Trojan.DownLoader12.48418

Technical Information

To ensure autorun and distribution

Sets the following service settings

[<HKLM>\System\CurrentControlSet\Services\baby] 'ImagePath' = '<SYSTEM32>\taogeTTsO3.sys'

Creates the following services

'baby' <SYSTEM32>\taogeTTsO3.sys

Modifies file system

Creates the following files

%WINDIR%\syswow64\taogettso3.sys
%APPDATA%\macromedia\flash player\macromedia.com\support\flashplayer\sys\#c2.web.yystatic.com\settings.sxx
%APPDATA%\macromedia\flash player\macromedia.com\support\flashplayer\sys\settings.sxx
%APPDATA%\macromedia\flash player\#sharedobjects\gr8by44n\c2.web.yystatic.com\r\rc\main\main\1\62\main.swf\main_guest_sobj.sxx
%APPDATA%\macromedia\flash player\#sharedobjects\gr8by44n\c2.web.yystatic.com\pcinfo.sxx
%APPDATA%\macromedia\flash player\#sharedobjects\gr8by44n\c2.web.yystatic.com\r\sc\mini\defaultscene\1\81\gcard.swf\mgedata.sxx

Deletes the following files

%WINDIR%\syswow64\taogettso3.sys
%APPDATA%\macromedia\flash player\macromedia.com\support\flashplayer\sys\#c2.web.yystatic.com\settings.sol

Moves the following files

from %APPDATA%\macromedia\flash player\macromedia.com\support\flashplayer\sys\#c2.web.yystatic.com\settings.sxx to %APPDATA%\macromedia\flash player\macromedia.com\support\flashplayer\sys\#c2.web.yystatic.com\settings.sol
from %APPDATA%\macromedia\flash player\#sharedobjects\gr8by44n\c2.web.yystatic.com\r\rc\main\main\1\62\main.swf\main_guest_sobj.sxx to %APPDATA%\macromedia\flash player\#sharedobjects\gr8by44n\c2.web.yystatic.com\r\rc\main\main\1\62\main.swf\main_guest_sobj.sol
from %APPDATA%\macromedia\flash player\#sharedobjects\gr8by44n\c2.web.yystatic.com\pcinfo.sxx to %APPDATA%\macromedia\flash player\#sharedobjects\gr8by44n\c2.web.yystatic.com\pcinfo.sol
from %APPDATA%\macromedia\flash player\#sharedobjects\gr8by44n\c2.web.yystatic.com\r\sc\mini\defaultscene\1\81\gcard.swf\mgedata.sxx to %APPDATA%\macromedia\flash player\#sharedobjects\gr8by44n\c2.web.yystatic.com\r\sc\mini\defaultscene\1\81\gcard.swf\mgedata.sol

Substitutes the following files

%APPDATA%\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol
%APPDATA%\macromedia\flash player\macromedia.com\support\flashplayer\sys\#c2.web.yystatic.com\settings.sxx
%APPDATA%\macromedia\flash player\macromedia.com\support\flashplayer\sys\#c2.web.yystatic.com\settings.sol

Network activity

Connects to

'yy.com':80
'11#.#85.109.95':8084
'11#.#85.109.96':3843
'11#.#85.109.95':3843
'27.##2.182.48':93
'11#.#85.109.96':843
'27.##2.182.48':843
'yl##.hiido.com':80
'11#.#85.109.95':843
'12#.#39.231.112':96
'12#.#39.231.118':843
'12#.#39.231.112':843
'fp######ad2.macromedia.com':80
'c2.###.yystatic.com':80
'we####.yystatic.com':80
'12#.#39.231.118':83
'11#.#85.109.96':91

TCP

HTTP GET requests

http://yy.com/s/36907/1991979092/mini.swf
http://yl##.hiido.com/j.gif?ac############################################################################################################################
http://c2.###.yystatic.com/r/rc/main/publicModulev2/1/64/smileres.swf
http://c2.###.yystatic.com/r/sc/mini/defaultScene/1/81/moreLiveVideo.swf
http://c2.###.yystatic.com/r/sc/mini/defaultScene/1/81/gTopBar.swf
http://c2.###.yystatic.com/r/sc/mini/defaultScene/1/81/gTongji.swf
http://c2.###.yystatic.com/r/sc/mini/defaultScene/1/81/gameMiniUI.swf
http://c2.###.yystatic.com/r/sc/mini/defaultScene/1/81/gCard.swf
http://c2.###.yystatic.com/r/sc/mini/defaultScene/1/81/sceneConfig.xml
http://yl##.hiido.com/crossdomain.xml
http://st###.web.yy.com/c.gif?ac#################################################################################################################################################################...
http://st##.yy.com/mainstat.html?s=##############################################################################################################################################################...
http://c2.###.yystatic.com/r/rc/main/core/1/825/core.bmp
http://c2.###.yystatic.com/r/rc/mini/loading/1/17/loading.swf
http://we####.yystatic.com//get-data/36907?su####################################
http://we####.yystatic.com/crossdomain.xml
http://c2.###.yystatic.com/r/rc/main/main/1/62/main.swf?ty################################################################################################################
http://we####.yystatic.com/s/36907/1991979092/mini.swf
http://www.yy.com/s/36907/1991979092/mini.swf
http://c2.###.yystatic.com/r/sc/mini/defaultScene/1/81/defaultScene.swf
http://st##.yy.com/webyystat.html?&r#############################################################################################################################################################...