Trojan.DownLoader13.16882

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ec525f4' = '%APPDATA%\ec525f4.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ec525f' = 'C:\ec525f4\ec525f4.exe'

Creates or modifies the following files:

%HOMEPATH%\Start Menu\Programs\Startup\ec525f4.exe

Malicious functions:

To complicate detection of its presence in the operating system,

blocks the following features:

System Restore (SR)

Creates and executes the following:

'%TEMP%\3.tmp'
'%TEMP%\2.tmp'

Executes the following:

'<SYSTEM32>\svchost.exe' netsvcs
'<SYSTEM32>\vssadmin.exe' Delete Shadows /All /Quiet
'%WINDIR%\explorer.exe'
'<SYSTEM32>\msiexec.exe'

Injects code into

the following system processes:

<SYSTEM32>\svchost.exe

Modifies file system :

Creates the following files:

C:\ec525f4\ec525f4.exe
%APPDATA%\ec525f4.exe
%TEMP%\2.tmp
%TEMP%\3.tmp

Deletes the following files:

%TEMP%\2.tmp

Network activity:

Connects to:

'pi####istanbul.com':80
'th#####itualhealth.com':80
'dh##2.com':80
'ru##ove.us':80
'yo#####resigns.co.uk':80
'co####security.com':80
'az####h-azavak.cz':80
'kr#######rkonsum.uni-koeln.de':80
'pa###kom.co.id':80
'ar##el.ro':80
'e-###azalar.com':80
'do##film.de':80
'ma#####artins.com.br':80
'my####rnalip.com':80
'cu###yip.com':80
'su####tive.com.tr':80
'20#.#6.232.182':80
'ye##5.com':80
'ip##ddr.es':80
'st#####rketinsiders.com':80
'el########presidentielles-france.fr':80
'ke#####yurtheeram.com':80
'cz####czajka.com':80
'pr###eamigos.cz':80
'mu###edia.com':80

TCP:

HTTP GET requests:

http://cu###yip.com/
http://my####rnalip.com/raw
http://ip##ddr.es/

HTTP POST requests:

http://dh##2.com/wp-content/themes/lightweight/img4.php?e=###########
http://ar##el.ro/blog/wp-content/themes/Chucky/img5.php?u=###########
http://th#####itualhealth.com/wp-content/themes/lightweight/img4.php?e=###########
http://co####security.com/wp-content/themes/grizzly/img5.php?r=###########
http://pi####istanbul.com/wp-content/themes/camilla/img1.php?x=###########
http://kr#######rkonsum.uni-koeln.de/wp-content/themes/UltraLight/img4.php?h=###########
http://pa###kom.co.id/wp-content/themes/satellite_corp/img5.php?z=###########
http://az####h-azavak.cz/wp-content/themes/pixeled/img1.php?l=###########
http://e-###azalar.com/wp-content/themes/em/img2.php?w=###########
http://do##film.de/handler/img3.php?q=###########
http://yo#####resigns.co.uk/wp-content/themes/twentytwelve/img3.php?m=###########
http://pr###eamigos.cz/wp-content/themes/themeboy_football_club_v2.0.8/img2.php?d=###########
http://mu###edia.com/wp-content/themes/lightweight/img2.php?s=###########
http://cz####czajka.com/wp-content/themes/dt-the7-Theme/img3.php?w=###########
http://ye##5.com/system.php
http://su####tive.com.tr/wp-content/themes/pindol/img3.php?l=###########
http://ma#####artins.com.br/blog/wp-content/themes/marcelmartins/img1.php?k=###########
http://ru##ove.us/wp-content/themes/twentyfifteen/img5.php?z=###########
http://ke#####yurtheeram.com/wp-content/themes/kingsize/img2.php?j=###########
http://st#####rketinsiders.com/wp-content/themes/Impreza/img2.php?e=###########
http://el########presidentielles-france.fr/wp-content/themes/theme1917/img5.php?l=###########