Trojan.DownLoader9.34961

Добавлен в вирусную базу Dr.Web: 2013-06-23

Описание добавлено: 2013-06-26

Technical Information

Malicious functions:

Creates and executes the following:

'<SYSTEM32>\lgaewwgn.exe'
'<SYSTEM32>\ipdajzny.exe'
'<SYSTEM32>\bugvqaxf.exe'
'<SYSTEM32>\yiaojfsg.exe'
'<SYSTEM32>\ybnvcfzk.exe' /pid=3200
'<SYSTEM32>\cydvxveu.exe'
'<SYSTEM32>\tyiwfzoy.exe'
'<SYSTEM32>\eyxvrlqs.exe'
'<SYSTEM32>\wjzscssr.exe'
'<SYSTEM32>\oyzwbqmk.exe'
'<SYSTEM32>\lzaszjnl.exe'
'<SYSTEM32>\bzdbfnwn.exe'
'<SYSTEM32>\omsybzlk.exe'
'<SYSTEM32>\moyifytj.exe'
'<SYSTEM32>\jjjqgnnv.exe'
'<SYSTEM32>\byboifhf.exe'
'<SYSTEM32>\jyutchye.exe'
'<SYSTEM32>\ybnvcfzk.exe'
'<SYSTEM32>\jnnjwrql.exe'
'<SYSTEM32>\mmociwtw.exe'
'<SYSTEM32>\teerducz.exe'
'<SYSTEM32>\mcorsfsg.exe'
'<SYSTEM32>\wzeuvvpz.exe'
'<SYSTEM32>\srszxgcb.exe'
'<SYSTEM32>\afaauqrq.exe'

Injects code into

the following system processes:

<SYSTEM32>\svchost.exe

Searches for windows to

detect analytical utilities:

ClassName: '' WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
ClassName: 'PROCMON_WINDOW_CLASS' WindowName: ''
ClassName: '' WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'
ClassName: 'RegmonClass' WindowName: ''
ClassName: '' WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
ClassName: 'GBDYLLO' WindowName: ''
ClassName: 'OLLYDBG' WindowName: ''
ClassName: 'FilemonClass' WindowName: ''
ClassName: 'pediy06' WindowName: ''

Modifies file system :

Creates the following files:

%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\1759CB3B5124F217143044[4]
<SYSTEM32>\lgaewwgn.exe
<SYSTEM32>\ipdajzny.exe
<SYSTEM32>\bugvqaxf.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\1759CB3B5124F217143044[4]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\1759CB3B5124F217143044[3]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\1759CB3B5124F217143044[3]
<SYSTEM32>\omsybzlk.exe
<SYSTEM32>\yiaojfsg.exe
<SYSTEM32>\cydvxveu.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\1759CB3B5124F217143044[3]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\1759CB3B5124F217143044[5]
<SYSTEM32>\tyiwfzoy.exe
<SYSTEM32>\eyxvrlqs.exe
<SYSTEM32>\wjzscssr.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\1759CB3B5124F217143044[5]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\1759CB3B5124F217143044[5]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\1759CB3B5124F217143044[4]
<SYSTEM32>\oyzwbqmk.exe
<SYSTEM32>\lzaszjnl.exe
<SYSTEM32>\bzdbfnwn.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\1759CB3B5124F217143044[4]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\1759CB3B5124F217143044[3]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\1759CB3B5124F217143044[1]
<SYSTEM32>\jnnjwrql.exe
<SYSTEM32>\moyifytj.exe
<SYSTEM32>\jjjqgnnv.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\1759CB3B5124F217143044[1]
<SYSTEM32>\ybnvcfzk.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\1759CB3B5124F217143044[1]
<SYSTEM32>\MSWINSCK.ocx
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\1759CB3B5124F217143044[1]
<SYSTEM32>\jyutchye.exe
<SYSTEM32>\mmociwtw.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\1759CB3B5124F217143044[2]
<SYSTEM32>\teerducz.exe
<SYSTEM32>\mcorsfsg.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\1759CB3B5124F217143044[2]
<SYSTEM32>\afaauqrq.exe
<SYSTEM32>\byboifhf.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\1759CB3B5124F217143044[2]
<SYSTEM32>\wzeuvvpz.exe
<SYSTEM32>\srszxgcb.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\1759CB3B5124F217143044[2]

Sets the 'hidden' attribute to the following files:

<SYSTEM32>\lgaewwgn.exe
<SYSTEM32>\ipdajzny.exe
<SYSTEM32>\bugvqaxf.exe
<SYSTEM32>\omsybzlk.exe
<SYSTEM32>\yiaojfsg.exe
<SYSTEM32>\cydvxveu.exe
<SYSTEM32>\tyiwfzoy.exe
<SYSTEM32>\eyxvrlqs.exe
<SYSTEM32>\wjzscssr.exe
<SYSTEM32>\oyzwbqmk.exe
<SYSTEM32>\lzaszjnl.exe
<SYSTEM32>\bzdbfnwn.exe
<SYSTEM32>\moyifytj.exe
<SYSTEM32>\jjjqgnnv.exe
<SYSTEM32>\byboifhf.exe
<SYSTEM32>\jyutchye.exe
<SYSTEM32>\ybnvcfzk.exe
<SYSTEM32>\jnnjwrql.exe
<SYSTEM32>\mmociwtw.exe
<SYSTEM32>\teerducz.exe
<SYSTEM32>\mcorsfsg.exe
<SYSTEM32>\wzeuvvpz.exe
<SYSTEM32>\srszxgcb.exe
<SYSTEM32>\afaauqrq.exe

Deletes the following files:

%TEMP%\~DF2523.tmp
%TEMP%\~DF67C3.tmp
%TEMP%\~DF589E.tmp
%TEMP%\~DFF4C3.tmp
%TEMP%\~DF43CC.tmp
%TEMP%\~DF3191.tmp
%TEMP%\~DF9286.tmp
%TEMP%\~DFFE2E.tmp
%TEMP%\~DFF353.tmp
%TEMP%\~DF28FE.tmp
%TEMP%\~DF8E37.tmp
%TEMP%\~DFCCB5.tmp
%TEMP%\~DFBF6B.tmp
%TEMP%\~DF81E.tmp
%TEMP%\~DF4B3D.tmp
%TEMP%\~DF3C65.tmp
%TEMP%\~DFE10F.tmp
%TEMP%\~DFD7E1.tmp
%TEMP%\~DF166A.tmp
%TEMP%\~DF7B87.tmp
%TEMP%\~DFE158.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\1759CB3B5124F217143044[4]
%TEMP%\~DFC258.tmp
%TEMP%\~DF6A79.tmp
%TEMP%\~DFAB20.tmp
%TEMP%\~DF97E1.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\1759CB3B5124F217143044[2]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\1759CB3B5124F217143044[1]
%TEMP%\~DF314F.tmp
%TEMP%\~DF74CA.tmp
%TEMP%\~DFFCDE.tmp
%TEMP%\~DFE213.tmp
%TEMP%\~DF39B8.tmp
%TEMP%\~DF4864.tmp
%TEMP%\~DF25B0.tmp
%TEMP%\~DF15DE.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\1759CB3B5124F217143044[1]
%TEMP%\~DFA90E.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\1759CB3B5124F217143044[1]
%TEMP%\~DFDC01.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\1759CB3B5124F217143044[2]
%TEMP%\~DFD770.tmp
%TEMP%\~DFCFB0.tmp
%TEMP%\~DF168A.tmp
%TEMP%\~DF850D.tmp
%TEMP%\~DF9C45.tmp
%TEMP%\~DF1039.tmp
%TEMP%\~DF77B7.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\1759CB3B5124F217143044[2]
%TEMP%\~DF7C1E.tmp
%TEMP%\~DF389.tmp
%TEMP%\~DF4452.tmp
%TEMP%\~DF33ED.tmp

Network activity:

Connects to:

'localhost':1097
'localhost':1095
'localhost':1093
'localhost':1103
'localhost':1101
'localhost':1099
'localhost':1085
'localhost':1083
'localhost':1081
'localhost':1091
'localhost':1089
'localhost':1087
'localhost':1120
'localhost':1118
'localhost':1116
'localhost':1126
'localhost':1124
'localhost':1122
'localhost':1108
'localhost':1106
'localhost':1104
'localhost':1114
'localhost':1112
'localhost':1110
'localhost':1050
'localhost':1048
'localhost':1046
'localhost':1056
'localhost':1054
'localhost':1052
'localhost':1039
'cf#####9.uf.daum.net':80
'localhost':1036
'localhost':1044
'localhost':1042
'localhost':1041
'localhost':1073
'localhost':1071
'localhost':1069
'localhost':1079
'localhost':1077
'localhost':1075
'localhost':1061
'localhost':1059
'localhost':1057
'localhost':1067
'localhost':1065
'localhost':1063

TCP:

HTTP GET requests:

cf#####9.uf.daum.net/attach/1759CB3B5124F217143044

UDP:

DNS ASK cf#####9.uf.daum.net

Miscellaneous:

Searches for the following windows:

ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: '18467-41' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней