Trojan.DownLoader4.55935

Technical Information

To ensure autorun and distribution:

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\sfdrv01] 'Start' = '00000001'
[<HKLM>\SYSTEM\ControlSet001\Services\KupSvrLookup] 'Start' = '00000002'

Malicious functions:

Creates and executes the following:

%PROGRAM_FILES%\FeixinMedia\mysetup.exe
%PROGRAM_FILES%\Common\kupdata.exe
<Current directory>\mzone-2669.exe
%PROGRAM_FILES%\FeixinMedia\ipseccmd.exe -p Pass11 -r Pass11 -f 119.147.15.*+0 -n PASS -x -p Pass12 -r Pass12 -f 119.147.182.*+0 -n PASS -x -p Pass1 -r Pass1 -f 125.39.100.74+0 -n PASS -x -p Pass2 -r Pass2 -f 220.181.126.15+0 -n PASS -x -p Pass15 -r Pass15 -f 119.147.64.*+0 -n PASS -x -p Pass16 -r Pass16 -f 119.147.74.*+0 -n PASS -x -p Pass13 -r Pass13 -f 119.147.21.*+0 -n PASS -x -p Pass14 -r Pass14 -f 119.147.41.*+0 -n PASS -x -p Block3 -r BlockTWO -f 122.70.*.*+0 -n BLOCK -x -p Block4 -r BlockTHREE -f 124.238.*.*+0 -n BLOCK -x -p Block1 -r BlockTCP -f 119.147.*.*+0 -n BLOCK -x -p Block2 -r BlockNEW -f 119.188.*.*+0 -n BLOCK -x -p Block9 -r Block9 -f 221.194.*.*+0 -n BLOCK -x -p Block0 -r Block0 -f 118.145.*.*+0 -n BLOCK -x -p Block6 -r Block6 -f 125.39.*.*+0 -n BLOCK -x -p Block8 -r Block8 -f 220.181.*.*+0 -n BLOCK -x

Executes the following:

<SYSTEM32>\sc.exe start KupSvrLookup
<SYSTEM32>\sc.exe create sfdrv01 binpath= <SYSTEM32>\starforce\sfdrv01.sys type= kernel start= system group= Base tag= yes
<SYSTEM32>\sc.exe start sfdrv01
<SYSTEM32>\sc.exe start PolicyAgent
<SYSTEM32>\sc.exe create KupSvrLookup binpath= "%PROGRAM_FILES%\Common\kupdata.exe" type= share start= auto displayname= "ISATAP And Teredo To Cache Services"
<SYSTEM32>\sc.exe description KupSvrLookup "К№УГ IPv6 ЧЄ»»јјКхМб№©ЅшРР»ҐБЄНшдЇААёьРВТФј°Ф¤¶БјУЛЩ·юОсЎЈИз№ыНЈЦ№ёГ·юОсЈ¬ФтјЖЛг»ъЅ«І»ѕЯ±ёХвР©јјКхМб№©µДјУЛЩ№¦ДЬЎЈ"

Modifies file system :

Creates the following files:

%TEMP%\nsoF.tmp\ns11.tmp
%TEMP%\nsoF.tmp\ns10.tmp
%TEMP%\nsoF.tmp\nsExec.dll
%WINDIR%\yypro.pac
%PROGRAM_FILES%\Common\pro.txt
%TEMP%\nsoF.tmp\ns12.tmp
%TEMP%\nsoF.tmp\System.dll
%PROGRAM_FILES%\Common\kupdata.exe
%PROGRAM_FILES%\Common\sfdrv01-nos.sys
%PROGRAM_FILES%\Common\msxml2.dll
%TEMP%\nsoF.tmp\AccessControl.dll
%PROGRAM_FILES%\Common\sfdrv01.sys
%PROGRAM_FILES%\Common\suject.db
%TEMP%\nsk2.tmp\ns19.tmp
%TEMP%\nsk2.tmp\ns18.tmp
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\0J2LM5OP\wpad[1].dat
%TEMP%\nsk2.tmp\ns1C.tmp
%TEMP%\nsk2.tmp\ns1B.tmp
%TEMP%\nsk2.tmp\ns1A.tmp
%TEMP%\nsk2.tmp\ns17.tmp
%TEMP%\nsoF.tmp\ns14.tmp
%TEMP%\nsoF.tmp\ns13.tmp
<SYSTEM32>\starforce\sfdrv01.sys
%TEMP%\nsk2.tmp\ns16.tmp
%TEMP%\nsk2.tmp\ns15.tmp
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\0J2LM5OP\ol[1].asp
%TEMP%\nsa4.tmp\modern-wizard.bmp
%TEMP%\nsa4.tmp\ioSpecial.ini
%TEMP%\nsk2.tmp\Internet.dll
%PROGRAM_FILES%\FeixinMedia\ipseccmd.exe
%TEMP%\nsk2.tmp\nsisplugin.dll
%TEMP%\nsa4.tmp\InstallOptions.dll
%TEMP%\nsk2.tmp\nsRandom.dll
<Current directory>\mzone-2669.exe
%PROGRAM_FILES%\FeixinMedia\s0001.xml
%PROGRAM_FILES%\FeixinMedia\menu.xml
%PROGRAM_FILES%\FeixinMedia\un0216151000632.exe
%PROGRAM_FILES%\FeixinMedia\temp0216151000632.ini
%TEMP%\nsk2.tmp\System.dll
%TEMP%\nsk2.tmp\nsD.tmp
%TEMP%\nsk2.tmp\nsC.tmp
%TEMP%\nsk2.tmp\nsB.tmp
%PROGRAM_FILES%\Common\ypac.txt
%PROGRAM_FILES%\Common\sqlite3.dll
%PROGRAM_FILES%\FeixinMedia\mysetup.exe
%TEMP%\nsk2.tmp\nsA.tmp
%TEMP%\nsk2.tmp\ns6.tmp
%TEMP%\nsk2.tmp\ns5.tmp
%TEMP%\nsk2.tmp\nsExec.dll
%TEMP%\nsk2.tmp\ns9.tmp
%TEMP%\nsk2.tmp\ns8.tmp
%TEMP%\nsk2.tmp\ns7.tmp