Trojan.DownLoader4.9662

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Classes\FlashGet.Document\shell\open\command] '' = '"%TEMP%\FLASHG~1\flashget.exe" "%1"'

Modifies file system :

Creates the following files:

%TEMP%\FlashGet Portable\language\JCSRL.INI
%TEMP%\FlashGet Portable\language\JCSVK.INI
%TEMP%\FlashGet Portable\language\JCRUS.INI
%TEMP%\FlashGet Portable\language\JCSLO.INI
%TEMP%\FlashGet Portable\language\JCTUR.INI
%TEMP%\FlashGet Portable\language\JCUKR.INI
%TEMP%\FlashGet Portable\language\JCSWE.INI
%TEMP%\FlashGet Portable\language\JCTHI.INI
%TEMP%\FlashGet Portable\language\JCROM.INI
%TEMP%\FlashGet Portable\language\JCLTU.INI
%TEMP%\FlashGet Portable\language\JCNLD.INI
%TEMP%\FlashGet Portable\language\JCKOR.INI
%TEMP%\FlashGet Portable\language\JCLAT.INI
%TEMP%\FlashGet Portable\language\JCPOB.INI
%TEMP%\FlashGet Portable\language\JCPTP.INI
%TEMP%\FlashGet Portable\language\JCNOR.INI
%TEMP%\FlashGet Portable\language\JCPLS.INI
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\flashget1[1].ini
%TEMP%\FlashGet Portable\FGUpdate1.ini
%TEMP%\FlashGet Portable\FGMule\config\update\core.svr
%TEMP%\FlashGet Portable\FGMule\config\FGEMCORE.cfg
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\flashget3[1].ini
%TEMP%\FlashGet Portable\FGUpdate3.ini
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\flashget2[1].ini
%TEMP%\FlashGet Portable\FGUpdate2.ini
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\fgmule_list[1].htm
%TEMP%\FlashGet Portable\Skin\Normal.ini
%TEMP%\FlashGet Portable\sounds\Benchmark.wav
%TEMP%\FlashGet Portable\Skin\LEFTBACK.JPG
%TEMP%\FlashGet Portable\Skin\LOGO_BG.GIF
%TEMP%\FlashGet Portable\FGMule\config\core.cfg
%TEMP%\FlashGet Portable\fgbhocfg.ini
%TEMP%\FlashGet Portable\sounds\Done.wav
%TEMP%\FlashGet Portable\Config\BITS.ini
%TEMP%\FlashGet Portable\language\JCJPN.INI
%TEMP%\FlashGet Portable\dbghelp.dll
%TEMP%\FlashGet Portable\debugrpt.dll
%TEMP%\FlashGet Portable\Table.jcs
%TEMP%\FlashGet Portable\WHATSNEW.TXT
%TEMP%\FlashGet Portable\flashget.exe
%TEMP%\FlashGet Portable\flashget.exe.manifest
%TEMP%\FlashGet Portable\fgmgr.dll
%TEMP%\FlashGet Portable\fgupdate.dll
%TEMP%\FlashGet Portable\Readme.txt
%TEMP%\nsy3.tmp\AdvSplash.dll
%TEMP%\FlashGet Portable\FGBTCORE.dll
%TEMP%\nsi2.tmp
%TEMP%\FlashgetPortable.bmp
%TEMP%\FlashGet Portable\JC_LINK.HTM
%TEMP%\FlashGet Portable\Normal.jcs
%TEMP%\FlashGet Portable\FGEMCORE.dll
%TEMP%\FlashGet Portable\JC_ALL.HTM
%TEMP%\FlashGet Portable\language\JCENG.INI
%TEMP%\FlashGet Portable\language\JCESP.INI
%TEMP%\FlashGet Portable\language\JCDEU.INI
%TEMP%\FlashGet Portable\language\JCELL.INI
%TEMP%\FlashGet Portable\language\JCHEB.INI
%TEMP%\FlashGet Portable\language\JCITA.INI
%TEMP%\FlashGet Portable\language\JCFIN.INI
%TEMP%\FlashGet Portable\language\JCFRA.INI
%TEMP%\FlashGet Portable\language\JCDAX.INI
%TEMP%\FlashGet Portable\license.txt
%TEMP%\FlashGet Portable\language\JCBUL.INI
%TEMP%\FlashGet Portable\getflash.dll
%TEMP%\FlashGet Portable\jccatch.dll
%TEMP%\FlashGet Portable\language\JCCHT.INI
%TEMP%\FlashGet Portable\language\JCCZE.INI
%TEMP%\FlashGet Portable\language\JCCAT.INI
%TEMP%\FlashGet Portable\language\JCCHS.INI

Deletes the following files:

%TEMP%\FlashGet Portable\FGMule\config\update\core.svr

Network activity:

Connects to:

'bb#.##ashget.com':80
'dl.##ashget.com':80
'localhost':1039
'es#.#cominc.com':53

TCP:

HTTP GET requests:

dl.##ashget.com/flashget/flashget2.ini?m=#########################################
dl.##ashget.com/flashget/flashget3.ini?m=#########################################
bb#.##ashget.com/config/fgmule_list.htm
dl.##ashget.com/flashget/flashget1.ini?m=#########################################

UDP: