Trojan.DownLoader12.32908

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,%ALLUSERSPROFILE%\vesswIQA\AcIcUcAM.exe,'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'AcIcUcAM.exe' = '%ALLUSERSPROFILE%\vesswIQA\AcIcUcAM.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'jaQEcQMQ.exe' = '%HOMEPATH%\NIMMEwsg\jaQEcQMQ.exe'

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\FkYQcQph] 'Start' = '00000002'

Malicious functions:

To complicate detection of its presence in the operating system,

forces the system hide from view:

hidden files
file extensions

blocks the following features:

User Account Control (UAC)

Creates and executes the following:

'%ALLUSERSPROFILE%\lwQggIEM\nwAEcgMA.exe'
'%ALLUSERSPROFILE%\vesswIQA\AcIcUcAM.exe'
'%HOMEPATH%\NIMMEwsg\jaQEcQMQ.exe'

Executes the following:

'<SYSTEM32>\cmd.exe' /c ""%TEMP%\YaocwEEY.bat" "<Full path to virus>""
'<SYSTEM32>\reg.exe' /pid=2712
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\yaAUgcIA.bat" "<Full path to virus>""
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\iMQcUMsU.bat" "<Full path to virus>""
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\RwQUscQk.bat" "<Full path to virus>""
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\oAEcYYYQ.bat" "<Full path to virus>""
'<SYSTEM32>\cscript.exe' /pid=3056
'<SYSTEM32>\reg.exe' /c ""%TEMP%\ssgwkoQE.bat" "<Full path to virus>""
'<SYSTEM32>\reg.exe' /pid=3212
'<SYSTEM32>\reg.exe'
'<SYSTEM32>\reg.exe' /pid=2876
'<SYSTEM32>\cscript.exe' /pid=3148
'<SYSTEM32>\reg.exe' /pid=3396
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\dOMQQYMQ.bat" "<Full path to virus>""
'<SYSTEM32>\cscript.exe' %TEMP%\file.vbs
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\mOAwoQwM.bat" "<Full path to virus>""
'<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
'<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
'<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\eEcQkEsM.bat" "<Full path to virus>""
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\cCEEQEoA.bat" "<Full path to virus>""
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\fIEgkgEA.bat" "<Full path to virus>""
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\HOsskIIQ.bat" "<Full path to virus>""
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\EewQEUws.bat" "<Full path to virus>""
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\QYMUwUcY.bat" "<Full path to virus>""
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\rigoEoQo.bat" "<Full path to virus>""

Injects code into

the following system processes:

<SYSTEM32>\cmd.exe
<SYSTEM32>\reg.exe

Modifies file system :

Creates the following files:

<Current directory>\AIoo.ico
C:\RCX25.tmp
<Current directory>\CMwu.exe
%TEMP%\rKsMwUEg.bat
C:\RCX26.tmp
<Current directory>\FsMs.exe
<Current directory>\daMg.ico
C:\RCX23.tmp
<Current directory>\HEou.exe
<Current directory>\dQsc.ico
C:\RCX24.tmp
<Current directory>\ooEA.exe
<Current directory>\xakw.ico
C:\RCX29.tmp
<Current directory>\yMka.exe
<Current directory>\FcYE.ico
C:\RCX2A.tmp
<Current directory>\KkUy.exe
<Current directory>\nOYg.ico
C:\RCX28.tmp
C:\RCX27.tmp
<Current directory>\QYky.exe
<Current directory>\EgQY.ico
<Current directory>\FsMG.exe
<Current directory>\IwQg.ico
%TEMP%\oAEcYYYQ.bat
C:\RCX1E.tmp
<Current directory>\cEAS.exe
<Current directory>\ewUE.ico
C:\RCX1F.tmp
<Current directory>\RcIa.exe
<Current directory>\ToAM.ico
C:\RCX1D.tmp
<Current directory>\ugAm.exe
<Current directory>\bYYw.ico
%TEMP%\HOsskIIQ.bat
<Current directory>\oIIG.exe
<Current directory>\bycg.ico
C:\RCX1C.tmp
<Current directory>\yoIQ.ico
C:\RCX21.tmp
<Current directory>\SwQq.exe
C:\RCX22.tmp
%TEMP%\RwQUscQk.bat
<Current directory>\fAQS.exe
<Current directory>\JooA.ico
<Current directory>\TcEo.ico
%TEMP%\iMQcUMsU.bat
%TEMP%\NywssIgs.bat
%TEMP%\OEQkssYY.bat
C:\RCX20.tmp
<Current directory>\Jwse.exe
%TEMP%\BOMEIAkU.bat
<Current directory>\IYgM.exe
<Current directory>\yYoI.ico
%TEMP%\ZaQsEIgU.bat
<Current directory>\RYME.ico
%TEMP%\ssgwkoQE.bat
C:\RCX35.tmp
C:\RCX34.tmp
<Current directory>\vMEG.exe
<Current directory>\tOAY.ico
C:\RCX32.tmp
<Current directory>\iYUM.exe
<Current directory>\Rcks.ico
C:\RCX33.tmp
<Current directory>\VwkU.exe
<Current directory>\skoM.ico
C:\RCX38.tmp
<Current directory>\tUoU.ico
%TEMP%\OGcQkkUk.bat
C:\RCX39.tmp
<Current directory>\xAAw.exe
<Current directory>\fcMc.ico
C:\RCX36.tmp
<Current directory>\dYkm.exe
<Current directory>\YMIA.ico
C:\RCX37.tmp
<Current directory>\Qkso.exe
C:\RCX2D.tmp
<Current directory>\kooQ.exe
<Current directory>\OwYo.ico
C:\RCX2E.tmp
<Current directory>\eUYy.exe
<Current directory>\KKgQ.ico
C:\RCX2C.tmp
%TEMP%\YaocwEEY.bat
<Current directory>\HsUe.exe
<Current directory>\zocA.ico
<Current directory>\RAwY.exe
<Current directory>\DaEo.ico
C:\RCX2B.tmp
<Current directory>\ZIUU.exe
<Current directory>\XSYk.ico
C:\RCX30.tmp
<Current directory>\AwoY.exe
<Current directory>\yWEA.ico
C:\RCX31.tmp
%TEMP%\yaAUgcIA.bat
C:\RCX2F.tmp
<Current directory>\BkMW.exe
<Current directory>\eioo.ico
<Current directory>\YcEa.exe
<Current directory>\JAYA.ico
%TEMP%\eOAoAIYw.bat
C:\RCX7.tmp
<Current directory>\lcsu.exe
<Current directory>\AoQE.ico
C:\RCX8.tmp
<Current directory>\qQcK.exe
<Current directory>\MGIY.ico
C:\RCX6.tmp
<Current directory>\YAUw.exe
<Current directory>\VMkI.ico
%TEMP%\EewQEUws.bat
<Current directory>\dMUw.exe
<Current directory>\hiMA.ico
C:\RCX5.tmp
%TEMP%\QYMUwUcY.bat
<Current directory>\pUgc.exe
<Current directory>\wKsE.ico
<Current directory>\KMkm.exe
<Current directory>\kQck.ico
C:\RCXB.tmp
%TEMP%\UIcUscEU.bat
C:\RCX9.tmp
<Current directory>\sAII.exe
<Current directory>\rAEo.ico
C:\RCXA.tmp
<Current directory>\Fsss.exe
<Current directory>\pgEQ.ico
<Current directory>\CogE.exe
%TEMP%\dOMQQYMQ.bat
<Current directory>\oYYs.ico
%TEMP%\euwQsUAc.bat
%TEMP%\file.vbs
C:\RCX1.tmp
<Current directory>\<Virus name>
%ALLUSERSPROFILE%\lwQggIEM\nwAEcgMA.exe
%ALLUSERSPROFILE%\vesswIQA\AcIcUcAM
%HOMEPATH%\NIMMEwsg\jaQEcQMQ
%TEMP%\JagIckog.bat
C:\Documents and Settings\LocalService\NIMMEwsg\jaQEcQMQ
%ALLUSERSPROFILE%\casg.txt
%TEMP%\AYosoQMQ.bat
C:\RCX3.tmp
<Current directory>\OkIg.exe
C:\RCX4.tmp
<Current directory>\JcMU.exe
<Current directory>\BIAk.ico
<Current directory>\LGcU.ico
%TEMP%\nkIMcAYM.bat
%TEMP%\mOAwoQwM.bat
<Current directory>\giIQ.ico
C:\RCX2.tmp
<Current directory>\goMA.exe
%TEMP%\eEcQkEsM.bat
C:\RCXC.tmp
<Current directory>\OoEe.exe
<Current directory>\AkME.ico
C:\RCX16.tmp
<Current directory>\SQcy.exe
<Current directory>\agIQ.ico
C:\RCX17.tmp
<Current directory>\FAYm.exe
<Current directory>\Vogq.exe
<Current directory>\VuQQ.ico
%TEMP%\uuMkEgUs.bat
<Current directory>\LKsc.ico
C:\RCX15.tmp
%TEMP%\cCEEQEoA.bat
<Current directory>\EGIs.ico
C:\RCX1A.tmp
<Current directory>\iwkQ.exe
%TEMP%\wyYIYcIc.bat
C:\RCX1B.tmp
<Current directory>\WsEu.exe
<Current directory>\Seks.ico
<Current directory>\Fwoc.exe
<Current directory>\QgMM.ico
C:\RCX18.tmp
%TEMP%\fIEgkgEA.bat
C:\RCX19.tmp
%TEMP%\yqUUEcIc.bat
C:\RCXF.tmp
%TEMP%\mGwAscwM.bat
<Current directory>\mssI.exe
<Current directory>\ekkg.exe
<Current directory>\awYM.ico
%TEMP%\rigoEoQo.bat
<Current directory>\ACQg.ico
C:\RCXD.tmp
<Current directory>\Jocc.exe
<Current directory>\GUcQ.ico
C:\RCXE.tmp
<Current directory>\vMIg.exe
<Current directory>\QCwM.ico
C:\RCX13.tmp
<Current directory>\tssm.exe
<Current directory>\YEYU.ico
C:\RCX14.tmp
<Current directory>\EIkc.exe
<Current directory>\tQIo.ico
C:\RCX12.tmp
<Current directory>\TkYU.exe
<Current directory>\JOQM.ico
C:\RCX10.tmp
<Current directory>\rQQI.exe
<Current directory>\vooE.ico
C:\RCX11.tmp

Deletes the following files:

<Current directory>\AIoo.ico
%TEMP%\rKsMwUEg.bat
<Current directory>\EgQY.ico
<Current directory>\QYky.exe
<Current directory>\CMwu.exe
<Current directory>\xakw.ico
<Current directory>\FsMs.exe
<Current directory>\daMg.ico
<Current directory>\nOYg.ico
<Current directory>\KkUy.exe
<Current directory>\HsUe.exe
%TEMP%\BOMEIAkU.bat
<Current directory>\IwQg.ico
<Current directory>\FsMG.exe
<Current directory>\FcYE.ico
<Current directory>\yMka.exe
<Current directory>\ToAM.ico
<Current directory>\RcIa.exe
<Current directory>\TcEo.ico
<Current directory>\Jwse.exe
<Current directory>\cEAS.exe
<Current directory>\bycg.ico
%TEMP%\NywssIgs.bat
<Current directory>\ewUE.ico
<Current directory>\HEou.exe
<Current directory>\yoIQ.ico
<Current directory>\ooEA.exe
<Current directory>\dQsc.ico
<Current directory>\SwQq.exe
%TEMP%\OEQkssYY.bat
<Current directory>\fAQS.exe
<Current directory>\JooA.ico
<Current directory>\zocA.ico
<Current directory>\yYoI.ico
<Current directory>\IYgM.exe
<Current directory>\RYME.ico
<Current directory>\dYkm.exe
<Current directory>\iYUM.exe
<Current directory>\tOAY.ico
%TEMP%\ZaQsEIgU.bat
<Current directory>\Rcks.ico
%TEMP%\OGcQkkUk.bat
%TEMP%\ssgwkoQE.bat
<Current directory>\skoM.ico
<Current directory>\VwkU.exe
<Current directory>\fcMc.ico
<Current directory>\Qkso.exe
<Current directory>\YMIA.ico
<Current directory>\xAAw.exe
<Current directory>\KKgQ.ico
<Current directory>\eUYy.exe
<Current directory>\eioo.ico
<Current directory>\BkMW.exe
<Current directory>\DaEo.ico
<Current directory>\RAwY.exe
<Current directory>\OwYo.ico
<Current directory>\kooQ.exe
<Current directory>\AwoY.exe
<Current directory>\XSYk.ico
<Current directory>\vMEG.exe
<Current directory>\yWEA.ico
<Current directory>\YcEa.exe
%TEMP%\eOAoAIYw.bat
<Current directory>\ZIUU.exe
<Current directory>\JAYA.ico
<Current directory>\oIIG.exe
<Current directory>\rAEo.ico
<Current directory>\sAII.exe
<Current directory>\Fsss.exe
%TEMP%\UIcUscEU.bat
<Current directory>\AoQE.ico
<Current directory>\lcsu.exe
<Current directory>\MGIY.ico
<Current directory>\qQcK.exe
<Current directory>\Jocc.exe
<Current directory>\kQck.ico
<Current directory>\vMIg.exe
<Current directory>\GUcQ.ico
<Current directory>\pUgc.exe
<Current directory>\pgEQ.ico
<Current directory>\KMkm.exe
<Current directory>\wKsE.ico
<Current directory>\goMA.exe
%TEMP%\nkIMcAYM.bat
<Current directory>\OkIg.exe
<Current directory>\giIQ.ico
<Current directory>\CogE.exe
%TEMP%\JagIckog.bat
%TEMP%\euwQsUAc.bat
<Current directory>\oYYs.ico
<Current directory>\VMkI.ico
<Current directory>\YAUw.exe
<Current directory>\hiMA.ico
<Current directory>\dMUw.exe
%TEMP%\AYosoQMQ.bat
<Current directory>\LGcU.ico
<Current directory>\BIAk.ico
<Current directory>\JcMU.exe
<Current directory>\QCwM.ico
<Current directory>\agIQ.ico
<Current directory>\SQcy.exe
<Current directory>\Fwoc.exe
%TEMP%\yqUUEcIc.bat
<Current directory>\LKsc.ico
<Current directory>\FAYm.exe
<Current directory>\AkME.ico
<Current directory>\OoEe.exe
<Current directory>\EGIs.ico
<Current directory>\WsEu.exe
<Current directory>\bYYw.ico
<Current directory>\ugAm.exe
<Current directory>\iwkQ.exe
<Current directory>\QgMM.ico
%TEMP%\wyYIYcIc.bat
<Current directory>\Seks.ico
<Current directory>\TkYU.exe
<Current directory>\awYM.ico
<Current directory>\rQQI.exe
<Current directory>\JOQM.ico
<Current directory>\mssI.exe
%TEMP%\mGwAscwM.bat
<Current directory>\ekkg.exe
<Current directory>\ACQg.ico
<Current directory>\tQIo.ico
%TEMP%\uuMkEgUs.bat
<Current directory>\VuQQ.ico
<Current directory>\Vogq.exe
<Current directory>\tssm.exe
<Current directory>\vooE.ico
<Current directory>\EIkc.exe
<Current directory>\YEYU.ico

Moves the following files:

from C:\RCX27.tmp to <Current directory>\QYky.exe
from C:\RCX26.tmp to <Current directory>\FsMs.exe
from C:\RCX25.tmp to <Current directory>\CMwu.exe
from C:\RCX28.tmp to <Current directory>\FsMG.exe
from C:\RCX2B.tmp to <Current directory>\HsUe.exe
from C:\RCX2A.tmp to <Current directory>\KkUy.exe
from C:\RCX29.tmp to <Current directory>\yMka.exe
from C:\RCX20.tmp to <Current directory>\Jwse.exe
from C:\RCX1F.tmp to <Current directory>\RcIa.exe
from C:\RCX1E.tmp to <Current directory>\cEAS.exe
from C:\RCX21.tmp to <Current directory>\SwQq.exe
from C:\RCX24.tmp to <Current directory>\ooEA.exe
from C:\RCX23.tmp to <Current directory>\HEou.exe
from C:\RCX22.tmp to <Current directory>\fAQS.exe
from C:\RCX35.tmp to <Current directory>\IYgM.exe
from C:\RCX34.tmp to <Current directory>\iYUM.exe
from C:\RCX33.tmp to <Current directory>\vMEG.exe
from C:\RCX36.tmp to <Current directory>\dYkm.exe
from C:\RCX39.tmp to <Current directory>\VwkU.exe
from C:\RCX38.tmp to <Current directory>\xAAw.exe
from C:\RCX37.tmp to <Current directory>\Qkso.exe
from C:\RCX2E.tmp to <Current directory>\eUYy.exe
from C:\RCX2D.tmp to <Current directory>\kooQ.exe
from C:\RCX2C.tmp to <Current directory>\RAwY.exe
from C:\RCX2F.tmp to <Current directory>\BkMW.exe
from C:\RCX32.tmp to <Current directory>\AwoY.exe
from C:\RCX31.tmp to <Current directory>\ZIUU.exe
from C:\RCX30.tmp to <Current directory>\YcEa.exe
from C:\RCX1D.tmp to <Current directory>\oIIG.exe
from C:\RCXA.tmp to <Current directory>\Fsss.exe
from C:\RCX9.tmp to <Current directory>\sAII.exe
from C:\RCX8.tmp to <Current directory>\qQcK.exe
from C:\RCXB.tmp to <Current directory>\pUgc.exe
from C:\RCXE.tmp to <Current directory>\vMIg.exe
from C:\RCXD.tmp to <Current directory>\Jocc.exe
from C:\RCXC.tmp to <Current directory>\KMkm.exe
from C:\RCX3.tmp to <Current directory>\OkIg.exe
from C:\RCX2.tmp to <Current directory>\goMA.exe
from C:\RCX1.tmp to <Current directory>\CogE.exe
from C:\RCX4.tmp to <Current directory>\JcMU.exe
from C:\RCX7.tmp to <Current directory>\lcsu.exe
from C:\RCX6.tmp to <Current directory>\dMUw.exe
from C:\RCX5.tmp to <Current directory>\YAUw.exe
from C:\RCX18.tmp to <Current directory>\SQcy.exe
from C:\RCX17.tmp to <Current directory>\OoEe.exe
from C:\RCX16.tmp to <Current directory>\FAYm.exe
from C:\RCX19.tmp to <Current directory>\Fwoc.exe
from C:\RCX1C.tmp to <Current directory>\ugAm.exe
from C:\RCX1B.tmp to <Current directory>\WsEu.exe
from C:\RCX1A.tmp to <Current directory>\iwkQ.exe
from C:\RCX11.tmp to <Current directory>\TkYU.exe
from C:\RCX10.tmp to <Current directory>\ekkg.exe
from C:\RCXF.tmp to <Current directory>\mssI.exe
from C:\RCX12.tmp to <Current directory>\rQQI.exe
from C:\RCX15.tmp to <Current directory>\Vogq.exe
from C:\RCX14.tmp to <Current directory>\EIkc.exe
from C:\RCX13.tmp to <Current directory>\tssm.exe

Deletes itself.

Network activity:

Connects to:

'74.##5.232.51':80

TCP:

HTTP GET requests:

74.##5.232.51/

UDP:

DNS ASK google.com

Miscellaneous:

Searches for the following windows:

ClassName: '' WindowName: 'Microsoft Windows'
ClassName: '' WindowName: 'jaQEcQMQ.exe'
ClassName: 'Indicator' WindowName: ''
ClassName: '' WindowName: 'AcIcUcAM.exe'

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней