Trojan.DownLoader19.7659

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Virtual Modules Office Auto Resource Internet' = '<SYSTEM32>\cyesevoorz.exe'

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\Presentation Font Collector HomeGroup Transaction] 'ImagePath' = '<SYSTEM32>\cyesevoorz.exe'
[<HKLM>\SYSTEM\ControlSet001\Services\Presentation Font Collector HomeGroup Transaction] 'Start' = '00000002'

Malicious functions:

To complicate detection of its presence in the operating system,

blocks the following features:

Windows Security Center

Creates and executes the following:

'<SYSTEM32>\wampotralg.exe' "<SYSTEM32>\cyesevoorz.exe"
'%WINDIR%\Temp\osburrj3z58a51zgpy.exe' -r 45269 tcp
'%TEMP%\osburrj3ehzw0szgpyxl6dij.exe'
'<SYSTEM32>\cyesevoorz.exe'

Modifies file system:

Creates the following files:

<SYSTEM32>\sylhsfbvtywg\run
<SYSTEM32>\sylhsfbvtywg\rng
%WINDIR%\Temp\osburrj3z58a51zgpy.exe
<SYSTEM32>\sylhsfbvtywg\cfg
%TEMP%\osburrj3ehzw0szgpyxl6dij.exe
<SYSTEM32>\sylhsfbvtywg\tst
<SYSTEM32>\wampotralg.exe
<SYSTEM32>\cyesevoorz.exe

Sets the 'hidden' attribute to the following files:

<SYSTEM32>\wampotralg.exe
<SYSTEM32>\cyesevoorz.exe

Deletes the following files:

%WINDIR%\Temp\osburrj3z58a51zgpy.exe
%TEMP%\osburrj3ehzw0szgpyxl6dij.exe

Network activity:

Connects to:

'tr###body.net':80
'yo###ody.net':80
'tr###dance.net':80
'yo###ance.net':80
'tr###tell.net':80
'vi###are.net':80
'lr###dance.net':80
'yo###ell.net':80
'lr###dare.net':80
'yo###are.net':80
'wa###even.net':80
'ta###even.net':80
'wa###ome.net':80
'ta###ome.net':80
'wa###oday.net':80
'ta###uch.net':80
'tr###dare.net':80
'ta###oday.net':80
'wa###uch.net':80
'fi###ell.net':80
'se###dare.net':80
'fi###ody.net':80
'pl###tell.net':80
'le###dare.net':80
'se###body.net':80
'le###body.net':80
'se###dance.net':80
'le###dance.net':80
'pl###body.net':80
'vi###ody.net':80
'lr###tell.net':80
'vi###ance.net':80
'lr###body.net':80
'vi###ell.net':80
'pl###dance.net':80
'fi###ance.net':80
'pl###dare.net':80
'fi###are.net':80
'mu###uch.net':80
'le###today.net':80
'se###such.net':80
'ef###tbuilt.net':80
'th###while.net':80
'le###such.net':80
'to###even.net':80
'fa###even.net':80
'to###ome.net':80
'fa###ome.net':80
'ri###nstorm.net':80
'de####promise.net':80
'se####strong.net':80
'or###thrown.net':80
'jo####ymeasure.net':80
'si######edwerryhouse.net':80
'gw#####ynhuddleston.net':80
'of####urprise.net':80
'mo####gduring.net':80
'ch####nother.net':80
'pi###some.net':80
'mu###ome.net':80
'we###uch.net':80
've###uch.net':80
'pi###seven.net':80
'mu###oday.net':80
'pi###such.net':80
'mu###even.net':80
'pi###today.net':80
've###oday.net':80
'to###uch.net':80
'fa###uch.net':80
'to###oday.net':80
'fa###oday.net':80
'we###ome.net':80
've###even.net':80
'we###oday.net':80
've###ome.net':80
'we###even.net':80

TCP:

HTTP GET requests:

http://tr###body.net/index.php
http://yo###ody.net/index.php
http://tr###dance.net/index.php
http://yo###ance.net/index.php
http://tr###tell.net/index.php
http://vi###are.net/index.php
http://lr###dance.net/index.php
http://yo###ell.net/index.php
http://lr###dare.net/index.php
http://yo###are.net/index.php
http://wa###even.net/index.php
http://ta###even.net/index.php
http://wa###ome.net/index.php
http://ta###ome.net/index.php
http://wa###oday.net/index.php
http://ta###uch.net/index.php
http://tr###dare.net/index.php
http://ta###oday.net/index.php
http://wa###uch.net/index.php
http://fi###ell.net/index.php
http://se###dare.net/index.php
http://fi###ody.net/index.php
http://pl###tell.net/index.php
http://le###dare.net/index.php
http://se###body.net/index.php
http://le###body.net/index.php
http://se###dance.net/index.php
http://le###dance.net/index.php
http://pl###body.net/index.php
http://vi###ody.net/index.php
http://lr###tell.net/index.php
http://vi###ance.net/index.php
http://lr###body.net/index.php
http://vi###ell.net/index.php
http://pl###dance.net/index.php
http://fi###ance.net/index.php
http://pl###dare.net/index.php
http://fi###are.net/index.php
http://mu###uch.net/index.php
http://le###today.net/index.php
http://se###such.net/index.php
http://ef###tbuilt.net/index.php
http://th###while.net/index.php
http://le###such.net/index.php
http://to###even.net/index.php
http://fa###even.net/index.php
http://to###ome.net/index.php
http://fa###ome.net/index.php
http://ri###nstorm.net/index.php
http://de####promise.net/index.php
http://se####strong.net/index.php
http://or###thrown.net/index.php
http://jo####ymeasure.net/index.php
http://si######edwerryhouse.net/index.php
http://gw#####ynhuddleston.net/index.php
http://of####urprise.net/index.php
http://mo####gduring.net/index.php
http://ch####nother.net/index.php
http://pi###some.net/index.php
http://mu###ome.net/index.php
http://we###uch.net/index.php
http://ve###uch.net/index.php
http://pi###seven.net/index.php
http://mu###oday.net/index.php
http://pi###such.net/index.php
http://mu###even.net/index.php
http://pi###today.net/index.php
http://ve###oday.net/index.php
http://to###uch.net/index.php
http://fa###uch.net/index.php
http://to###oday.net/index.php
http://fa###oday.net/index.php
http://we###ome.net/index.php
http://ve###even.net/index.php
http://we###oday.net/index.php
http://ve###ome.net/index.php
http://we###even.net/index.php

UDP:

DNS ASK tr###body.net
DNS ASK yo###ody.net
DNS ASK tr###dance.net
DNS ASK yo###ance.net
DNS ASK tr###tell.net
DNS ASK vi###are.net
DNS ASK lr###dance.net
DNS ASK yo###ell.net
DNS ASK lr###dare.net
DNS ASK yo###are.net
DNS ASK wa###even.net
DNS ASK ta###even.net
DNS ASK wa###ome.net
DNS ASK ta###ome.net
DNS ASK wa###oday.net
DNS ASK ta###uch.net
DNS ASK tr###dare.net
DNS ASK ta###oday.net
DNS ASK wa###uch.net
DNS ASK vi###ance.net
DNS ASK se###dare.net
DNS ASK le###dare.net
DNS ASK pl###tell.net
DNS ASK fi###ell.net
DNS ASK se###dance.net
DNS ASK le###body.net
DNS ASK se###tell.net
DNS ASK le###dance.net
DNS ASK se###body.net
DNS ASK fi###ody.net
DNS ASK lr###tell.net
DNS ASK vi###ell.net
DNS ASK lr###body.net
DNS ASK vi###ody.net
DNS ASK pl###dare.net
DNS ASK fi###ance.net
DNS ASK pl###body.net
DNS ASK fi###are.net
DNS ASK pl###dance.net
DNS ASK mu###uch.net
DNS ASK le###today.net
DNS ASK se###such.net
DNS ASK ef###tbuilt.net
DNS ASK th###while.net
DNS ASK le###such.net
DNS ASK to###even.net
DNS ASK fa###even.net
DNS ASK to###ome.net
DNS ASK fa###ome.net
DNS ASK ri###nstorm.net
DNS ASK de####promise.net
DNS ASK se####strong.net
DNS ASK or###thrown.net
DNS ASK jo####ymeasure.net
DNS ASK si######edwerryhouse.net
DNS ASK gw#####ynhuddleston.net
DNS ASK of####urprise.net
DNS ASK mo####gduring.net
DNS ASK ch####nother.net
DNS ASK pi###some.net
DNS ASK mu###ome.net
DNS ASK we###uch.net
DNS ASK ve###uch.net
DNS ASK pi###seven.net
DNS ASK mu###oday.net
DNS ASK pi###such.net
DNS ASK mu###even.net
DNS ASK pi###today.net
DNS ASK ve###oday.net
DNS ASK to###uch.net
DNS ASK fa###uch.net
DNS ASK to###oday.net
DNS ASK fa###oday.net
DNS ASK we###ome.net
DNS ASK ve###even.net
DNS ASK we###oday.net
DNS ASK ve###ome.net
DNS ASK we###even.net
'23#.#55.255.250':1900

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations

Free trial