BackDoor.PcClient.6226

Malicious functions:

To bypass firewall, removes or modifies the following registry keys:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%APPDATA%\Torque\Torque.exe' = '%APPDATA%\Torque\Torque.exe:*:Enabled:Torque'

Creates and executes the following:

Modifies file system :

Creates the following files:

%APPDATA%\Torque\apps\player.btapp
%APPDATA%\Torque\apps\plus.btapp
%APPDATA%\Torque\apps\welcome-upsell.btapp
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Torque.lnk
%APPDATA%\Torque\apps\featuredContent.btapp
%APPDATA%\Torque\apps.btapp
%APPDATA%\Torque\dlimagecache\10E6FBE4D921B475FA5FEC6E9A535A540D6FEED1
%APPDATA%\Torque\dlimagecache\32F529521A3DEC709F97F761F192AABF29BDC408
%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\3ca1edd1d03bbe79524a24c5817112f7_23ef5514-3059-436f-a4a7-4cefaab20eb1
%HOMEPATH%\Cookies\%USERNAME%@localhost[2].txt
%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\1619e4116a27778b58dc8a6a39f12ab4_23ef5514-3059-436f-a4a7-4cefaab20eb1
%APPDATA%\Torque\settings.dat.new
%APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\Preferred
%APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\228091b6-3237-456b-b2e1-7635843652f5
%ALLUSERSPROFILE%\Start Menu\Torque.lnk
%ALLUSERSPROFILE%\Desktop\Torque.lnk
%HOMEPATH%\Cookies\%USERNAME%@localhost[1].txt
%APPDATA%\Torque\au.log
%APPDATA%\Torque\Torque.exe

Deletes the following files:

Moves the following files:

from %APPDATA%\Torque\apps\welcome-upsell.btapp to %APPDATA%\Torque\apps\welcome-upsell.btapp.17440.tmp
from %APPDATA%\Torque\apps\player.btapp.new to %APPDATA%\Torque\apps\player.btapp
from %APPDATA%\Torque\apps\welcome-upsell.btapp.new to %APPDATA%\Torque\apps\welcome-upsell.btapp
from %APPDATA%\Torque\apps\plus.btapp.new to %APPDATA%\Torque\apps\plus.btapp
from %APPDATA%\Torque\apps\plus.btapp to %APPDATA%\Torque\apps\plus.btapp.17440.tmp
from %APPDATA%\Torque\settings.dat to %APPDATA%\Torque\settings.dat.old
from %APPDATA%\Torque\settings.dat.new to %APPDATA%\Torque\settings.dat
from %APPDATA%\Torque\apps\featuredContent.btapp to %APPDATA%\Torque\apps\featuredContent.btapp.17437.tmp
from %APPDATA%\Torque\apps\player.btapp to %APPDATA%\Torque\apps\player.btapp.17440.tmp
from %APPDATA%\Torque\apps\featuredContent.btapp.new to %APPDATA%\Torque\apps\featuredContent.btapp

Network activity:

Connects to:

TCP:

HTTP GET requests:

ap##.#ittorrent.com/discoverContent/discoverContent.btapp?h=########################################################
www.bi###rrent.com/favicon.ico
up####.bittorrent.com/time.php
www.mi###ova.org/favicon.ico
up####.utorrent.com/installstats.php?cl##############################################################################################################################
ap##.#ittorrent.com/utorrent-onboarding/welcome-upsell.btapp
ap##.#ittorrent.com/featuredcontent/featuredcontent.btapp
ap##.#ittorrent.com/utorrent-onboarding/plus2.btapp
ap##.#ittorrent.com/utorrent-onboarding/player.btapp

UDP: