Trojan.DownLoader19.7840

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Helper Thread NetBIOS Cache AutoConfig Config' = 'C:\dvqtxqhhsxqlo\ldqflsmg.exe'

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\Search Bus Center Endpoint] 'ImagePath' = 'C:\dvqtxqhhsxqlo\ldqflsmg.exe'
[<HKLM>\SYSTEM\ControlSet001\Services\Search Bus Center Endpoint] 'Start' = '00000002'

Malicious functions:

Creates and executes the following:

'C:\dvqtxqhhsxqlo\zavgizpe.exe' "c:\dvqtxqhhsxqlo\ldqflsmg.exe"
'C:\dvqtxqhhsxqlo\ldqflsmg.exe'
'C:\dvqtxqhhsxqlo\ir2qbxaen9ktrzq1pc.exe'

Modifies file system:

Creates the following files:

C:\dvqtxqhhsxqlo\ldqflsmg.exe
C:\dvqtxqhhsxqlo\zavgizpe.exe
C:\dvqtxqhhsxqlo\ir2qbxaen9ktrzq1pc.exe
%WINDIR%\dvqtxqhhsxqlo\cnubtarzg
C:\dvqtxqhhsxqlo\cnubtarzg

Sets the 'hidden' attribute to the following files:

C:\dvqtxqhhsxqlo\zavgizpe.exe
C:\dvqtxqhhsxqlo\ldqflsmg.exe

Deletes the following files:

C:\dvqtxqhhsxqlo\ir2qbxaen9ktrzq1pc.exe
%WINDIR%\dvqtxqhhsxqlo\cnubtarzg

Network activity:

Connects to:

'fo####nearly.net':80
'su####safety.net':80
'fo####nsafety.net':80
'su###nsmell.net':80
'fo####nsmell.net':80
'su###nearly.net':80
'su####future.net':80
'wh####rearly.net':80
'ri###early.net':80
'wh####rsafety.net':80
'fo####nfuture.net':80
'wh####rsmell.net':80
'ri###smell.net':80
'ex####future.net':80
'be####efuture.net':80
'pe###nsmell.net':80
'be####eearly.net':80
'ex####safety.net':80
'be####esafety.net':80
'ma####esmell.net':80
'ma####esafety.net':80
'pe####future.net':80
'ma####efuture.net':80
'pe###nearly.net':80
'ma####eearly.net':80
'pe####safety.net':80
'ri###safety.net':80
'pi####efuture.net':80
'ci####ttefuture.net':80
'ch####ensmell.net':80
'ci####tteearly.net':80
'pi####esafety.net':80
'ci####ttesafety.net':80
'fa###ysmell.net':80
'fa####safety.net':80
'ch####enfuture.net':80
'fa####future.net':80
'ch####enearly.net':80
'fa###yearly.net':80
'ch####ensafety.net':80
'th###hsmell.net':80
'fi###eearly.net':80
'th###hearly.net':80
'wh####rfuture.net':80
'ri###future.net':80
'fi###esmell.net':80
'fi####safety.net':80
'pi####esmell.net':80
'ci####ttesmell.net':80
'pi####eearly.net':80
'th####safety.net':80
'fi####future.net':80
'th####future.net':80
'wh####rfriend.net':80
'ri###friend.net':80
'fi####laughter.net':80
'ri###fancy.net':80
'wh####rconsider.net':80
'ri####onsider.net':80
'th####laughter.net':80
'th####consider.net':80
'fi####friend.net':80
'th####friend.net':80
'fi###efancy.net':80
'th###hfancy.net':80
'fi####consider.net':80
'fo####nlaughter.net':80
'su###nfancy.net':80
'fo####nfancy.net':80
'pe####friend.net':80
'ma####efriend.net':80
'su####laughter.net':80
'su####consider.net':80
'wh####rlaughter.net':80
'ri####aughter.net':80
'wh####rfancy.net':80
'fo####nconsider.net':80
'su####friend.net':80
'fo####nfriend.net':80
'pi####elaughter.net':80
'en####hlaughter.net':80
'ei###rfancy.net':80
'en####hfancy.net':80
'ch####enfriend.net':80
'fa####friend.net':80
'ei####laughter.net':80
'ei####consider.net':80
'ex###tsmell.net':80
'be####esmell.net':80
'ex###tearly.net':80
'en####hconsider.net':80
'ei####friend.net':80
'en####hfriend.net':80
'pi####econsider.net':80
'ci#####teconsider.net':80
'pi####efriend.net':80
'ci#####telaughter.net':80
'pi####efancy.net':80
'ci####ttefancy.net':80
'ci####ttefriend.net':80
'fa###yfancy.net':80
'ch#####nconsider.net':80
'fa####consider.net':80
'ch#####nlaughter.net':80
'fa####laughter.net':80
'ch####enfancy.net':80

TCP:

HTTP GET requests:

http://fo####nearly.net/index.php
http://su####safety.net/index.php
http://fo####nsafety.net/index.php
http://su###nsmell.net/index.php
http://fo####nsmell.net/index.php
http://su###nearly.net/index.php
http://su####future.net/index.php
http://wh####rearly.net/index.php
http://ri###early.net/index.php
http://wh####rsafety.net/index.php
http://fo####nfuture.net/index.php
http://wh####rsmell.net/index.php
http://ri###smell.net/index.php
http://ex####future.net/index.php
http://be####efuture.net/index.php
http://pe###nsmell.net/index.php
http://be####eearly.net/index.php
http://ex####safety.net/index.php
http://be####esafety.net/index.php
http://ma####esmell.net/index.php
http://ma####esafety.net/index.php
http://pe####future.net/index.php
http://ma####efuture.net/index.php
http://pe###nearly.net/index.php
http://ma####eearly.net/index.php
http://pe####safety.net/index.php
http://ri###safety.net/index.php
http://pi####efuture.net/index.php
http://ci####ttefuture.net/index.php
http://ch####ensmell.net/index.php
http://ci####tteearly.net/index.php
http://pi####esafety.net/index.php
http://ci####ttesafety.net/index.php
http://fa###ysmell.net/index.php
http://fa####safety.net/index.php
http://ch####enfuture.net/index.php
http://fa####future.net/index.php
http://ch####enearly.net/index.php
http://fa###yearly.net/index.php
http://ch####ensafety.net/index.php
http://th###hsmell.net/index.php
http://fi###eearly.net/index.php
http://th###hearly.net/index.php
http://wh####rfuture.net/index.php
http://ri###future.net/index.php
http://fi###esmell.net/index.php
http://fi####safety.net/index.php
http://pi####esmell.net/index.php
http://ci####ttesmell.net/index.php
http://pi####eearly.net/index.php
http://th####safety.net/index.php
http://fi####future.net/index.php
http://th####future.net/index.php
http://wh####rfriend.net/index.php
http://ri###friend.net/index.php
http://fi####laughter.net/index.php
http://ri###fancy.net/index.php
http://wh####rconsider.net/index.php
http://ri####onsider.net/index.php
http://th####laughter.net/index.php
http://th####consider.net/index.php
http://fi####friend.net/index.php
http://th####friend.net/index.php
http://fi###efancy.net/index.php
http://th###hfancy.net/index.php
http://fi####consider.net/index.php
http://fo####nlaughter.net/index.php
http://su###nfancy.net/index.php
http://fo####nfancy.net/index.php
http://pe####friend.net/index.php
http://ma####efriend.net/index.php
http://su####laughter.net/index.php
http://su####consider.net/index.php
http://wh####rlaughter.net/index.php
http://ri####aughter.net/index.php
http://wh####rfancy.net/index.php
http://fo####nconsider.net/index.php
http://su####friend.net/index.php
http://fo####nfriend.net/index.php
http://pi####elaughter.net/index.php
http://en####hlaughter.net/index.php
http://ei###rfancy.net/index.php
http://en####hfancy.net/index.php
http://ch####enfriend.net/index.php
http://fa####friend.net/index.php
http://ei####laughter.net/index.php
http://ei####consider.net/index.php
http://ex###tsmell.net/index.php
http://be####esmell.net/index.php
http://ex###tearly.net/index.php
http://en####hconsider.net/index.php
http://ei####friend.net/index.php
http://en####hfriend.net/index.php
http://pi####econsider.net/index.php
http://ci#####teconsider.net/index.php
http://pi####efriend.net/index.php
http://ci#####telaughter.net/index.php
http://pi####efancy.net/index.php
http://ci####ttefancy.net/index.php
http://ci####ttefriend.net/index.php
http://fa###yfancy.net/index.php
http://ch#####nconsider.net/index.php
http://fa####consider.net/index.php
http://ch#####nlaughter.net/index.php
http://fa####laughter.net/index.php
http://ch####enfancy.net/index.php

UDP:

DNS ASK su####safety.net
DNS ASK fo####nsafety.net
DNS ASK su####future.net
DNS ASK fo####nsmell.net
DNS ASK su###nearly.net
DNS ASK fo####nearly.net
DNS ASK fo####nfuture.net
DNS ASK ri###early.net
DNS ASK wh####rsafety.net
DNS ASK ri###safety.net
DNS ASK wh####rsmell.net
DNS ASK ri###smell.net
DNS ASK wh####rearly.net
DNS ASK be####efuture.net
DNS ASK pe###nsmell.net
DNS ASK ma####esmell.net
DNS ASK ex####safety.net
DNS ASK be####esafety.net
DNS ASK ex####future.net
DNS ASK pe###nearly.net
DNS ASK pe####future.net
DNS ASK ma####efuture.net
DNS ASK su###nsmell.net
DNS ASK ma####eearly.net
DNS ASK pe####safety.net
DNS ASK ma####esafety.net
DNS ASK wh####rfuture.net
DNS ASK ci####ttefuture.net
DNS ASK ch####ensmell.net
DNS ASK fa###ysmell.net
DNS ASK pi####esafety.net
DNS ASK ci####ttesafety.net
DNS ASK pi####efuture.net
DNS ASK ch####enearly.net
DNS ASK ch####enfuture.net
DNS ASK fa####future.net
DNS ASK ei###rsmell.net
DNS ASK fa###yearly.net
DNS ASK ch####ensafety.net
DNS ASK fa####safety.net
DNS ASK fi###eearly.net
DNS ASK th###hearly.net
DNS ASK fi####safety.net
DNS ASK ri###future.net
DNS ASK fi###esmell.net
DNS ASK th###hsmell.net
DNS ASK th####safety.net
DNS ASK ci####ttesmell.net
DNS ASK pi####eearly.net
DNS ASK ci####tteearly.net
DNS ASK fi####future.net
DNS ASK th####future.net
DNS ASK pi####esmell.net
DNS ASK be####eearly.net
DNS ASK wh####rfriend.net
DNS ASK ri###friend.net
DNS ASK fi####laughter.net
DNS ASK ri###fancy.net
DNS ASK wh####rconsider.net
DNS ASK ri####onsider.net
DNS ASK th####laughter.net
DNS ASK th####consider.net
DNS ASK fi####friend.net
DNS ASK th####friend.net
DNS ASK fi###efancy.net
DNS ASK th###hfancy.net
DNS ASK fi####consider.net
DNS ASK fo####nlaughter.net
DNS ASK su###nfancy.net
DNS ASK fo####nfancy.net
DNS ASK pe####friend.net
DNS ASK ma####efriend.net
DNS ASK su####laughter.net
DNS ASK su####consider.net
DNS ASK wh####rlaughter.net
DNS ASK ri####aughter.net
DNS ASK wh####rfancy.net
DNS ASK fo####nconsider.net
DNS ASK su####friend.net
DNS ASK fo####nfriend.net
DNS ASK pi####elaughter.net
DNS ASK en####hlaughter.net
DNS ASK ei###rfancy.net
DNS ASK en####hfancy.net
DNS ASK ch####enfriend.net
DNS ASK fa####friend.net
DNS ASK ei####laughter.net
DNS ASK ei####consider.net
DNS ASK ex###tsmell.net
DNS ASK be####esmell.net
DNS ASK ex###tearly.net
DNS ASK en####hconsider.net
DNS ASK ei####friend.net
DNS ASK en####hfriend.net
DNS ASK pi####econsider.net
DNS ASK ci#####teconsider.net
DNS ASK pi####efriend.net
DNS ASK ci#####telaughter.net
DNS ASK pi####efancy.net
DNS ASK ci####ttefancy.net
DNS ASK ci####ttefriend.net
DNS ASK fa###yfancy.net
DNS ASK ch#####nconsider.net
DNS ASK fa####consider.net
DNS ASK ch#####nlaughter.net
DNS ASK fa####laughter.net
DNS ASK ch####enfancy.net

Miscellaneous:

Searches for the following windows:

ClassName: 'Shell_TrayWnd' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней