Trojan.DownLoader10.45600

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'shell' = 'explorer.exe,%APPDATA%\skype.dat'

Malicious functions:

Executes the following:

'<SYSTEM32>\svchost.exe'

Injects code into

the following system processes:

<SYSTEM32>\svchost.exe

Modifies file system :

Creates the following files:

%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\rn-ndgk-jkppph-acuyhtllakcdigtf-pbof-nmfttwzjlmdnclgtkola-useg-bhzv-cgxx-dwqc-dheabi-zmiirkcuat-[1].html
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\sncexczjddon-gdqk-wgixgk-sdceitdfjtuo-dfdh-xlsd-yqbcshqpjhoa-zvabvkfrldrixxvacg-xqteofzjxcii-[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\sisi-sisi-sisisisinsglns-gopb-kdcoamuqixalquvaackkdrea-iqlgbatydkkdukiozvdfqpawbwsppapfvy[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\nsoe-exjl-bwipnadwoffvbcxyzj-zayjii-elpp-uoif-lzif-zojz-akixfanqatoulibwatqncanfqjjzxpcdeypz[1].html
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\nd-gkjk-ppphac-uyqc-lilaxq-cnit-kqwfnw-ybgscadizavnrqstpvvakkno-rzal-pqjtdurannyg-iicnkfyqowvt[1].html
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\io-uulmld-wkcl-albc-iodkytuyrzux-cbrirc-fpof-zvnbgtqtri-xlzo-gkgj-dgitvisiybga-rtri-siks-hcqngncu[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\xj-igyhvaxlsy-ftxpllohsd-htdk-lidkpfzjtiqujk-dmfqwksypadglmxlsdru-zjdwprawsdyego-kqjh-bfegtm-[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ongdqkkdvttsorqpxtsneagxbwejigjlcoofnsjw-nfvpca-xqqccd-qunbigaubaqjna-vtsn-fqpi-bcynyxclcn[1].html
%APPDATA%\skype.dat
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\dgksbafvsuducalauoox-rqjgtydivkfttm-lxos-pmcbrk-xsalvnjtrk-oyoacnjusnbfoftwks-cjla-uueaqpfz[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\sisi-sisi-sisi-sisi-nsglnsgopbkd-coamuq-ixal-quvaackkdreaiq-lgba-tydkkd-ukiozvdfqpaw-bwsppapfvy[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\rtiouulmldwkclalbtys-qurodaxpkbsrdwebzmuxnocdldykqkxfqpph-bipp-frjxrpuasrix-zjfc-ysezabqp[1].html
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\jk-ppphacuyqckfouonqkdf-tituplkyrp-cepf-pvdi-vaqzpa-ezua-vicbuozhlznhce-oufzxt-faeb-bwvi-qjqs-my[1].html

Network activity:

Connects to:

'as##.xxuz.com':80
'ca####gspanish.in':80
'am###etweet.us':80

TCP:

HTTP GET requests:

as##.xxuz.com/post/nsoe-exjl-bwipnadwoffvbcxyzj-zayjii-elpp-uoif-lzif-zojz-akixfanqatoulibwatqncanfqjjzxpcdeypz.html
ca####gspanish.in/post/rn-ndgk-jkppph-acuyhtllakcdigtf-pbof-nmfttwzjlmdnclgtkola-useg-bhzv-cgxx-dwqc-dheabi-zmiirkcuat-.html
am###etweet.us/tgp/sncexczjddon-gdqk-wgixgk-sdceitdfjtuo-dfdh-xlsd-yqbcshqpjhoa-zvabvkfrldrixxvacg-xqteofzjxcii-.php
as##.xxuz.com/questions/nd-gkjk-ppphac-uyqc-lilaxq-cnit-kqwfnw-ybgscadizavnrqstpvvakkno-rzal-pqjtdurannyg-iicnkfyqowvt.html
ca####gspanish.in/o/io-uulmld-wkcl-albc-iodkytuyrzux-cbrirc-fpof-zvnbgtqtri-xlzo-gkgj-dgitvisiybga-rtri-siks-hcqngncu.php
am###etweet.us/o/xj-igyhvaxlsy-ftxpllohsd-htdk-lidkpfzjtiqujk-dmfqwksypadglmxlsdru-zjdwprawsdyego-kqjh-bfegtm-.php
as##.xxuz.com/post/jk-ppphacuyqckfouonqkdf-tituplkyrp-cepf-pvdi-vaqzpa-ezua-vicbuozhlznhce-oufzxt-faeb-bwvi-qjqs-my.html
ca####gspanish.in/o/dgksbafvsuducalauoox-rqjgtydivkfttm-lxos-pmcbrk-xsalvnjtrk-oyoacnjusnbfoftwks-cjla-uueaqpfz.php
am###etweet.us/post/ongdqkkdvttsorqpxtsneagxbwejigjlcoofnsjw-nfvpca-xqqccd-qunbigaubaqjna-vtsn-fqpi-bcynyxclcn.html
as##.xxuz.com/o/sisi-sisi-sisisisinsglns-gopb-kdcoamuqixalquvaackkdrea-iqlgbatydkkdukiozvdfqpawbwsppapfvy.php
ca####gspanish.in/tgp/sisi-sisi-sisi-sisi-nsglnsgopbkd-coamuq-ixal-quvaackkdreaiq-lgba-tydkkd-ukiozvdfqpaw-bwsppapfvy.php
am###etweet.us/questions/rtiouulmldwkclalbtys-qurodaxpkbsrdwebzmuxnocdldykqkxfqpph-bipp-frjxrpuasrix-zjfc-ysezabqp.html