all.net/index.php
http://sp###been.net/index.php
http://vi###been.net/index.php
http://ar###sugar.net/index.php
http://so###sugar.net/index.php
http://ar###pass.net/index.php
http://so###pass.net/index.php
http://up###gain.net/index.php
http://wh###again.net/index.php
http://ar###stand.net/index.php
http://so###stand.net/index.php
http://dr###next.net/index.php
http://th###ext.net/index.php
http://dr###cook.net/index.php
http://th###ook.net/index.php
http://ar###again.net/index.php
http://so###again.net/index.php
http://dr###been.net/index.php
http://th###een.net/index.php
http://be##lxc.com/index.php
http://sa###ext.net/index.php
http://al###being.net/index.php
http://ri###nstorm.net/index.php
http://gl###all.net/index.php
http://ta###tall.net/index.php
http://sp###een.net/index.php
http://sa###een.net/index.php
http://mo###ugust.net/index.php
http://mi###hown.net/index.php
http://cr#####onaraminta.net/index.php
http://le###form.net/index.php
http://pr####tbottom.net/index.php
http://ca####nbring.net/index.php
http://ab###ell.net/index.php
http://mo###olor.net/index.php
http://eq###next.net/index.php
http://gr###next.net/index.php
http://eq###cook.net/index.php
http://gr###cook.net/index.php
http://sp###tall.net/index.php
http://vi###tall.net/index.php
http://eq###been.net/index.php
http://gr###been.net/index.php
http://gl###ext.net/index.php
http://ta###next.net/index.php
http://gl###ook.net/index.php
http://ta###cook.net/index.php
http://eq###tall.net/index.php
http://gr###tall.net/index.php
http://gl###een.net/index.php
http://ta###been.net/index.php

UDP:

DNS ASK wa###next.net
DNS ASK fa###ext.net
DNS ASK wa###cook.net
DNS ASK fa###ook.net
DNS ASK dr###tall.net
DNS ASK th###all.net
DNS ASK wa###been.net
DNS ASK fa###een.net
DNS ASK sp###next.net
DNS ASK vi###next.net
DNS ASK sp###cook.net
DNS ASK vi###cook.net
DNS ASK wa###tall.net
DNS ASK fa###all.net
DNS ASK sp###been.net
DNS ASK vi###been.net
DNS ASK dr###cook.net
DNS ASK so###sugar.net
DNS ASK ar###stand.net
DNS ASK so###pass.net
DNS ASK ar###sugar.net
DNS ASK wh###again.net
DNS ASK up###ass.net
DNS ASK so###stand.net
DNS ASK up###gain.net
DNS ASK th###ext.net
DNS ASK dr###been.net
DNS ASK th###ook.net
DNS ASK dr###next.net
DNS ASK so###again.net
DNS ASK ar###pass.net
DNS ASK th###een.net
DNS ASK ar###again.net
DNS ASK be##lxc.com
DNS ASK sa###ext.net
DNS ASK al###being.net
DNS ASK ri###nstorm.net
DNS ASK gl###all.net
DNS ASK ta###tall.net
DNS ASK sp###een.net
DNS ASK sa###een.net
DNS ASK mo###ugust.net
DNS ASK mi###hown.net
DNS ASK cr#####onaraminta.net
DNS ASK le###form.net
DNS ASK pr####tbottom.net
DNS ASK ca####nbring.net
DNS ASK ab###ell.net
DNS ASK mo###olor.net
DNS ASK eq###next.net
DNS ASK gr###next.net
DNS ASK eq###cook.net
DNS ASK gr###cook.net
DNS ASK sp###tall.net
DNS ASK vi###tall.net
DNS ASK eq###been.net
DNS ASK gr###been.net
DNS ASK gl###ext.net
DNS ASK ta###next.net
DNS ASK gl###ook.net
DNS ASK ta###cook.net
DNS ASK eq###tall.net
DNS ASK gr###tall.net
DNS ASK gl###een.net
DNS ASK ta###been.net
'23#.#55.255.250':1900

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical Information

Curing recommendations

Free trial