Trojan.DownLoader4.51210

Technical Information

To ensure autorun and distribution:

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\kaccore] 'Start' = '00000002'

Malicious functions:

To bypass firewall, removes or modifies the following registry keys:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\Kingsoft\KAC\Service\kaccore.exe' = '%PROGRAM_FILES%\Kingsoft\KAC\Service\kaccore.exe:*:Enabled:Kingsoft Uplive Service'

Creates and executes the following:

%PROGRAM_FILES%\Kingsoft\KAC\KSA\ksamain.exe -install
%PROGRAM_FILES%\Kingsoft\KAC\Service\kaccore.exe /service

Executes the following:

%WINDIR%\regedit.exe /s "%PROGRAM_FILES%\Kingsoft\KAC\Service\regall.reg"

Modifies file system :

Creates the following files:

%ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\images\is-TGJ3K.tmp
%ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\images\is-IRIDO.tmp
%ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\images\is-TD8ME.tmp
%ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\images\is-A4PKE.tmp
%ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\images\is-68MNM.tmp
%ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\js\is-NRTBC.tmp
%ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\js\is-TN82P.tmp
%ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\images\is-5OQTM.tmp
%ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\images\is-2E10U.tmp
%ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\images\is-9E6QA.tmp
%ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\images\is-JB3J2.tmp
%ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\images\is-BVKAG.tmp
%ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\images\is-QF32E.tmp
%ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\images\is-VBDL2.tmp
%ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\images\is-FBL98.tmp
%ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\images\is-1V6ET.tmp
%ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\images\is-4AAU9.tmp
%ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\images\is-7US8I.tmp
%ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\is-4OTIG.tmp
%ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\is-SK2FL.tmp
%ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\is-OJ9A4.tmp
%ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\is-F5TQA.tmp
%ALLUSERSPROFILE%\Desktop\ЅрЙЅВ©¶ґРЮёґ.lnk
%PROGRAM_FILES%\Kingsoft\KAC\Service\installapp.ini
%PROGRAM_FILES%\Kingsoft\KAC\KSA\unins000.dat
%ALLUSERSPROFILE%\Start Menu\Programs\ЅрЙЅВ©¶ґЙЁГи\ЅрЙЅВ©¶ґРЮёґ.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\ЅрЙЅВ©¶ґЙЁГи\Р¶ФШЅрЙЅВ©¶ґРЮёґ.lnk
%ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\js\intf\is-LSP5G.tmp
%ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\js\intf\is-7TECE.tmp
%ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\js\is-KON83.tmp
%ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\js\is-MKAJV.tmp
%ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\js\lang\is-U7URD.tmp
%ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\js\mod\is-0UVTE.tmp
%ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\js\mod\is-PPP3B.tmp
%ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\js\lang\is-HKP3E.tmp
%ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\js\lib\is-UJBTT.tmp
%ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\images\is-BFBMC.tmp
%PROGRAM_FILES%\Kingsoft\KAC\Service\is-V7RHK.tmp
%PROGRAM_FILES%\Kingsoft\KAC\Service\is-T7RUJ.tmp
%PROGRAM_FILES%\Kingsoft\KAC\Service\is-995GU.tmp
%PROGRAM_FILES%\Kingsoft\KAC\Service\is-7R6HM.tmp
%PROGRAM_FILES%\Kingsoft\KAC\Service\is-P0R1L.tmp
%PROGRAM_FILES%\Kingsoft\KAC\Service\is-ERJ4B.tmp
%PROGRAM_FILES%\Kingsoft\KAC\Service\is-LUHPC.tmp
%PROGRAM_FILES%\Kingsoft\KAC\Service\is-44FS8.tmp
%PROGRAM_FILES%\Kingsoft\KAC\Service\is-LBUPC.tmp
%TEMP%\is-S0N97.tmp\ksa88.exe.tmp
%TEMP%\is-RT6HG.tmp\_isetup\_RegDLL.tmp
%TEMP%\ksa88.exe
%TEMP%\nsp2.tmp\System.dll
%TEMP%\is-RT6HG.tmp\_isetup\_shfoldr.dll
%PROGRAM_FILES%\Kingsoft\KAC\Service\is-5A0PH.tmp
%PROGRAM_FILES%\Kingsoft\KAC\Service\is-AVJN2.tmp
%TEMP%\is-RT6HG.tmp\inst.bmp
%PROGRAM_FILES%\Kingsoft\KAC\KSA\is-JE6DF.tmp
%ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\images\is-AJM05.tmp
%ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\images\is-DF2GN.tmp
%ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\images\is-4JUVV.tmp
%ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\images\is-VBK29.tmp
%ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\images\is-2QNBP.tmp
%ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\images\is-0P9A5.tmp
%ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\images\is-6MQE0.tmp
%ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\images\is-JIMSB.tmp
%ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\images\is-PGGTE.tmp
%PROGRAM_FILES%\Kingsoft\KAC\KSA\is-4TO71.tmp
%PROGRAM_FILES%\Kingsoft\KAC\KSA\is-37SHS.tmp
%PROGRAM_FILES%\Kingsoft\KAC\KSA\is-QRFPS.tmp
%PROGRAM_FILES%\Kingsoft\KAC\KSA\is-AI5GH.tmp
%PROGRAM_FILES%\Kingsoft\KAC\KSA\is-4DSBA.tmp
%ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\images\is-6C48S.tmp
%ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\images\is-UTQ5B.tmp
%PROGRAM_FILES%\Kingsoft\KAC\KSA\is-RNLQQ.tmp
%ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\css\is-LS1PE.tmp