Trojan.DownLoader17.51598

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '1e6f17d9' = '%APPDATA%\1e6f17d9.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '1e6f17d' = 'C:\1e6f17d9\1e6f17d9.exe'

Creates or modifies the following files:

%HOMEPATH%\Start Menu\Programs\Startup\1e6f17d9.exe

Malicious functions:

To complicate detection of its presence in the operating system,

blocks the following features:

System Restore (SR)

Executes the following:

'<SYSTEM32>\vssadmin.exe' Delete Shadows /All /Quiet
'<SYSTEM32>\svchost.exe' netsvcs
'%WINDIR%\explorer.exe'

Injects code into

the following system processes:

<SYSTEM32>\svchost.exe

Modifies file system :

Creates the following files:

%APPDATA%\1e6f17d9.exe
C:\1e6f17d9\1e6f17d9.exe

Network activity:

Connects to:

'mb####gcom.ucv.cl':80
'to#####orenonderzoek.nl':80
'al.##.gov.br':80
'sh##s.cc':80
'we##gen.com':80
'op###uite.it':80
'tr##trac.it':80
'ke###lee.net':80
'ke###-eg.com':80
'ia###ngnok.com':80
'gd.##b.ac.id':80
'po#####oodenwindows.com':80
'v9##1.net':80
'sa####donovaly.sk':80
'ye####yatintadi.com':80
'tr##s.pl':80
'xa###czl.com':80
'ip##ddr.es':80
'my####rnalip.com':80
'cu###yip.com':80
'ze####sterplus.ru':80
'se###roy.com':80
'ta##lu.com':80
'zo##man.com':80
'pe####.itu.edu.tr':80
'yy##st.com':80
'we#######nthefrenchriviera.com':80

TCP:

HTTP GET requests:

http://cu###yip.com/
http://my####rnalip.com/raw
http://ip##ddr.es/

HTTP POST requests:

http://to#####orenonderzoek.nl/wp-content/plugins/wp-db-backup-made/Xoeyqs.php?y=###########
http://al.##.gov.br/cpi/telefonia/wp-content/themes/cpi/GcnPfu.php?h=###########
http://tr##trac.it/wp-content/themes/twentyten/kPog6K.php?t=###########
http://we##gen.com/wp-content/plugins/wp-db-backup/h1X6p7.php?w=###########
http://op###uite.it/wp-content/themes/lightweight/Y7rNkE.php?n=###########
http://mb####gcom.ucv.cl/wp-content/gallery/nSN1_Z.php?w=###########
http://ke###lee.net/wp-content/uploads/2015/01/EqTf2Q.php?r=###########
http://ke###-eg.com/modules/mod_msn/juZPUi.php?s=###########
http://ia###ngnok.com/tmp/XmUk10.php?v=###########
http://gd.##b.ac.id/wp-content/uploads/iMhCqK.php?m=###########
http://po#####oodenwindows.com/tmp/JFwXS6.php?f=###########
http://v9##1.net/wp-content/themes/twentytwelve/H_S2xs.php?c=###########
http://sh##s.cc/wp-content/themes/twentytwelve/vnUN8e.php?q=###########
http://ze####sterplus.ru/wp-content/themes/storefront-paper/WIhbkO.php?v=###########
http://pe####.itu.edu.tr/wp/wp-content/plugins/wp-db-backup/94dXi5.php?s=###########
http://yy##st.com/wp-content/plugins/wp-db-backup-made/ZdOaXp.php?p=###########
http://ye####yatintadi.com/wp-content/plugins/wp-db-backup-made/0Kyc7k.php?a=###########
http://tr##s.pl/stara-strona-backup-20-08-2012/var/Srz7Vd.php?z=###########
http://xa###czl.com/wp-content/themes/zsqx/iRWgt3.php?o=###########
http://zo##man.com/wp-content/plugins/wp-db-backup1/BDEOY6.php?b=###########
http://tr##s.pl/stara-strona-backup-20-08-2012/var/j4m502.php?h=###########
http://sa####donovaly.sk/wp-content/plugins/wp_module/OdZhrT.php?y=###########
http://we#######nthefrenchriviera.com/wp-content/uploads/bcswkG.php?k=###########
http://se###roy.com/wp-content/plugins/wp-db-backup-made/BYA4Ks.php?o=###########
http://ta##lu.com/wp-content/plugins/wp_module/sbML0j.php?r=###########