Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Downloader' = '"%TEMP%\startup.exe"'
Creates the following files on removable media:
- <Drive name for removable media>:\SysPro.exe
- <Drive name for removable media>:\autorun.inf
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
Executes the following:
- <SYSTEM32>\wscript.exe "%TEMP%\DofusMod.vbs"
Terminates or attempts to terminate
the following user processes:
- bdagent.exe
- zlclient.exe
- AVP.EXE
- outpost.exe
Modifies file system :
Creates the following files:
- %TEMP%\exiterreur2.png
- %TEMP%\exitdofus2.png
- %TEMP%\exit1.png
- %TEMP%\options1.png
- %TEMP%\exitdofus1.png
- %TEMP%\croix2.png
- %TEMP%\croix1.png
- %TEMP%\decoche.png
- %TEMP%\exiterreur1.png
- %TEMP%\exit2.png
- %TEMP%\fleche1.png
- %TEMP%\parrainage1.png
- %TEMP%\options2.png
- %TEMP%\parrainage2.png
- %TEMP%\star2.png
- %TEMP%\star1.png
- %TEMP%\Jouer2.png
- %TEMP%\fleche2.png
- %TEMP%\Jouer1.png
- %TEMP%\ok1.png
- %TEMP%\ok2.png
- <DRIVERS>\svchost.exe
- <SYSTEM32>\dllcache\doc.pif
- %TEMP%\DofusMod.vbs
- %TEMP%\startup.exe
- %TEMP%\DofusMod.exe
- C:\autorun.inf
- %TEMP%\Downloader.exe
- C:\SysPro.exe
- <SYSTEM32>\dllcache\myporn.scr
- <SYSTEM32>\dllcache\recycled.exe
- %TEMP%\25boss.png
- %TEMP%\avantage2.png
- %TEMP%\avantage1.png
- %TEMP%\coche.png
- %TEMP%\config2.png
- %TEMP%\config1.png
- %TEMP%\64boss.png
- %TEMP%\50boss.png
- %TEMP%\77boss.png
- %TEMP%\annuler2.png
- %TEMP%\annuler1.png
Sets the 'hidden' attribute to the following files:
- C:\SysPro.exe
- C:\autorun.inf
Deletes the following files:
- %TEMP%\DofusMod.vbs
Network activity:
Connects to:
- 'as####27.herobo.com':80
- 'dl.##opbox.com':80
TCP:
HTTP GET requests:
- as####27.herobo.com/options1.png
- as####27.herobo.com/exitdofus1.png
- as####27.herobo.com/fleche2.png
- as####27.herobo.com/fleche1.png
- as####27.herobo.com/exitdofus2.png
- as####27.herobo.com/exiterreur1.png
- as####27.herobo.com/exit1.png
- as####27.herobo.com/exiterreur2.png
- as####27.herobo.com/Jouer2.png
- as####27.herobo.com/parrainage2.png
- as####27.herobo.com/parrainage1.png
- as####27.herobo.com/star2.png
- as####27.herobo.com/star1.png
- as####27.herobo.com/ok2.png
- as####27.herobo.com/Jouer1.png
- as####27.herobo.com/options2.png
- as####27.herobo.com/ok1.png
- as####27.herobo.com/exit2.png
- as####27.herobo.com/64boss.png
- as####27.herobo.com/50boss.png
- as####27.herobo.com/annuler1.png
- as####27.herobo.com/77boss.png
- dl.##opbox.com/u/27365203/dofusmod-autodestruction.exe
- dl.##opbox.com/u/27365203/DofusMod.vbs
- as####27.herobo.com/25boss.png
- dl.##opbox.com/u/27365203/downloader-startup.exe
- as####27.herobo.com/annuler2.png
- as####27.herobo.com/croix1.png
- as####27.herobo.com/config2.png
- as####27.herobo.com/decoche.png
- as####27.herobo.com/croix2.png
- as####27.herobo.com/avantage2.png
- as####27.herobo.com/avantage1.png
- as####27.herobo.com/config1.png
- as####27.herobo.com/coche.png
UDP:
- DNS ASK as####27.herobo.com
- DNS ASK dl.##opbox.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Indicator' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
