Trojan.DownLoader25.51127

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Health Policy Adapter Framework' = 'C:\yzueukneh\uehzov6z.exe'

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\Spooler Transfer AutoConnect Removal Registry] 'ImagePath' = 'C:\yzueukneh\uehzov6z.exe'
[<HKLM>\SYSTEM\ControlSet001\Services\Spooler Transfer AutoConnect Removal Registry] 'Start' = '00000002'

Malicious functions:

Creates and executes the following:

'C:\yzueukneh\ycltz1evxt9.exe' "c:\yzueukneh\uehzov6z.exe"
'C:\yzueukneh\uehzov6z.exe'
'C:\yzueukneh\uc248j9n3743xhzmc7d0g.exe'

Modifies file system:

Creates the following files:

C:\yzueukneh\uehzov6z.exe
C:\yzueukneh\ycltz1evxt9.exe
C:\yzueukneh\egrrcjht
%WINDIR%\yzueukneh\whoqxz
C:\yzueukneh\whoqxz
C:\yzueukneh\uc248j9n3743xhzmc7d0g.exe

Sets the 'hidden' attribute to the following files:

C:\yzueukneh\ycltz1evxt9.exe
C:\yzueukneh\uehzov6z.exe

Deletes the following files:

C:\yzueukneh\uc248j9n3743xhzmc7d0g.exe
%WINDIR%\yzueukneh\whoqxz

Substitutes the following files:

%WINDIR%\yzueukneh\whoqxz

Network activity:

Connects to:

'ch#####neshaquila.net':80
'sh#####leshaquila.net':80
'ch#####nemarcelyn.net':80
'sh#####lemarcelyn.net':80
'ch#####nekristeen.net':80
'sh#####lekristeen.net':80
'ch#####necallahan.net':80
'sh#####lecallahan.net':80
'ce#####nekristeen.net':80
'ce#####nemarcelyn.net':80
'am#####neshaquila.net':80
'al#####rakristeen.net':80
'am#####nemarcelyn.net':80
'ce#####necallahan.net':80
'am#####nekristeen.net':80
'ce#####neshaquila.net':80
'am#####necallahan.net':80
'ar#####ldmarcelyn.net':80
'ge#####nacallahan.net':80
'ch#####lecallahan.net':80
'ge#####nashaquila.net':80
'ch#####leshaquila.net':80
'an#####lemarcelyn.net':80
'gu#####enmarcelyn.net':80
'ge#####nakristeen.net':80
'ch#####lekristeen.net':80
'ch#####lemarcelyn.net':80
'za#####ahshaquila.net':80
'ar#####ldcallahan.net':80
'za#####ahmarcelyn.net':80
'ar#####ldshaquila.net':80
'za#####ahkristeen.net':80
'ge#####namarcelyn.net':80
'za#####ahcallahan.net':80
'ar#####ldkristeen.net':80
'gu#####encheyenne.net':80
'gw#####resymphony.net':80
'gu#####enbradford.net':80
'an#####lecheyenne.net':80
'ch#####ankiersten.net':80
'gw#####rebradford.net':80
'ch#####ansymphony.net':80
'gw#####rekiersten.net':80
'an#####lebradford.net':80
'ge#####nacheyenne.net':80
'ch#####lecheyenne.net':80
'ge#####nabradford.net':80
'ch#####lebradford.net':80
'an#####lekiersten.net':80
'gu#####enkiersten.net':80
'an#####lesymphony.net':80
'gu#####ensymphony.net':80
'ch#####anbradford.net':80
'al#####ramarcelyn.net':80
'ma#####nashaquila.net':80
'al#####erkristeen.net':80
'ma#####namarcelyn.net':80
'al#####racallahan.net':80
'ma#####nakristeen.net':80
'al#####rashaquila.net':80
'ma#####nacallahan.net':80
'ka#####nekristeen.net':80
'ka#####nemarcelyn.net':80
'al#####ermarcelyn.net':80
'gw#####recheyenne.net':80
'ch#####ancheyenne.net':80
'ka#####necallahan.net':80
'al#####ercallahan.net':80
'ka#####neshaquila.net':80
'al#####ershaquila.net':80

TCP:

HTTP GET requests:

http://ch#####neshaquila.net/index.php
http://sh#####leshaquila.net/index.php
http://ch#####nemarcelyn.net/index.php
http://sh#####lemarcelyn.net/index.php
http://ch#####nekristeen.net/index.php
http://sh#####lekristeen.net/index.php
http://ch#####necallahan.net/index.php
http://sh#####lecallahan.net/index.php
http://ce#####nekristeen.net/index.php
http://ce#####nemarcelyn.net/index.php
http://am#####neshaquila.net/index.php
http://al#####rakristeen.net/index.php
http://am#####nemarcelyn.net/index.php
http://ce#####necallahan.net/index.php
http://am#####nekristeen.net/index.php
http://ce#####neshaquila.net/index.php
http://am#####necallahan.net/index.php
http://ar#####ldmarcelyn.net/index.php
http://ge#####nacallahan.net/index.php
http://ch#####lecallahan.net/index.php
http://ge#####nashaquila.net/index.php
http://ch#####leshaquila.net/index.php
http://an#####lemarcelyn.net/index.php
http://gu#####enmarcelyn.net/index.php
http://ge#####nakristeen.net/index.php
http://ch#####lekristeen.net/index.php
http://ch#####lemarcelyn.net/index.php
http://za#####ahshaquila.net/index.php
http://ar#####ldcallahan.net/index.php
http://za#####ahmarcelyn.net/index.php
http://ar#####ldshaquila.net/index.php
http://za#####ahkristeen.net/index.php
http://ge#####namarcelyn.net/index.php
http://za#####ahcallahan.net/index.php
http://ar#####ldkristeen.net/index.php
http://gu#####encheyenne.net/index.php
http://gw#####resymphony.net/index.php
http://gu#####enbradford.net/index.php
http://an#####lecheyenne.net/index.php
http://ch#####ankiersten.net/index.php
http://gw#####rebradford.net/index.php
http://ch#####ansymphony.net/index.php
http://gw#####rekiersten.net/index.php
http://an#####lebradford.net/index.php
http://ge#####nacheyenne.net/index.php
http://ch#####lecheyenne.net/index.php
http://ge#####nabradford.net/index.php
http://ch#####lebradford.net/index.php
http://an#####lekiersten.net/index.php
http://gu#####enkiersten.net/index.php
http://an#####lesymphony.net/index.php
http://gu#####ensymphony.net/index.php
http://ch#####anbradford.net/index.php
http://al#####ramarcelyn.net/index.php
http://ma#####nashaquila.net/index.php
http://al#####erkristeen.net/index.php
http://ma#####namarcelyn.net/index.php
http://al#####racallahan.net/index.php
http://ma#####nakristeen.net/index.php
http://al#####rashaquila.net/index.php
http://ma#####nacallahan.net/index.php
http://ka#####nekristeen.net/index.php
http://ka#####nemarcelyn.net/index.php
http://al#####ermarcelyn.net/index.php
http://gw#####recheyenne.net/index.php
http://ch#####ancheyenne.net/index.php
http://ka#####necallahan.net/index.php
http://al#####ercallahan.net/index.php
http://ka#####neshaquila.net/index.php
http://al#####ershaquila.net/index.php

UDP:

DNS ASK sh#####leshaquila.net
DNS ASK ch#####necallahan.net
DNS ASK sh#####lemarcelyn.net
DNS ASK ch#####neshaquila.net
DNS ASK sh#####lekristeen.net
DNS ASK ar#####ldmarcelyn.net
DNS ASK sh#####lecallahan.net
DNS ASK ch#####nekristeen.net
DNS ASK ch#####nemarcelyn.net
DNS ASK am#####neshaquila.net
DNS ASK ce#####neshaquila.net
DNS ASK am#####nemarcelyn.net
DNS ASK ce#####nemarcelyn.net
DNS ASK am#####nekristeen.net
DNS ASK ce#####nekristeen.net
DNS ASK am#####necallahan.net
DNS ASK ce#####necallahan.net
DNS ASK za#####ahmarcelyn.net
DNS ASK ch#####lecallahan.net
DNS ASK ge#####nakristeen.net
DNS ASK ch#####leshaquila.net
DNS ASK ge#####nacallahan.net
DNS ASK gu#####enmarcelyn.net
DNS ASK an#####leshaquila.net
DNS ASK ch#####lekristeen.net
DNS ASK an#####lemarcelyn.net
DNS ASK ge#####nashaquila.net
DNS ASK ar#####ldcallahan.net
DNS ASK za#####ahcallahan.net
DNS ASK ar#####ldshaquila.net
DNS ASK za#####ahshaquila.net
DNS ASK ge#####namarcelyn.net
DNS ASK ch#####lemarcelyn.net
DNS ASK ar#####ldkristeen.net
DNS ASK za#####ahkristeen.net
DNS ASK al#####rakristeen.net
DNS ASK gu#####encheyenne.net
DNS ASK gw#####resymphony.net
DNS ASK gu#####enbradford.net
DNS ASK an#####lecheyenne.net
DNS ASK ch#####ankiersten.net
DNS ASK gw#####rebradford.net
DNS ASK ch#####ansymphony.net
DNS ASK gw#####rekiersten.net
DNS ASK an#####lebradford.net
DNS ASK ge#####nacheyenne.net
DNS ASK ch#####lecheyenne.net
DNS ASK ge#####nabradford.net
DNS ASK ch#####lebradford.net
DNS ASK an#####lekiersten.net
DNS ASK gu#####enkiersten.net
DNS ASK an#####lesymphony.net
DNS ASK gu#####ensymphony.net
DNS ASK ch#####anbradford.net
DNS ASK al#####ramarcelyn.net
DNS ASK ma#####nashaquila.net
DNS ASK al#####erkristeen.net
DNS ASK ma#####namarcelyn.net
DNS ASK al#####racallahan.net
DNS ASK ma#####nakristeen.net
DNS ASK al#####rashaquila.net
DNS ASK ma#####nacallahan.net
DNS ASK ka#####nekristeen.net
DNS ASK ka#####nemarcelyn.net
DNS ASK al#####ermarcelyn.net
DNS ASK gw#####recheyenne.net
DNS ASK ch#####ancheyenne.net
DNS ASK ka#####necallahan.net
DNS ASK al#####ercallahan.net
DNS ASK ka#####neshaquila.net
DNS ASK al#####ershaquila.net

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней