Trojan.DownLoader10.62022

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'shell' = 'explorer.exe,%APPDATA%\skype.dat'

Malicious functions:

Executes the following:

'<SYSTEM32>\svchost.exe'

Injects code into

the following system processes:

<SYSTEM32>\svchost.exe

Modifies file system :

Creates the following files:

%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\dknqzajpfcgtdhxsdhty0ysam0dgiqegwpwkxoks0llraxtdrxvixjgphznqueyhclldu_mpea_nevqjutwofli0hc[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\pqneytmxykvqsrznvp0ygxqltopop0jtej0gjebmpplxsjxsrzmfcxsuyvn0vtgj_kbwf0gdmsgdfmarbaejrnpflt[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\gkjkpp_phac_uyqc_kfko0btfp0bioe_ezldclddohshatsrcqpbjvgjebsdixcbqklgcj_qzxjez0pyiomxcbpq_koyg0[1].html
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bfiqfz0cjyn0spgb_nnjkcq0qjouygjvaw0vpdidiytqnrc_xyyb_uknbkbjlgali0ksigrdrzaktwclsn0kodrnsrpvn[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\el_uqfp0lgsncexczjifwpgoxtiiznrtus0pljx_aknw0ytqklxnwrz0yxkqosxlsnpl0zjlaoa0suxxbfwifrtfqcpr[1].html
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ohifejda0pljv_zvyx0ohwk0lgduys0coqsco0syphda0nlva0plzrnnoprotwnajp0xxnomx0nnft0ygwp0qjxq0gljukdll[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\cqpiqjteit_qukq0cbphnnpbvtpauumpyvnmjtceqtptxxlaua0xicqddalbh0tyyxuokkrz0qntf0xcsh0znwk0hjcg[1].html
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\cdnbvphe0rovnvyvlstyv0duxojgardhsdiqltrcjt0gnsd0mypyjp0kfbc0gbco0dkzj0snjpezwidmdu0qtzhbq0rnio0[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ca0lajutfofnoygfqaklzrozhor_vnsinbbippelkqrtcnpbddeygjow0hepfqpblpmmxof0gsnq0cncqybzmfyfc0[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ptptptptptptptptheat0paalbioufrfrjt0dmjh0dwar0xynm_zrvq_rtxo0xlky0vleh0vlqt0nhnehtuqvlyxphzjey[1].html
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\glga0jzqrpfxyaw0rkwfditinecqdfcuxs0nscuejbidhrinbxlvr_tedmks0tiex0zrrizvzhrqcg0nsnlmp0jhms0sp[1].html
%APPDATA%\skype.dat
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ak0uakb0egnlxjigyh0rkiivybcbasdfrftyqjk0wgorltipqkpmfqygjhnahe_xpsncdebofox0onqz0syqtks0xfam_[1].html
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\xsdknqza0jpfcgtdhkojppmdwuocblzez0tyzakkzhwkuayt0tsqklxjgaloe0zaru0onvq_fpoueg0cbyvwbcelmdn[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\jzqrpf0xyaw0rkowpv0eadgpmndqspraucdrdwp_gkbl0ddvk0ouldez0bhxxjppmgkrurdegofyjkoph_rkih0nopprz[1].html
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\sisisisisisisisinsglnsgopbkdcoamuqixalqu0vaac_kkdrea0vylgphihrilamxoa0zvdfqpawbwsppapf0vy[1].php

Network activity:

Connects to:

'vi#####s.dns-dns.com':80
'fi####imetubefvv.in':80
'ag###poder.us':80

TCP:

HTTP GET requests:

fi####imetubefvv.in/forum/pqneytmxykvqsrznvp0ygxqltopop0jtej0gjebmpplxsjxsrzmfcxsuyvn0vtgj_kbwf0gdmsgdfmarbaejrnpflt.php
vi#####s.dns-dns.com/news/cqpiqjteit_qukq0cbphnnpbvtpauumpyvnmjtceqtptxxlaua0xicqddalbh0tyyxuokkrz0qntf0xcsh0znwk0hjcg.html
vi#####s.dns-dns.com/community/bfiqfz0cjyn0spgb_nnjkcq0qjouygjvaw0vpdidiytqnrc_xyyb_uknbkbjlgali0ksigrdrzaktwclsn0kodrnsrpvn.php
ag###poder.us/community/dknqzajpfcgtdhxsdhty0ysam0dgiqegwpwkxoks0llraxtdrxvixjgphznqueyhclldu_mpea_nevqjutwofli0hc.php
vi#####s.dns-dns.com/forum/ohifejda0pljv_zvyx0ohwk0lgduys0coqsco0syphda0nlva0plzrnnoprotwnajp0xxnomx0nnft0ygwp0qjxq0gljukdll.php
ag###poder.us/news/al0bcgocnpmezeamvjlbqnfcoyxgonq0jkxyyg0noam0fyel0kgpzmpphonlghjsiwkyefrcgrazjejofux0kkvy0pm.html
ag###poder.us/forum/cdnbvphe0rovnvyvlstyv0duxojgardhsdiqltrcjt0gnsd0mypyjp0kfbc0gbco0dkzj0snjpezwidmdu0qtzhbq0rnio0.php
fi####imetubefvv.in/news/el_uqfp0lgsncexczjifwpgoxtiiznrtus0pljx_aknw0ytqklxnwrz0yxkqosxlsnpl0zjlaoa0suxxbfwifrtfqcpr.html
vi#####s.dns-dns.com/news/jzqrpf0xyaw0rkowpv0eadgpmndqspraucdrdwp_gkbl0ddvk0ouldez0bhxxjppmgkrurdegofyjkoph_rkih0nopprz.html
ag###poder.us/forum/sisisisisisisisinsglnsgopbkdcoamuqixalqu0vaac_kkdrea0vylgphihrilamxoa0zvdfqpawbwsppapf0vy.php
ag###poder.us/forums/ptptptptptptptptheat0paalbioufrfrjt0dmjh0dwar0xynm_zrvq_rtxo0xlky0vleh0vlqt0nhnehtuqvlyxphzjey.html
fi####imetubefvv.in/news/glga0jzqrpfxyaw0rkwfditinecqdfcuxs0nscuejbidhrinbxlvr_tedmks0tiex0zrrizvzhrqcg0nsnlmp0jhms0sp.html
ag###poder.us/forum/ca0lajutfofnoygfqaklzrozhor_vnsinbbippelkqrtcnpbddeygjow0hepfqpblpmmxof0gsnq0cncqybzmfyfc0.php
fi####imetubefvv.in/forums/gkjkpp_phac_uyqc_kfko0btfp0bioe_ezldclddohshatsrcqpbjvgjebsdixcbqklgcj_qzxjez0pyiomxcbpq_koyg0.html
fi####imetubefvv.in/news/ak0uakb0egnlxjigyh0rkiivybcbasdfrftyqjk0wgorltipqkpmfqygjhnahe_xpsncdebofox0onqz0syqtks0xfam_.html
vi#####s.dns-dns.com/community/xsdknqza0jpfcgtdhkojppmdwuocblzez0tyzakkzhwkuayt0tsqklxjgaloe0zaru0onvq_fpoueg0cbyvwbcelmdn.php