Trojan.DownLoader32.55297

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '{6ZMULYI-VTB5-YY4B-9P18-4IAGZZK9R1R}' = '"%APPDATA%\amd64_microsoft-windows-i..l-keyboard-0001041e_31bf3856ad364e35_6.3.9600.16384_none_9...

Malicious functions

Searches for registry branches where third party applications store passwords

[<HKCU>\Software\Martin Prikryl\WinSCP 2\Sessions]

Reads files which store third party applications passwords

%HOMEPATH%\desktop\fi51.doc
%HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
%HOMEPATH%\desktop\hanni_umami_chapter.doc
%HOMEPATH%\desktop\lisp_success.doc
%HOMEPATH%\desktop\nwfieldnotes1966.docx
%HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
%HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc
%HOMEPATH%\desktop\dashborder_192.bmp
%HOMEPATH%\desktop\dialmap.bmp
%HOMEPATH%\desktop\toolbar.bmp

Searches for windows to

detect analytical utilities:

ClassName: 'OLLYDBG', WindowName: ''
ClassName: 'GBDYLLO', WindowName: ''
ClassName: 'pediy06', WindowName: ''
ClassName: 'FilemonClass', WindowName: ''
ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
ClassName: 'RegmonClass', WindowName: ''
ClassName: '', WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'

Modifies file system

Creates the following files

%TEMP%\aut1.tmp
%TEMP%\dw.log
%TEMP%\nsf6.tmp\system.dll
%TEMP%\nsf6.tmp\nsdialogs.dll
%TEMP%\nsf6.tmp\brandingurl.dll
%TEMP%\nsf6.tmp\aero.dll
%TEMP%\nsf6.tmp\modern-wizard.bmp
%TEMP%\nsf6.tmp\modern-header.bmp
%TEMP%\nsf6.tmp\orange-r.bmp
%TEMP%\17427f.dmp
%TEMP%\nsf6.tmp\ukr-r.bmp
%TEMP%\nsf6.tmp\rus-r.bmp
%TEMP%\nsf6.tmp\langdll.dll
%TEMP%\nsh5.tmp
%APPDATA%\z96453169\uninstall.tool-3.5.9.5660.exe
%TEMP%\aut3.tmp
%APPDATA%\z96453169\uninstall tool 3.5.9-build 5660.exe
%TEMP%\aut2.tmp
%APPDATA%\z96453169\uninstall tool 3.5.9 build 5660.exe
%TEMP%\nsf6.tmp\eng-r.bmp
%APPDATA%\amd64_microsoft-windows-i..l-keyboard-0001041e_31bf3856ad364e35_6.3.9600.16384_none_922e26ef1bece244\config.json

Sets the 'hidden' attribute to the following files

%APPDATA%\amd64_microsoft-windows-i..l-keyboard-0001041e_31bf3856ad364e35_6.3.9600.16384_none_922e26ef1bece244\nlsdata0003.exe
%APPDATA%\amd64_microsoft-windows-i..l-keyboard-0001041e_31bf3856ad364e35_6.3.9600.16384_none_922e26ef1bece244\config.json

Deletes the following files

%TEMP%\aut1.tmp
%TEMP%\aut2.tmp
%TEMP%\aut3.tmp

Moves the following files

from %APPDATA%\z96453169\uninstall tool 3.5.9-build 5660.exe to %APPDATA%\amd64_microsoft-windows-i..l-keyboard-0001041e_31bf3856ad364e35_6.3.9600.16384_none_922e26ef1bece244\nlsdata0003.exe

Network activity

Connects to

'ya####ba.zzz.com.ua':52256
'ya####ba.zzz.com.ua':54918

TCP

HTTP GET requests

http://45.##.228.211:2012/websocket via 45.##.228.211
http://ap#.#pify.org/

'<LOCALNET>.8.54':1109

'<LOCALNET>.8.54':1106

'<LOCALNET>.8.54':1103

'<LOCALNET>.8.54':1100

'<LOCALNET>.8.54':1097

'<LOCALNET>.8.54':1094

'<LOCALNET>.8.54':1091

'<LOCALNET>.8.54':1088

'<LOCALNET>.8.54':1085

'<LOCALNET>.8.54':1082

'<LOCALNET>.8.54':1079

'<LOCALNET>.8.54':1076

'<LOCALNET>.8.54':1073

'<LOCALNET>.8.54':1070

'<LOCALNET>.8.54':1067

'<LOCALNET>.8.54':1064

'<LOCALNET>.8.54':1061

'<LOCALNET>.8.54':1058

'<LOCALNET>.8.54':1055

'<LOCALNET>.8.54':1052

'<LOCALNET>.8.54':1049

'ya####ba.zzz.com.ua':21

'<LOCALNET>.8.54':1046

'ip###ger.org':443

'ip##fo.io':443

'<LOCALNET>.8.54':1112

'<LOCALNET>.8.54':1115

UDP

DNS ASK ap#.#pify.org
DNS ASK ip##fo.io
DNS ASK ip###ger.org
DNS ASK ya####ba.zzz.com.ua

Miscellaneous

Searches for the following windows

ClassName: '18467-41' WindowName: ''

Creates and executes the following

'%APPDATA%\z96453169\uninstall tool 3.5.9 build 5660.exe'
'%APPDATA%\z96453169\uninstall tool 3.5.9-build 5660.exe'
'%APPDATA%\z96453169\uninstall.tool-3.5.9.5660.exe'
'%APPDATA%\amd64_microsoft-windows-i..l-keyboard-0001041e_31bf3856ad364e35_6.3.9600.16384_none_922e26ef1bece244\nlsdata0003.exe'

Executes the following