Trojan.DownLoader17.52833

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'AutoConnect User-mode Center Connectivity' = '<SYSTEM32>\khwxbhjvhrf.exe'

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\Controls Remote Shadow Program AutoConnect] 'Start' = '00000002'

Malicious functions:

To complicate detection of its presence in the operating system,

blocks the following features:

Windows Security Center

Creates and executes the following:

'<SYSTEM32>\aprrfowt.exe' "<SYSTEM32>\khwxbhjvhrf.exe"
'%WINDIR%\Temp\ztdfqacb3dllkz.exe' -r 43369 tcp
'%TEMP%\ztdfqacb37eykzrgism9t.exe'
'<SYSTEM32>\khwxbhjvhrf.exe'

Modifies file system :

Creates the following files:

<SYSTEM32>\yzpjbptis\run
<SYSTEM32>\yzpjbptis\rng
%WINDIR%\Temp\ztdfqacb3dllkz.exe
<SYSTEM32>\yzpjbptis\cfg
<SYSTEM32>\aprrfowt.exe
%TEMP%\ztdfqacb37eykzrgism9t.exe
<SYSTEM32>\yzpjbptis\tst
<SYSTEM32>\khwxbhjvhrf.exe
<SYSTEM32>\yzpjbptis\etc

Sets the 'hidden' attribute to the following files:

<SYSTEM32>\aprrfowt.exe
<SYSTEM32>\khwxbhjvhrf.exe

Deletes the following files:

%WINDIR%\Temp\ztdfqacb3dllkz.exe
<DRIVERS>\etc\hosts
%TEMP%\ztdfqacb37eykzrgism9t.exe

Substitutes the HOSTS file.

Network activity:

Connects to:

'qu###throw.net':80
'th###hrow.net':80
'th###tock.net':80
'he###hole.net':80
'qu###stock.net':80
'qu###reply.net':80
'su###ystock.net':80
'mo###tock.net':80
'th###hole.net':80
'th###eply.net':80
'qu###whole.net':80
'si###whole.net':80
'ca###tock.net':80
'th###whole.net':80
'th###reply.net':80
'si###reply.net':80
'he###tock.net':80
'he###eply.net':80
'ca###hole.net':80
'ca###eply.net':80
'ca###hrow.net':80
'he###hrow.net':80
'cl###stock.net':80
'da###tock.net':80
'si###hole.net':80
'si###eply.net':80
'me###hole.net':80
'cl###throw.net':80
'cl###whole.net':80
'da###hole.net':80
'da###eply.net':80
'da###hrow.net':80
'cl###reply.net':80
'mo###eply.net':80
'su###ywhole.net':80
'su###yreply.net':80
'su###ythrow.net':80
'mo###hrow.net':80
'mo###hole.net':80
'si###hrow.net':80
'me###eply.net':80
'me###hrow.net':80
'me###tock.net':80
'si###tock.net':80
'si###throw.net':80
'si###oud.net':80
'me###ree.net':80
'me###oud.net':80
'me####ousand.net':80
'si####ousand.net':80
'si###ree.net':80
'da####ousand.net':80
'cl###loud.net':80
'cl####housand.net':80
'cl####aturday.net':80
'da####turday.net':80
'de###lxc.com':80
'mo####ousand.net':80
'be##lxc.com':80
'ri###nstorm.net':80
'af###sllc.com':80
'su###yloud.net':80
'me####turday.net':80
'si####turday.net':80
'mo###ree.net':80
'mo###oud.net':80
'su###ytree.net':80
'du###hrow.net':80
'wi###eply.net':80
'wi###hrow.net':80
'wi###tock.net':80
'du###tock.net':80
'du###eply.net':80
'si###stock.net':80
'th###throw.net':80
'th###stock.net':80
'wi###hole.net':80
'du###hole.net':80
'mi###tock.net':80
'tr###stock.net':80
'da###ree.net':80
'da###oud.net':80
'cl###tree.net':80
'mi###hrow.net':80
'mi###hole.net':80
'tr###whole.net':80
'tr###reply.net':80
'tr###throw.net':80
'mi###eply.net':80

TCP:

HTTP GET requests:

http://qu###throw.net/index.php
http://th###hrow.net/index.php
http://th###tock.net/index.php
http://he###hole.net/index.php
http://qu###stock.net/index.php
http://qu###reply.net/index.php
http://su###ystock.net/index.php
http://mo###tock.net/index.php
http://th###hole.net/index.php
http://th###eply.net/index.php
http://qu###whole.net/index.php
http://si###whole.net/index.php
http://ca###tock.net/index.php
http://th###whole.net/index.php
http://th###reply.net/index.php
http://si###reply.net/index.php
http://he###tock.net/index.php
http://he###eply.net/index.php
http://ca###hole.net/index.php
http://ca###eply.net/index.php
http://ca###hrow.net/index.php
http://he###hrow.net/index.php
http://cl###stock.net/index.php
http://da###tock.net/index.php
http://si###hole.net/index.php
http://si###eply.net/index.php
http://me###hole.net/index.php
http://cl###throw.net/index.php
http://cl###whole.net/index.php
http://da###hole.net/index.php
http://da###eply.net/index.php
http://da###hrow.net/index.php
http://cl###reply.net/index.php
http://mo###eply.net/index.php
http://su###ywhole.net/index.php
http://su###yreply.net/index.php
http://su###ythrow.net/index.php
http://mo###hrow.net/index.php
http://mo###hole.net/index.php
http://si###hrow.net/index.php
http://me###eply.net/index.php
http://me###hrow.net/index.php
http://me###tock.net/index.php
http://si###tock.net/index.php
http://si###throw.net/index.php
http://si###oud.net/index.php
http://me###ree.net/index.php
http://me###oud.net/index.php
http://me####ousand.net/index.php
http://si####ousand.net/index.php
http://si###ree.net/index.php
http://da####ousand.net/index.php
http://cl###loud.net/index.php
http://cl####housand.net/index.php
http://cl####aturday.net/index.php
http://da####turday.net/index.php
http://de###lxc.com/index.php
http://mo####ousand.net/index.php
http://be##lxc.com/index.php
http://ri###nstorm.net/index.php
http://af###sllc.com/index.php
http://su###yloud.net/index.php
http://me####turday.net/index.php
http://si####turday.net/index.php
http://mo###ree.net/index.php
http://mo###oud.net/index.php
http://su###ytree.net/index.php
http://du###hrow.net/index.php
http://wi###eply.net/index.php
http://wi###hrow.net/index.php
http://wi###tock.net/index.php
http://du###tock.net/index.php
http://du###eply.net/index.php
http://si###stock.net/index.php
http://th###throw.net/index.php
http://th###stock.net/index.php
http://wi###hole.net/index.php
http://du###hole.net/index.php
http://mi###tock.net/index.php
http://tr###stock.net/index.php
http://da###ree.net/index.php
http://da###oud.net/index.php
http://cl###tree.net/index.php
http://mi###hrow.net/index.php
http://mi###hole.net/index.php
http://tr###whole.net/index.php
http://tr###reply.net/index.php
http://tr###throw.net/index.php
http://mi###eply.net/index.php

UDP:

DNS ASK th###tock.net
DNS ASK qu###throw.net
DNS ASK qu###stock.net
DNS ASK ca###hole.net
DNS ASK he###hole.net
DNS ASK th###hrow.net
DNS ASK th###hole.net
DNS ASK su###ystock.net
DNS ASK qu###whole.net
DNS ASK qu###reply.net
DNS ASK th###eply.net
DNS ASK th###whole.net
DNS ASK si###whole.net
DNS ASK si###reply.net
DNS ASK si###throw.net
DNS ASK th###reply.net
DNS ASK ca###tock.net
DNS ASK ca###eply.net
DNS ASK he###eply.net
DNS ASK he###hrow.net
DNS ASK he###tock.net
DNS ASK ca###hrow.net
DNS ASK mo###tock.net
DNS ASK cl###stock.net
DNS ASK da###tock.net
DNS ASK si###hole.net
DNS ASK si###eply.net
DNS ASK me###hole.net
DNS ASK cl###throw.net
DNS ASK cl###whole.net
DNS ASK da###hole.net
DNS ASK da###eply.net
DNS ASK da###hrow.net
DNS ASK cl###reply.net
DNS ASK mo###eply.net
DNS ASK su###ywhole.net
DNS ASK su###yreply.net
DNS ASK su###ythrow.net
DNS ASK mo###hrow.net
DNS ASK mo###hole.net
DNS ASK si###hrow.net
DNS ASK me###eply.net
DNS ASK me###hrow.net
DNS ASK me###tock.net
DNS ASK si###tock.net
DNS ASK si###oud.net
DNS ASK me###ree.net
DNS ASK me###oud.net
DNS ASK me####ousand.net
DNS ASK si####ousand.net
DNS ASK si###ree.net
DNS ASK da####ousand.net
DNS ASK cl###loud.net
DNS ASK cl####housand.net
DNS ASK cl####aturday.net
DNS ASK da####turday.net
DNS ASK de###lxc.com
DNS ASK mo####ousand.net
DNS ASK be##lxc.com
DNS ASK ri###nstorm.net
DNS ASK af###sllc.com
DNS ASK su###yloud.net
DNS ASK me####turday.net
DNS ASK si####turday.net
DNS ASK mo###ree.net
DNS ASK mo###oud.net
DNS ASK su###ytree.net
DNS ASK du###hrow.net
DNS ASK wi###eply.net
DNS ASK wi###hrow.net
DNS ASK wi###tock.net
DNS ASK du###tock.net
DNS ASK du###eply.net
DNS ASK si###stock.net
DNS ASK th###throw.net
DNS ASK th###stock.net
DNS ASK wi###hole.net
DNS ASK du###hole.net
DNS ASK mi###tock.net
DNS ASK tr###stock.net
DNS ASK da###ree.net
DNS ASK da###oud.net
DNS ASK cl###tree.net
DNS ASK mi###hrow.net
DNS ASK mi###hole.net
DNS ASK tr###whole.net
DNS ASK tr###reply.net
DNS ASK tr###throw.net
DNS ASK mi###eply.net
'23#.#55.255.250':1900

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней