Trojan.DownLoader23.4644

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Device Manager PC File Event Logs Support' = 'C:\qwvhjaugvlneal\fvlxeseuwy.exe'

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\WMI Resource DNS Manager Bus] 'ImagePath' = 'C:\qwvhjaugvlneal\fvlxeseuwy.exe'
[<HKLM>\SYSTEM\ControlSet001\Services\WMI Resource DNS Manager Bus] 'Start' = '00000002'

Malicious functions:

Executes the following:

'C:\qwvhjaugvlneal\vhafjth.exe' "c:\qwvhjaugvlneal\fvlxeseuwy.exe"
'C:\qwvhjaugvlneal\fvlxeseuwy.exe'
'C:\qwvhjaugvlneal\lhht2g8nnntczyxlyx.exe'

Modifies file system:

Creates the following files:

C:\qwvhjaugvlneal\fvlxeseuwy.exe
C:\qwvhjaugvlneal\vhafjth.exe
C:\qwvhjaugvlneal\lhht2g8nnntczyxlyx.exe
%WINDIR%\qwvhjaugvlneal\rc6nvnrkosj
C:\qwvhjaugvlneal\rc6nvnrkosj

Sets the 'hidden' attribute to the following files:

C:\qwvhjaugvlneal\vhafjth.exe
C:\qwvhjaugvlneal\fvlxeseuwy.exe

Deletes the following files:

C:\qwvhjaugvlneal\lhht2g8nnntczyxlyx.exe
%WINDIR%\qwvhjaugvlneal\rc6nvnrkosj

Network activity:

Connects to:

'qu###bridge.net':80
'se####bridge.net':80
'se####except.net':80
'br###whose.net':80
'qu###except.net':80
'qu####icycle.net':80
'ag####twagon.net':80
'do###wagon.net':80
'se###nwhose.net':80
'se####bicycle.net':80
'qu###whose.net':80
'ga###rwhose.net':80
'fl###except.net':80
'be###rwhose.net':80
'be####bicycle.net':80
'ga####bicycle.net':80
'br###except.net':80
'br####icycle.net':80
'fl###whose.net':80
'fl####icycle.net':80
'fl###bridge.net':80
'br###bridge.net':80
'ag####twithout.net':80
'ca####nwagon.net':80
'la####ithout.net':80
'la###wagon.net':80
'ni####robable.net':80
'de####probable.net':80
'ca####nwithout.net':80
'ca####nprobable.net':80
're###dwagon.net':80
'la####robable.net':80
'la####itchen.net':80
'ca####nkitchen.net':80
'ag####tprobable.net':80
'do####robable.net':80
'do####itchen.net':80
'do####ithout.net':80
'ag####tkitchen.net':80
'ni###wagon.net':80
'ni####itchen.net':80
'de####kitchen.net':80
'de####without.net':80
'de###ewagon.net':80
'ni####ithout.net':80
'de####bicycle.net':80
'ni###whose.net':80
'ni####icycle.net':80
'ni###bridge.net':80
'de####bridge.net':80
'de###ewhose.net':80
'ca####nbridge.net':80
'la####icycle.net':80
'la###bridge.net':80
'la###except.net':80
'ca####nexcept.net':80
'ag####tbridge.net':80
'do###bridge.net':80
'do###except.net':80
'se###nenter.net':80
'ag####texcept.net':80
'ag####tbicycle.net':80
'ni###except.net':80
'de####except.net':80
'do###whose.net':80
'do####icycle.net':80
'ag####twhose.net':80
'ca####nbicycle.net':80
'st####bicycle.net':80
'tr####icycle.net':80
'tr###bridge.net':80
'tr###except.net':80
'st####bridge.net':80
'st###twhose.net':80
'be####bridge.net':80
'ga####bridge.net':80
'ga####except.net':80
'tr###whose.net':80
'be####except.net':80
'el####icexcept.net':80
're####bridge.net':80
're####except.net':80
'la###whose.net':80
'ca####nwhose.net':80
'el####icbridge.net':80
'el####icwhose.net':80
'st####except.net':80
're###dwhose.net':80
're####bicycle.net':80
'el####icbicycle.net':80

TCP:

HTTP GET requests:

http://qu###bridge.net/index.php
http://se####bridge.net/index.php
http://se####except.net/index.php
http://br###whose.net/index.php
http://qu###except.net/index.php
http://qu####icycle.net/index.php
http://ag####twagon.net/index.php
http://do###wagon.net/index.php
http://se###nwhose.net/index.php
http://se####bicycle.net/index.php
http://qu###whose.net/index.php
http://ga###rwhose.net/index.php
http://fl###except.net/index.php
http://be###rwhose.net/index.php
http://be####bicycle.net/index.php
http://ga####bicycle.net/index.php
http://br###except.net/index.php
http://br####icycle.net/index.php
http://fl###whose.net/index.php
http://fl####icycle.net/index.php
http://fl###bridge.net/index.php
http://br###bridge.net/index.php
http://ag####twithout.net/index.php
http://ca####nwagon.net/index.php
http://la####ithout.net/index.php
http://la###wagon.net/index.php
http://ni####robable.net/index.php
http://de####probable.net/index.php
http://ca####nwithout.net/index.php
http://ca####nprobable.net/index.php
http://re###dwagon.net/index.php
http://la####robable.net/index.php
http://la####itchen.net/index.php
http://ca####nkitchen.net/index.php
http://ag####tprobable.net/index.php
http://do####robable.net/index.php
http://do####itchen.net/index.php
http://do####ithout.net/index.php
http://ag####tkitchen.net/index.php
http://ni###wagon.net/index.php
http://ni####itchen.net/index.php
http://de####kitchen.net/index.php
http://de####without.net/index.php
http://de###ewagon.net/index.php
http://ni####ithout.net/index.php
http://de####bicycle.net/index.php
http://ni###whose.net/index.php
http://ni####icycle.net/index.php
http://ni###bridge.net/index.php
http://de####bridge.net/index.php
http://de###ewhose.net/index.php
http://ca####nbridge.net/index.php
http://la####icycle.net/index.php
http://la###bridge.net/index.php
http://la###except.net/index.php
http://ca####nexcept.net/index.php
http://ag####tbridge.net/index.php
http://do###bridge.net/index.php
http://do###except.net/index.php
http://se###nenter.net/index.php
http://ag####texcept.net/index.php
http://ag####tbicycle.net/index.php
http://ni###except.net/index.php
http://de####except.net/index.php
http://do###whose.net/index.php
http://do####icycle.net/index.php
http://ag####twhose.net/index.php
http://ca####nbicycle.net/index.php
http://st####bicycle.net/index.php
http://tr####icycle.net/index.php
http://tr###bridge.net/index.php
http://tr###except.net/index.php
http://st####bridge.net/index.php
http://st###twhose.net/index.php
http://be####bridge.net/index.php
http://ga####bridge.net/index.php
http://ga####except.net/index.php
http://tr###whose.net/index.php
http://be####except.net/index.php
http://el####icexcept.net/index.php
http://re####bridge.net/index.php
http://re####except.net/index.php
http://la###whose.net/index.php
http://ca####nwhose.net/index.php
http://el####icbridge.net/index.php
http://el####icwhose.net/index.php
http://st####except.net/index.php
http://re###dwhose.net/index.php
http://re####bicycle.net/index.php
http://el####icbicycle.net/index.php

UDP:

DNS ASK se####bridge.net
DNS ASK qu####icycle.net
DNS ASK qu###bridge.net
DNS ASK qu###except.net
DNS ASK se####except.net
DNS ASK se####bicycle.net
DNS ASK do###wagon.net
DNS ASK ag####twithout.net
DNS ASK ag####twagon.net
DNS ASK qu###whose.net
DNS ASK se###nwhose.net
DNS ASK fl###except.net
DNS ASK br###except.net
DNS ASK ga###rwhose.net
DNS ASK ga####bicycle.net
DNS ASK be###rwhose.net
DNS ASK fl###bridge.net
DNS ASK fl###whose.net
DNS ASK br###whose.net
DNS ASK br####icycle.net
DNS ASK br###bridge.net
DNS ASK fl####icycle.net
DNS ASK do####ithout.net
DNS ASK la####ithout.net
DNS ASK ca####nwithout.net
DNS ASK ca####nwagon.net
DNS ASK de####probable.net
DNS ASK la###wagon.net
DNS ASK la####itchen.net
DNS ASK re###dwagon.net
DNS ASK el####icwagon.net
DNS ASK ca####nprobable.net
DNS ASK ca####nkitchen.net
DNS ASK la####robable.net
DNS ASK do####robable.net
DNS ASK ni###wagon.net
DNS ASK ag####tprobable.net
DNS ASK ag####tkitchen.net
DNS ASK do####itchen.net
DNS ASK de###ewagon.net
DNS ASK de####kitchen.net
DNS ASK ni####robable.net
DNS ASK ni####itchen.net
DNS ASK ni####ithout.net
DNS ASK de####without.net
DNS ASK be####bicycle.net
DNS ASK de####bicycle.net
DNS ASK ni###whose.net
DNS ASK ni####icycle.net
DNS ASK ni###bridge.net
DNS ASK de####bridge.net
DNS ASK de###ewhose.net
DNS ASK ca####nbridge.net
DNS ASK la####icycle.net
DNS ASK la###bridge.net
DNS ASK la###except.net
DNS ASK ca####nexcept.net
DNS ASK ag####tbridge.net
DNS ASK do###bridge.net
DNS ASK do###except.net
DNS ASK se###nenter.net
DNS ASK ag####texcept.net
DNS ASK ag####tbicycle.net
DNS ASK ni###except.net
DNS ASK de####except.net
DNS ASK do###whose.net
DNS ASK do####icycle.net
DNS ASK ag####twhose.net
DNS ASK ca####nbicycle.net
DNS ASK st####bicycle.net
DNS ASK tr####icycle.net
DNS ASK tr###bridge.net
DNS ASK tr###except.net
DNS ASK st####bridge.net
DNS ASK st###twhose.net
DNS ASK be####bridge.net
DNS ASK ga####bridge.net
DNS ASK ga####except.net
DNS ASK tr###whose.net
DNS ASK be####except.net
DNS ASK el####icexcept.net
DNS ASK re####bridge.net
DNS ASK re####except.net
DNS ASK la###whose.net
DNS ASK ca####nwhose.net
DNS ASK el####icbridge.net
DNS ASK el####icwhose.net
DNS ASK st####except.net
DNS ASK re###dwhose.net
DNS ASK re####bicycle.net
DNS ASK el####icbicycle.net

Miscellaneous:

Searches for the following windows:

ClassName: 'Shell_TrayWnd' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней