Trojan.DownLoader6.59714

Technical Information

To ensure autorun and distribution:

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\GFdert] 'Start' = '00000002'

Malicious functions:

To bypass firewall, removes or modifies the following registry keys:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] 'C:\System\gfdert.exe' = 'C:\System\gfdert.exe:*:Enabled:GFdert'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '\System\gfdert.exe' = '\System\gfdert.exe:*:Enabled:GFdert'

Creates and executes the following:

C:\System\gfdert.exe

Modifies file system :

Creates the following files:

C:\System\gfdert.exe

Sets the 'hidden' attribute to the following files:

C:\System\gfdert.exe

Deletes itself.

Network activity:

Connects to:

'12#.0.0.87':2967
'12#.0.0.81':2967
'12#.0.0.88':2967
'12#.0.0.85':2967
'12#.0.0.89':2967
'12#.0.0.84':2967
'12#.0.0.92':2967
'12#.0.0.83':2967
'12#.0.0.90':2967
'12#.0.0.82':2967
'12#.0.0.71':2967
'12#.0.0.68':2967
'12#.0.0.76':2967
'12#.0.0.72':2967
'12#.0.0.70':2967
'12#.0.0.80':2967
'12#.0.0.86':2967
'12#.0.0.79':2967
'12#.0.0.78':2967
'12#.0.0.77':2967
'12#.0.0.105':2967
'12#.0.0.108':2967
'12#.0.0.103':2967
'12#.0.0.102':2967
'12#.0.0.104':2967
'12#.0.0.107':2967
'12#.0.0.111':2967
'12#.0.0.106':2967
'12#.0.0.109':2967
'12#.0.0.110':2967
'12#.0.0.95':2967
'12#.0.0.97':2967
'12#.0.0.91':2967
'12#.0.0.93':2967
'12#.0.0.94':2967
'12#.0.0.100':2967
'12#.0.0.101':2967
'12#.0.0.99':2967
'12#.0.0.96':2967
'12#.0.0.98':2967
'12#.0.0.41':5900
'12#.0.0.49':5900
'12#.0.0.38':5900
'12#.0.0.43':5900
'12#.0.0.48':5900
'12#.0.0.54':5900
'12#.0.0.52':5900
'12#.0.0.44':5900
'12#.0.0.45':5900
'12#.0.0.39':5900
'12#.0.0.35':5900
'12#.0.0.36':5900
'12#.0.0.34':5900
'12#.0.0.32':5900
'12#.0.0.33':5900
'12#.0.0.46':5900
'12#.0.0.40':5900
'12#.0.0.47':5900
'12#.0.0.42':5900
'12#.0.0.37':5900
'12#.0.0.65':2967
'12#.0.0.66':2967
'12#.0.0.62':5900
'12#.0.0.53':5900
'12#.0.0.58':5900
'12#.0.0.75':2967
'12#.0.0.74':2967
'12#.0.0.69':2967
'12#.0.0.67':2967
'12#.0.0.73':2967
'12#.0.0.56':5900
'12#.0.0.59':5900
'12#.0.0.50':5900
'12#.0.0.57':5900
'12#.0.0.51':5900
'12#.0.0.63':5900
'12#.0.0.61':5900
'12#.0.0.60':5900
'12#.0.0.64':5900
'12#.0.0.55':5900
'12#.0.0.113':2967
'12#.0.0.102':2968
'12#.0.0.105':2968
'12#.0.0.101':2968
'12#.0.0.99':2968
'12#.0.0.100':2968
'12#.0.0.109':2968
'12#.0.0.106':2968
'12#.0.0.108':2968
'12#.0.0.104':2968
'12#.0.0.110':2968
'12#.0.0.93':2968
'12#.0.0.91':2968
'12#.0.0.92':2968
'12#.0.0.88':2968
'12#.0.0.83':2968
'12#.0.0.96':2968
'12#.0.0.98':2968
'12#.0.0.97':2968
'12#.0.0.94':2968
'12#.0.0.95':2968
'12#.0.0.121':2968
'12#.0.0.112':2968
'12#.0.0.125':2968
'12#.0.0.124':2968
'12#.0.0.114':2968
'12#.0.0.128':2968
'12#.0.0.120':2968
'12#.0.0.127':2968
'12#.0.0.126':2968
'12#.0.0.116':2968
'12#.0.0.113':2968
'12#.0.0.115':2968
'12#.0.0.111':2968
'12#.0.0.107':2968
'12#.0.0.103':2968
'12#.0.0.122':2968
'12#.0.0.123':2968
'12#.0.0.119':2968
'12#.0.0.117':2968
'12#.0.0.118':2968
'12#.0.0.120':2967
'12#.0.0.127':2967
'12#.0.0.126':2967
'12#.0.0.124':2967
'12#.0.0.125':2967
'12#.0.0.67':2968
'12#.0.0.73':2968
'12#.0.0.66':2968
'12#.0.0.128':2967
'12#.0.0.65':2968
'12#.0.0.118':2967
'12#.0.0.116':2967
'12#.0.0.117':2967
'12#.0.0.115':2967
'12#.0.0.112':2967
'12#.0.0.121':2967
'12#.0.0.123':2967
'12#.0.0.122':2967
'12#.0.0.114':2967
'12#.0.0.119':2967
'12#.0.0.89':2968
'12#.0.0.80':2968
'12#.0.0.85':2968
'12#.0.0.86':2968
'12#.0.0.79':2968
'12#.0.0.84':2968
'12#.0.0.82':2968
'12#.0.0.81':2968
'12#.0.0.87':2968
'12#.0.0.90':2968
'12#.0.0.71':2968
'12#.0.0.76':2968
'12#.0.0.74':2968
'12#.0.0.75':2968
'12#.0.0.69':2968
'12#.0.0.72':2968
'12#.0.0.70':2968
'12#.0.0.78':2968
'12#.0.0.68':2968
'12#.0.0.77':2968
'12#.0.0.52':2967
'12#.0.0.53':2967
'12#.0.0.51':2967
'12#.0.0.49':2967
'12#.0.0.50':2967
'12#.0.0.57':2967
'12#.0.0.58':2967
'12#.0.0.56':2967
'12#.0.0.54':2967
'12#.0.0.55':2967
'12#.0.0.42':2967
'12#.0.0.43':2967
'12#.0.0.41':2967
'12#.0.0.39':2967
'12#.0.0.40':2967
'12#.0.0.47':2967
'12#.0.0.48':2967
'12#.0.0.46':2967
'12#.0.0.44':2967
'12#.0.0.45':2967
'12#.0.0.10':2968
'12#.0.0.9':2968
'12#.0.0.8':2968
'12#.0.0.5':2968
'12#.0.0.3':2968
'12#.0.0.14':2968
'12#.0.0.13':2968
'12#.0.0.12':2968
'12#.0.0.7':2968
'12#.0.0.11':2968
'12#.0.0.62':2967
'12#.0.0.63':2967
'12#.0.0.61':2967
'12#.0.0.59':2967
'12#.0.0.60':2967
'12#.0.0.4':2968
'12#.0.0.6':2968
'12#.0.0.2':2968
'12#.0.0.64':2967
'localhost':2968
'12#.0.0.12':2967
'12#.0.0.13':2967
'12#.0.0.11':2967
'12#.0.0.9':2967
'12#.0.0.10':2967
'12#.0.0.17':2967
'12#.0.0.18':2967
'12#.0.0.16':2967
'12#.0.0.14':2967
'12#.0.0.15':2967
'12#.0.0.2':2967
'12#.0.0.3':2967
'localhost':2967
'92.##.118.183':3179
'74.##5.232.51':80
'12#.0.0.7':2967
'12#.0.0.8':2967
'12#.0.0.6':2967
'12#.0.0.4':2967
'12#.0.0.5':2967
'12#.0.0.32':2967
'12#.0.0.33':2967
'12#.0.0.31':2967
'12#.0.0.29':2967
'12#.0.0.30':2967
'12#.0.0.37':2967
'12#.0.0.38':2967
'12#.0.0.36':2967
'12#.0.0.34':2967
'12#.0.0.35':2967
'12#.0.0.22':2967
'12#.0.0.23':2967
'12#.0.0.21':2967
'12#.0.0.19':2967
'12#.0.0.20':2967
'12#.0.0.27':2967
'12#.0.0.28':2967
'12#.0.0.26':2967
'12#.0.0.24':2967
'12#.0.0.25':2967
'12#.0.0.15':2968
'12#.0.0.11':5900
'12#.0.0.3':5900
'12#.0.0.7':5900
'12#.0.0.5':5900
'12#.0.0.9':5900
'12#.0.0.8':5900
'12#.0.0.10':5900
'12#.0.0.6':5900
'12#.0.0.4':5900
'12#.0.0.14':5900
'12#.0.0.60':2968
'12#.0.0.61':2968
'12#.0.0.54':2968
'12#.0.0.58':2968
'12#.0.0.56':2968
'12#.0.0.59':2968
'localhost':5900
'12#.0.0.64':2968
'12#.0.0.62':2968
'12#.0.0.63':2968
'12#.0.0.20':5900
'12#.0.0.27':5900
'12#.0.0.24':5900
'12#.0.0.25':5900
'12#.0.0.21':5900
'12#.0.0.30':5900
'12#.0.0.31':5900
'12#.0.0.26':5900
'12#.0.0.29':5900
'12#.0.0.28':5900
'12#.0.0.19':5900
'12#.0.0.18':5900
'12#.0.0.13':5900
'12#.0.0.2':5900
'12#.0.0.12':5900
'12#.0.0.15':5900
'12#.0.0.23':5900
'12#.0.0.17':5900
'12#.0.0.22':5900
'12#.0.0.16':5900
'12#.0.0.29':2968
'12#.0.0.30':2968
'12#.0.0.28':2968
'12#.0.0.27':2968
'12#.0.0.26':2968
'12#.0.0.34':2968
'12#.0.0.35':2968
'12#.0.0.33':2968
'12#.0.0.31':2968
'12#.0.0.32':2968
'12#.0.0.18':2968
'12#.0.0.20':2968
'12#.0.0.19':2968
'12#.0.0.16':2968
'12#.0.0.17':2968
'12#.0.0.22':2968
'12#.0.0.25':2968
'12#.0.0.21':2968
'12#.0.0.24':2968
'12#.0.0.23':2968
'12#.0.0.44':2968
'12#.0.0.51':2968
'12#.0.0.39':2968
'12#.0.0.49':2968
'12#.0.0.45':2968
'12#.0.0.53':2968
'12#.0.0.57':2968
'12#.0.0.55':2968
'12#.0.0.52':2968
'12#.0.0.50':2968
'12#.0.0.47':2968
'12#.0.0.43':2968
'12#.0.0.38':2968
'12#.0.0.36':2968
'12#.0.0.37':2968
'12#.0.0.46':2968
'12#.0.0.48':2968
'12#.0.0.40':2968
'12#.0.0.41':2968
'12#.0.0.42':2968

UDP:

DNS ASK www.google.com

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical Information

Curing recommendations

Free trial