Trojan.DownLoader15.19476

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'GuaZhuan' = '"<Full path to virus>" -autorun '

Modifies file system :

Creates the following files:

%APPDATA%\LSinglePro\Temporary Internet Files\Content.IE5\FATFNCQE\h1[1].htm
%APPDATA%\LSinglePro\Temporary Internet Files\Content.IE5\CZIHAJAP\h3[1].htm
%APPDATA%\LSinglePro\Temporary Internet Files\Content.IE5\81Q745UN\c3ff2bb02242268c629a6d2e24fc5df42a490ab1625069ccccee68e0000a86607e663413b5aa77bc327b3126676b286e4a8bdcee6584e8fae5a3464c68dcff...
%APPDATA%\LSinglePro\log.txt
%APPDATA%\LSinglePro\Temporary Internet Files\Content.IE5\CZIHAJAP\h1[1].htm
%APPDATA%\LSinglePro\Temporary Internet Files\Content.IE5\CHY3OH6Z\f2[1].htm
%APPDATA%\LSinglePro\Temporary Internet Files\Content.IE5\FATFNCQE\h3[1].htm
%APPDATA%\LSinglePro\Temporary Internet Files\Content.IE5\81Q745UN\h3[1].htm
%APPDATA%\LSinglePro\Temporary Internet Files\Content.IE5\CZIHAJAP\h3[2].htm
%APPDATA%\LSinglePro\Temporary Internet Files\Content.IE5\CZIHAJAP\f8[1].htm
%APPDATA%\LSinglePro\Temporary Internet Files\Content.IE5\CZIHAJAP\CFGUpdate[1].5&checksum=&cid=E436FF3AD1D84911A973EBE56AB4D21B&rd=8807
%APPDATA%\LSinglePro\Temporary Internet Files\Content.IE5\CHY3OH6Z\h5[1].htm
%APPDATA%\LSinglePro\Temporary Internet Files\Content.IE5\desktop.ini
%APPDATA%\LSinglePro\Temporary Internet Files\Content.IE5\FATFNCQE\desktop.ini
%APPDATA%\LSinglePro\Temporary Internet Files\Content.IE5\81Q745UN\desktop.ini
%APPDATA%\LSinglePro\cfg.ini
%APPDATA%\LSinglePro\Temporary Internet Files\desktop.ini
%APPDATA%\LSinglePro\Temporary Internet Files\Content.IE5\index.dat
%APPDATA%\LSinglePro\Temporary Internet Files\Content.IE5\FATFNCQE\f8[1].htm
%APPDATA%\LSinglePro\Temporary Internet Files\Content.IE5\81Q745UN\f8[1].htm
%APPDATA%\LSinglePro\Temporary Internet Files\Content.IE5\FATFNCQE\CFGUpdate[1].5&checksum=&cid=894088DB6D3F44FDAC2D6FB905ABC18D&rd=4099
%APPDATA%\LSinglePro\Temporary Internet Files\Content.IE5\CZIHAJAP\desktop.ini
%APPDATA%\LSinglePro\Temporary Internet Files\Content.IE5\CHY3OH6Z\desktop.ini
%APPDATA%\LSinglePro\TFExecuter4\cfg.ini

Sets the 'hidden' attribute to the following files:

%APPDATA%\LSinglePro\Temporary Internet Files\Content.IE5\CZIHAJAP\desktop.ini
%APPDATA%\LSinglePro\Temporary Internet Files\Content.IE5\CHY3OH6Z\desktop.ini
%APPDATA%\LSinglePro\Temporary Internet Files\Content.IE5\81Q745UN\desktop.ini
%APPDATA%\LSinglePro\Temporary Internet Files\desktop.ini
%APPDATA%\LSinglePro\Temporary Internet Files\Content.IE5\FATFNCQE\desktop.ini

Deletes the following files:

%APPDATA%\LSinglePro\Temporary Internet Files\Content.IE5\CZIHAJAP\f8[1].htm
%APPDATA%\LSinglePro\Temporary Internet Files\Content.IE5\81Q745UN\f8[1].htm
%APPDATA%\LSinglePro\Temporary Internet Files\Content.IE5\CZIHAJAP\h3[2].htm
%APPDATA%\LSinglePro\Temporary Internet Files\Content.IE5\81Q745UN\h3[1].htm
%APPDATA%\LSinglePro\Temporary Internet Files\desktop.ini
%APPDATA%\LSinglePro\Temporary Internet Files\Content.IE5\desktop.ini
%APPDATA%\LSinglePro\Temporary Internet Files\Content.IE5\CZIHAJAP\h1[1].htm
%APPDATA%\LSinglePro\Temporary Internet Files\Content.IE5\FATFNCQE\f8[1].htm

Network activity:

Connects to:

'ap#.#ap1000.com':8011
'ap#.##uliangbao.cn':80

TCP:

HTTP GET requests:

http://ap#.##uliangbao.cn/clt/jobid/c3ff2bb02242268c629a6d2e24fc5df42a490ab1625069ccccee68e0000a86607e663413b5aa77bc327b3126676b286e4a8bdcee6584e8fae5a3464c68dcff3eadd91fac0129117687daa7e5d89d1...
http://ap#.##uliangbao.cn/redirect/CFGUpdate?nu###############################################################

HTTP POST requests: