Trojan.DownLoader12.32943

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,%ALLUSERSPROFILE%\vesswIQA\AcIcUcAM.exe,'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'AcIcUcAM.exe' = '%ALLUSERSPROFILE%\vesswIQA\AcIcUcAM.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'jaQEcQMQ.exe' = '%HOMEPATH%\NIMMEwsg\jaQEcQMQ.exe'

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\FkYQcQph] 'Start' = '00000002'

Malicious functions:

To complicate detection of its presence in the operating system,

forces the system hide from view:

hidden files
file extensions

blocks the following features:

User Account Control (UAC)

Creates and executes the following:

'%ALLUSERSPROFILE%\lwQggIEM\nwAEcgMA.exe'
'%ALLUSERSPROFILE%\vesswIQA\AcIcUcAM.exe'
'%HOMEPATH%\NIMMEwsg\jaQEcQMQ.exe'

Executes the following:

'<SYSTEM32>\cmd.exe' /c ""%TEMP%\eCIgMgYk.bat" "<Full path to virus>""
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\TAccIcwk.bat" "<Full path to virus>""
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\pYQMQAQs.bat" "<Full path to virus>""
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\tAosUsAs.bat" "<Full path to virus>""
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\hkMgIYgQ.bat" "<Full path to virus>""
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\uqskAEkU.bat" "<Full path to virus>""
'<SYSTEM32>\reg.exe' /pid=3000
'<SYSTEM32>\cscript.exe' /pid=3248
'<SYSTEM32>\reg.exe' /pid=3100
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\SKEwYAYI.bat" "<Full path to virus>""
'<SYSTEM32>\reg.exe' %TEMP%\file.vbs
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\VOswAsgo.bat" "<Full path to virus>""
'<SYSTEM32>\cscript.exe' %TEMP%\file.vbs
'<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
'<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
'<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\ryUUgQME.bat" "<Full path to virus>""
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\XUEYkgEo.bat" "<Full path to virus>""
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\TgYMEUAQ.bat" "<Full path to virus>""
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\aSoMUMwA.bat" "<Full path to virus>""
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\BIYAMIQA.bat" "<Full path to virus>""
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\AGYQYcYs.bat" "<Full path to virus>""

Injects code into

the following system processes:

<SYSTEM32>\reg.exe

Modifies file system :

Creates the following files:

<Current directory>\PowE.exe
<Current directory>\FiQM.ico
C:\RCX20.tmp
%TEMP%\eCIgMgYk.bat
%TEMP%\twkAEwgM.bat
%TEMP%\pYQMQAQs.bat
%TEMP%\dcEoIwUk.bat
C:\RCX1E.tmp
<Current directory>\KucM.ico
C:\RCX1F.tmp
<Current directory>\tAMI.exe
<Current directory>\xwMW.exe
<Current directory>\rgYM.ico
C:\RCX23.tmp
<Current directory>\ecEm.exe
<Current directory>\LUgE.ico
C:\RCX22.tmp
<Current directory>\gwMc.exe
<Current directory>\vesA.ico
C:\RCX21.tmp
<Current directory>\vwYY.exe
<Current directory>\HOAE.ico
<Current directory>\JoQS.exe
<Current directory>\wCAE.ico
%TEMP%\tAosUsAs.bat
<Current directory>\CkIA.exe
%TEMP%\MmEAoUIo.bat
C:\RCX1A.tmp
C:\RCX19.tmp
C:\RCX18.tmp
<Current directory>\OIEc.exe
%TEMP%\fkIUkgMg.bat
<Current directory>\tYAk.exe
<Current directory>\GaAU.ico
<Current directory>\GQgA.ico
C:\RCX1C.tmp
<Current directory>\HoUm.exe
<Current directory>\kOoo.ico
C:\RCX1D.tmp
<Current directory>\kEQA.exe
<Current directory>\nQoC.exe
<Current directory>\AGUg.ico
C:\RCX1B.tmp
<Current directory>\RuEY.ico
%TEMP%\hkMgIYgQ.bat
<Current directory>\YEYg.exe
<Current directory>\VKgw.ico
C:\RCX2D.tmp
<Current directory>\gEAs.exe
<Current directory>\GaUA.ico
C:\RCX2C.tmp
<Current directory>\GMsI.exe
<Current directory>\RAUc.ico
C:\RCX2B.tmp
<Current directory>\acAQ.exe
<Current directory>\xAIM.ico
<Current directory>\ngwe.exe
<Current directory>\GWAk.ico
C:\RCX30.tmp
<Current directory>\BsAG.exe
<Current directory>\mWwY.ico
C:\RCX2F.tmp
%TEMP%\oowIIoks.bat
C:\RCX2E.tmp
%TEMP%\SKEwYAYI.bat
<Current directory>\UwAa.exe
<Current directory>\paEw.ico
%TEMP%\uqskAEkU.bat
%TEMP%\TAccIcwk.bat
<Current directory>\MkYw.exe
C:\RCX26.tmp
<Current directory>\awcQ.exe
<Current directory>\OwcE.ico
<Current directory>\MIMs.ico
%TEMP%\gwQgUsow.bat
C:\RCX24.tmp
<Current directory>\CcYs.ico
C:\RCX25.tmp
<Current directory>\FEwU.exe
C:\RCX29.tmp
%TEMP%\lyMYAUsc.bat
<Current directory>\NuEk.ico
C:\RCX2A.tmp
<Current directory>\rUwg.exe
<Current directory>\KEsk.exe
<Current directory>\lQgI.ico
C:\RCX27.tmp
<Current directory>\SAMa.exe
<Current directory>\jycc.ico
C:\RCX28.tmp
<Current directory>\OOUI.ico
%TEMP%\BIYAMIQA.bat
%TEMP%\UsYwUUQE.bat
<Current directory>\AcYw.ico
C:\RCX7.tmp
<Current directory>\ZIMu.exe
C:\RCX6.tmp
<Current directory>\BUkc.exe
<Current directory>\OuIw.ico
C:\RCX5.tmp
<Current directory>\bEAk.exe
<Current directory>\bIQo.ico
C:\RCX9.tmp
<Current directory>\kgoe.exe
<Current directory>\qEYE.ico
C:\RCXA.tmp
<Current directory>\ywIa.exe
<Current directory>\XkAU.ico
<Current directory>\fAYC.exe
<Current directory>\YgYc.ico
C:\RCX8.tmp
%TEMP%\AGYQYcYs.bat
%TEMP%\QIwYIkYc.bat
C:\RCX4.tmp
<Current directory>\PKsM.ico
<Current directory>\<Virus name>
<Current directory>\QEMW.exe
C:\RCX1.tmp
%TEMP%\VOswAsgo.bat
%TEMP%\VEAosoog.bat
%ALLUSERSPROFILE%\vesswIQA\AcIcUcAM
%HOMEPATH%\NIMMEwsg\jaQEcQMQ
%ALLUSERSPROFILE%\lwQggIEM\nwAEcgMA.exe
C:\Documents and Settings\LocalService\NIMMEwsg\jaQEcQMQ
%ALLUSERSPROFILE%\casg.txt
C:\RCX3.tmp
%TEMP%\ykcwEgQI.bat
%TEMP%\ryUUgQME.bat
<Current directory>\YwgY.exe
<Current directory>\deQA.ico
<Current directory>\CQQM.exe
%TEMP%\file.vbs
<Current directory>\nGIg.ico
<Current directory>\WwUQ.exe
<Current directory>\Cewc.ico
C:\RCX2.tmp
C:\RCX13.tmp
<Current directory>\pIcG.exe
<Current directory>\ZaEw.ico
C:\RCX14.tmp
<Current directory>\vwAw.exe
<Current directory>\yMsE.ico
%TEMP%\XUEYkgEo.bat
C:\RCX11.tmp
<Current directory>\jsMo.ico
C:\RCX12.tmp
<Current directory>\DEoC.exe
C:\RCX16.tmp
<Current directory>\nkIi.exe
<Current directory>\IasI.ico
C:\RCX17.tmp
<Current directory>\ZogI.exe
<Current directory>\qYsc.ico
<Current directory>\yOwI.ico
%TEMP%\LeUYsocc.bat
<Current directory>\doEE.exe
%TEMP%\TgYMEUAQ.bat
C:\RCX15.tmp
<Current directory>\qIcI.exe
<Current directory>\bWsA.ico
%TEMP%\yckwoYIE.bat
<Current directory>\zgkc.exe
%TEMP%\aSoMUMwA.bat
C:\RCXD.tmp
C:\RCXC.tmp
<Current directory>\LYwm.exe
<Current directory>\iAwk.ico
C:\RCXB.tmp
<Current directory>\QEgW.exe
<Current directory>\Bykk.ico
<Current directory>\zIYa.exe
<Current directory>\RUcw.ico
C:\RCX10.tmp
%TEMP%\EWYwAsIo.bat
<Current directory>\pGgQ.ico
C:\RCXF.tmp
<Current directory>\tYkA.exe
<Current directory>\BOgg.ico
C:\RCXE.tmp
<Current directory>\sggA.exe
<Current directory>\nOYM.ico

Deletes the following files:

%TEMP%\twkAEwgM.bat
<Current directory>\PowE.exe
<Current directory>\FiQM.ico
<Current directory>\kOoo.ico
<Current directory>\tAMI.exe
<Current directory>\KucM.ico
<Current directory>\gwMc.exe
<Current directory>\xwMW.exe
<Current directory>\rgYM.ico
<Current directory>\ecEm.exe
<Current directory>\vesA.ico
<Current directory>\vwYY.exe
<Current directory>\HOAE.ico
<Current directory>\JoQS.exe
<Current directory>\CkIA.exe
<Current directory>\wCAE.ico
%TEMP%\MmEAoUIo.bat
<Current directory>\OOUI.ico
<Current directory>\tYAk.exe
<Current directory>\GaAU.ico
<Current directory>\nQoC.exe
<Current directory>\HoUm.exe
<Current directory>\GQgA.ico
%TEMP%\dcEoIwUk.bat
<Current directory>\AGUg.ico
<Current directory>\kEQA.exe
<Current directory>\RuEY.ico
%TEMP%\gwQgUsow.bat
<Current directory>\xAIM.ico
<Current directory>\YEYg.exe
<Current directory>\VKgw.ico
<Current directory>\GMsI.exe
<Current directory>\RAUc.ico
<Current directory>\acAQ.exe
%TEMP%\oowIIoks.bat
<Current directory>\paEw.ico
<Current directory>\ngwe.exe
<Current directory>\GWAk.ico
<Current directory>\gEAs.exe
<Current directory>\GaUA.ico
<Current directory>\UwAa.exe
<Current directory>\NuEk.ico
<Current directory>\MkYw.exe
<Current directory>\MIMs.ico
<Current directory>\awcQ.exe
<Current directory>\LUgE.ico
<Current directory>\FEwU.exe
<Current directory>\CcYs.ico
<Current directory>\OwcE.ico
<Current directory>\KEsk.exe
<Current directory>\jycc.ico
<Current directory>\rUwg.exe
<Current directory>\SAMa.exe
<Current directory>\lQgI.ico
%TEMP%\lyMYAUsc.bat
%TEMP%\QIwYIkYc.bat
<Current directory>\fAYC.exe
<Current directory>\YgYc.ico
<Current directory>\bIQo.ico
<Current directory>\ZIMu.exe
<Current directory>\AcYw.ico
<Current directory>\kgoe.exe
<Current directory>\LYwm.exe
<Current directory>\iAwk.ico
<Current directory>\QEgW.exe
<Current directory>\XkAU.ico
<Current directory>\ywIa.exe
<Current directory>\qEYE.ico
<Current directory>\bEAk.exe
<Current directory>\WwUQ.exe
<Current directory>\nGIg.ico
%TEMP%\ykcwEgQI.bat
%TEMP%\VEAosoog.bat
<Current directory>\QEMW.exe
<Current directory>\PKsM.ico
<Current directory>\CQQM.exe
<Current directory>\BUkc.exe
<Current directory>\OuIw.ico
%TEMP%\UsYwUUQE.bat
<Current directory>\Cewc.ico
<Current directory>\YwgY.exe
<Current directory>\deQA.ico
<Current directory>\Bykk.ico
<Current directory>\ZaEw.ico
%TEMP%\LeUYsocc.bat
<Current directory>\doEE.exe
<Current directory>\pIcG.exe
<Current directory>\yMsE.ico
<Current directory>\vwAw.exe
<Current directory>\yOwI.ico
<Current directory>\IasI.ico
%TEMP%\fkIUkgMg.bat
<Current directory>\OIEc.exe
<Current directory>\nkIi.exe
<Current directory>\qYsc.ico
<Current directory>\ZogI.exe
<Current directory>\jsMo.ico
<Current directory>\tYkA.exe
<Current directory>\BOgg.ico
<Current directory>\sggA.exe
%TEMP%\yckwoYIE.bat
<Current directory>\zgkc.exe
<Current directory>\bWsA.ico
<Current directory>\nOYM.ico
<Current directory>\qIcI.exe
<Current directory>\pGgQ.ico
<Current directory>\DEoC.exe
<Current directory>\zIYa.exe
<Current directory>\RUcw.ico
%TEMP%\EWYwAsIo.bat

Moves the following files:

from C:\RCX21.tmp to <Current directory>\gwMc.exe
from C:\RCX20.tmp to <Current directory>\PowE.exe
from C:\RCX1F.tmp to <Current directory>\tAMI.exe
from C:\RCX24.tmp to <Current directory>\ecEm.exe
from C:\RCX23.tmp to <Current directory>\xwMW.exe
from C:\RCX22.tmp to <Current directory>\vwYY.exe
from C:\RCX1B.tmp to <Current directory>\nQoC.exe
from C:\RCX1A.tmp to <Current directory>\CkIA.exe
from C:\RCX19.tmp to <Current directory>\tYAk.exe
from C:\RCX1E.tmp to <Current directory>\JoQS.exe
from C:\RCX1D.tmp to <Current directory>\HoUm.exe
from C:\RCX1C.tmp to <Current directory>\kEQA.exe
from C:\RCX2D.tmp to <Current directory>\YEYg.exe
from C:\RCX2C.tmp to <Current directory>\acAQ.exe
from C:\RCX2B.tmp to <Current directory>\GMsI.exe
from C:\RCX30.tmp to <Current directory>\ngwe.exe
from C:\RCX2F.tmp to <Current directory>\UwAa.exe
from C:\RCX2E.tmp to <Current directory>\gEAs.exe
from C:\RCX27.tmp to <Current directory>\awcQ.exe
from C:\RCX26.tmp to <Current directory>\MkYw.exe
from C:\RCX25.tmp to <Current directory>\FEwU.exe
from C:\RCX2A.tmp to <Current directory>\rUwg.exe
from C:\RCX29.tmp to <Current directory>\KEsk.exe
from C:\RCX28.tmp to <Current directory>\SAMa.exe
from C:\RCX9.tmp to <Current directory>\kgoe.exe
from C:\RCX8.tmp to <Current directory>\fAYC.exe
from C:\RCX7.tmp to <Current directory>\ZIMu.exe
from C:\RCXC.tmp to <Current directory>\QEgW.exe
from C:\RCXB.tmp to <Current directory>\LYwm.exe
from C:\RCXA.tmp to <Current directory>\ywIa.exe
from C:\RCX3.tmp to <Current directory>\CQQM.exe
from C:\RCX2.tmp to <Current directory>\WwUQ.exe
from C:\RCX1.tmp to <Current directory>\QEMW.exe
from C:\RCX6.tmp to <Current directory>\bEAk.exe
from C:\RCX5.tmp to <Current directory>\BUkc.exe
from C:\RCX4.tmp to <Current directory>\YwgY.exe
from C:\RCX15.tmp to <Current directory>\doEE.exe
from C:\RCX14.tmp to <Current directory>\vwAw.exe
from C:\RCX13.tmp to <Current directory>\pIcG.exe
from C:\RCX18.tmp to <Current directory>\OIEc.exe
from C:\RCX17.tmp to <Current directory>\ZogI.exe
from C:\RCX16.tmp to <Current directory>\nkIi.exe
from C:\RCXF.tmp to <Current directory>\sggA.exe
from C:\RCXE.tmp to <Current directory>\tYkA.exe
from C:\RCXD.tmp to <Current directory>\zgkc.exe
from C:\RCX12.tmp to <Current directory>\DEoC.exe
from C:\RCX11.tmp to <Current directory>\qIcI.exe
from C:\RCX10.tmp to <Current directory>\zIYa.exe

Deletes itself.

Network activity:

Connects to:

'74.##5.232.51':80

TCP:

HTTP GET requests:

74.##5.232.51/

UDP:

DNS ASK google.com

Miscellaneous:

Searches for the following windows:

ClassName: '' WindowName: 'Microsoft Windows'
ClassName: '' WindowName: 'AcIcUcAM.exe'
ClassName: 'Indicator' WindowName: ''
ClassName: '' WindowName: 'jaQEcQMQ.exe'

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней