Trojan.DownLoader24.63859

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Extensible Redirector Drive Installer' = 'C:\vdhrkzuduvp5e\rvcgozxq.exe'

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\Support Connections Human] 'ImagePath' = 'C:\vdhrkzuduvp5e\rvcgozxq.exe'
[<HKLM>\SYSTEM\ControlSet001\Services\Support Connections Human] 'Start' = '00000002'

Malicious functions:

Executes the following:

'C:\vdhrkzuduvp5e\ncsw2eyjya.exe' "c:\vdhrkzuduvp5e\rvcgozxq.exe"
'C:\vdhrkzuduvp5e\rvcgozxq.exe'
'C:\vdhrkzuduvp5e\w0bkgxjk30avfb4xxbbog2vss.exe'

Modifies file system:

Creates the following files:

C:\vdhrkzuduvp5e\rvcgozxq.exe
C:\vdhrkzuduvp5e\ncsw2eyjya.exe
C:\vdhrkzuduvp5e\eugyt4qsrn
%WINDIR%\vdhrkzuduvp5e\bjalmqtlax
C:\vdhrkzuduvp5e\bjalmqtlax
C:\vdhrkzuduvp5e\w0bkgxjk30avfb4xxbbog2vss.exe

Sets the 'hidden' attribute to the following files:

C:\vdhrkzuduvp5e\ncsw2eyjya.exe
C:\vdhrkzuduvp5e\rvcgozxq.exe

Deletes the following files:

C:\vdhrkzuduvp5e\w0bkgxjk30avfb4xxbbog2vss.exe
%WINDIR%\vdhrkzuduvp5e\bjalmqtlax

Network activity:

Connects to:

'ma#####newilkinson.net':80
'an#####temathewson.net':80
'ca#####necaulfield.net':80
'an#####tewilkinson.net':80
'ma#####nemathewson.net':80
'an#####tecaulfield.net':80
'ma#####necaulfield.net':80
'an#####tewilkerson.net':80
'ma#####newilkerson.net':80
'ca#####nawilkinson.net':80
'ca#####newilkinson.net':80
'ma#####iancaulfield.net':80
'ki#####eecaulfield.net':80
'ca#####namathewson.net':80
'ca#####newilkerson.net':80
'ca#####nacaulfield.net':80
'ca#####nemathewson.net':80
'ca#####nawilkerson.net':80
'ch#####tewilkinson.net':80
'ki#####ynwilkerson.net':80
'gl#####lewilkerson.net':80
'ki#####ynmathewson.net':80
'gl#####lemathewson.net':80
'ki#####yncaulfield.net':80
'ge#####vewilkinson.net':80
'je#####nemathewson.net':80
'gl#####lecaulfield.net':80
'je#####newilkinson.net':80
'st#####iemathewson.net':80
'ch#####tewilkerson.net':80
'st#####iewilkinson.net':80
'ch#####temathewson.net':80
'st#####iewilkerson.net':80
'ki#####ynwilkinson.net':80
'gl#####lewilkinson.net':80
'ch#####tecaulfield.net':80
'st#####iecaulfield.net':80
'ki#####eewilkerson.net':80
'ge#####vecathleen.net':80
'je#####netallulah.net':80
'ge#####vemarianna.net':80
'je#####necathleen.net':80
'ge#####vetallulah.net':80
'ze#####ahmarianna.net':80
'ma#####kemarianna.net':80
'je#####necharleen.net':80
'ge#####vecharleen.net':80
'ki#####yncathleen.net':80
'gl#####lecathleen.net':80
'ki#####ynmarianna.net':80
'gl#####lemarianna.net':80
'ki#####yntallulah.net':80
'gl#####lecharleen.net':80
'je#####nemarianna.net':80
'gl#####letallulah.net':80
'ki#####yncharleen.net':80
'ze#####ahcathleen.net':80
'kr#####hercaulfield.net':80
'ca#####racaulfield.net':80
'kr#####herwilkerson.net':80
'ca#####rawilkerson.net':80
'ma#####ianwilkinson.net':80
'ki#####eemathewson.net':80
'ma#####ianwilkerson.net':80
'ki#####eewilkinson.net':80
'ma#####ianmathewson.net':80
'ma#####ketallulah.net':80
'ze#####ahcharleen.net':80
'ma#####kecathleen.net':80
'ze#####ahtallulah.net':80
'ma#####kecharleen.net':80
'kr#####hermathewson.net':80
'ca#####ramathewson.net':80
'kr#####herwilkinson.net':80
'ca#####rawilkinson.net':80

TCP:

HTTP GET requests:

http://ma#####newilkinson.net/index.php
http://an#####temathewson.net/index.php
http://ca#####necaulfield.net/index.php
http://an#####tewilkinson.net/index.php
http://ma#####nemathewson.net/index.php
http://an#####tecaulfield.net/index.php
http://ma#####necaulfield.net/index.php
http://an#####tewilkerson.net/index.php
http://ma#####newilkerson.net/index.php
http://ca#####nawilkinson.net/index.php
http://ca#####newilkinson.net/index.php
http://ma#####iancaulfield.net/index.php
http://ki#####eecaulfield.net/index.php
http://ca#####namathewson.net/index.php
http://ca#####newilkerson.net/index.php
http://ca#####nacaulfield.net/index.php
http://ca#####nemathewson.net/index.php
http://ca#####nawilkerson.net/index.php
http://ch#####tewilkinson.net/index.php
http://ki#####ynwilkerson.net/index.php
http://gl#####lewilkerson.net/index.php
http://ki#####ynmathewson.net/index.php
http://gl#####lemathewson.net/index.php
http://ki#####yncaulfield.net/index.php
http://ge#####vewilkinson.net/index.php
http://je#####nemathewson.net/index.php
http://gl#####lecaulfield.net/index.php
http://je#####newilkinson.net/index.php
http://st#####iemathewson.net/index.php
http://ch#####tewilkerson.net/index.php
http://st#####iewilkinson.net/index.php
http://ch#####temathewson.net/index.php
http://st#####iewilkerson.net/index.php
http://ki#####ynwilkinson.net/index.php
http://gl#####lewilkinson.net/index.php
http://ch#####tecaulfield.net/index.php
http://st#####iecaulfield.net/index.php
http://ki#####eewilkerson.net/index.php
http://ge#####vecathleen.net/index.php
http://je#####netallulah.net/index.php
http://ge#####vemarianna.net/index.php
http://je#####necathleen.net/index.php
http://ge#####vetallulah.net/index.php
http://ze#####ahmarianna.net/index.php
http://ma#####kemarianna.net/index.php
http://je#####necharleen.net/index.php
http://ge#####vecharleen.net/index.php
http://ki#####yncathleen.net/index.php
http://gl#####lecathleen.net/index.php
http://ki#####ynmarianna.net/index.php
http://gl#####lemarianna.net/index.php
http://ki#####yntallulah.net/index.php
http://gl#####lecharleen.net/index.php
http://je#####nemarianna.net/index.php
http://gl#####letallulah.net/index.php
http://ki#####yncharleen.net/index.php
http://ze#####ahcathleen.net/index.php
http://kr#####hercaulfield.net/index.php
http://ca#####racaulfield.net/index.php
http://kr#####herwilkerson.net/index.php
http://ca#####rawilkerson.net/index.php
http://ma#####ianwilkinson.net/index.php
http://ki#####eemathewson.net/index.php
http://ma#####ianwilkerson.net/index.php
http://ki#####eewilkinson.net/index.php
http://ma#####ianmathewson.net/index.php
http://ma#####ketallulah.net/index.php
http://ze#####ahcharleen.net/index.php
http://ma#####kecathleen.net/index.php
http://ze#####ahtallulah.net/index.php
http://ma#####kecharleen.net/index.php
http://kr#####hermathewson.net/index.php
http://ca#####ramathewson.net/index.php
http://kr#####herwilkinson.net/index.php
http://ca#####rawilkinson.net/index.php

UDP:

DNS ASK an#####temathewson.net
DNS ASK ma#####nemathewson.net
DNS ASK an#####tewilkinson.net
DNS ASK ma#####newilkinson.net
DNS ASK an#####tewilkerson.net
DNS ASK ma#####necaulfield.net
DNS ASK ch#####tewilkinson.net
DNS ASK ma#####newilkerson.net
DNS ASK an#####tecaulfield.net
DNS ASK ca#####necaulfield.net
DNS ASK ca#####nawilkinson.net
DNS ASK ca#####newilkinson.net
DNS ASK ma#####iancaulfield.net
DNS ASK ki#####eecaulfield.net
DNS ASK ca#####namathewson.net
DNS ASK ca#####newilkerson.net
DNS ASK ca#####nacaulfield.net
DNS ASK ca#####nemathewson.net
DNS ASK ca#####nawilkerson.net
DNS ASK gl#####lewilkerson.net
DNS ASK ki#####yncaulfield.net
DNS ASK gl#####lemathewson.net
DNS ASK ki#####ynwilkerson.net
DNS ASK gl#####lecaulfield.net
DNS ASK je#####nemathewson.net
DNS ASK ge#####vemathewson.net
DNS ASK je#####newilkinson.net
DNS ASK ge#####vewilkinson.net
DNS ASK ki#####ynmathewson.net
DNS ASK st#####iemathewson.net
DNS ASK ch#####tewilkerson.net
DNS ASK st#####iewilkinson.net
DNS ASK ch#####temathewson.net
DNS ASK st#####iewilkerson.net
DNS ASK ki#####ynwilkinson.net
DNS ASK gl#####lewilkinson.net
DNS ASK ch#####tecaulfield.net
DNS ASK st#####iecaulfield.net
DNS ASK je#####netallulah.net
DNS ASK ge#####vetallulah.net
DNS ASK je#####necathleen.net
DNS ASK ge#####vecathleen.net
DNS ASK je#####necharleen.net
DNS ASK ma#####kemarianna.net
DNS ASK ze#####ahcathleen.net
DNS ASK ge#####vecharleen.net
DNS ASK ze#####ahmarianna.net
DNS ASK ge#####vemarianna.net
DNS ASK ki#####yncathleen.net
DNS ASK gl#####lecathleen.net
DNS ASK ki#####ynmarianna.net
DNS ASK gl#####lemarianna.net
DNS ASK ki#####yntallulah.net
DNS ASK gl#####lecharleen.net
DNS ASK je#####nemarianna.net
DNS ASK gl#####letallulah.net
DNS ASK ki#####yncharleen.net
DNS ASK ca#####racaulfield.net
DNS ASK ma#####ianwilkinson.net
DNS ASK ca#####rawilkerson.net
DNS ASK kr#####hercaulfield.net
DNS ASK ki#####eewilkinson.net
DNS ASK ma#####ianwilkerson.net
DNS ASK ki#####eewilkerson.net
DNS ASK ma#####ianmathewson.net
DNS ASK ki#####eemathewson.net
DNS ASK kr#####herwilkerson.net
DNS ASK ma#####ketallulah.net
DNS ASK ze#####ahcharleen.net
DNS ASK ma#####kecathleen.net
DNS ASK ze#####ahtallulah.net
DNS ASK ma#####kecharleen.net
DNS ASK kr#####hermathewson.net
DNS ASK ca#####ramathewson.net
DNS ASK kr#####herwilkinson.net
DNS ASK ca#####rawilkinson.net

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней