Trojan.SMSSend.1927

Technical Information

Malicious functions:

Creates and executes the following:

%TEMP%\install-part12.exe (downloaded from the Internet)

Executes the following:

<SYSTEM32>\attrib.exe -H -R "%TEMP%\mdmxa$$$$.bat"
<SYSTEM32>\cmd.exe /c %TEMP%\mdmxa$$$$.bat

Modifies file system :

Creates the following files:

%HOMEPATH%\Favorites\G마켓.url
%HOMEPATH%\Favorites\gmarket.url
%HOMEPATH%\Favorites\G마캣.url
%HOMEPATH%\Favorites\CJON마트.url
%HOMEPATH%\Favorites\지마켓.url
%HOMEPATH%\Favorites\GSSHOP.url
%HOMEPATH%\Favorites\gseshop.url
%HOMEPATH%\Favorites\GS샵.url
%HOMEPATH%\Favorites\gmaket.url
%HOMEPATH%\Favorites\GS SHOP.url
%HOMEPATH%\Favorites\CJON mart.url
%HOMEPATH%\Favorites\지에스홈쇼핑.url
%HOMEPATH%\Favorites\AK몰.url
%HOMEPATH%\Favorites\지에스이숍.url
%HOMEPATH%\Favorites\지에스숍.url
%HOMEPATH%\Favorites\지에스이샵.url
%HOMEPATH%\Favorites\CJmall.url
%HOMEPATH%\Favorites\cjon.url
%HOMEPATH%\Favorites\cj쇼핑.url
%HOMEPATH%\Favorites\assacom.url
%HOMEPATH%\Favorites\cj마트.url
%HOMEPATH%\Favorites\Links\G마켓.url
%WINDIR%\auction_favicon.ico
%WINDIR%\gmarket_favicon.ico
%HOMEPATH%\Favorites\filejo.url
%HOMEPATH%\Favorites\파일조.url
%TEMP%\install-part12.exe
%TEMP%\mdmxa$$$$.bat
%HOMEPATH%\Favorites\Links\11번가.url
%HOMEPATH%\Favorites\Links\옥션.url
%WINDIR%\11st_favicon.ico
%HOMEPATH%\Favorites\rmfnvhs.url
%HOMEPATH%\Favorites\NS이숍.url
%HOMEPATH%\Favorites\wlakzpt.url
%HOMEPATH%\Favorites\LG패션샵.url
%HOMEPATH%\Favorites\H몰.url
%HOMEPATH%\Favorites\Hmall.url
%HOMEPATH%\Favorites\그루폰.url
%HOMEPATH%\Favorites\groupon.url
%HOMEPATH%\Favorites\티몬.url
%HOMEPATH%\Favorites\플라이워치.url
%HOMEPATH%\Favorites\티켓몬스터.url
%HOMEPATH%\Favorites\지에스샵.url
%HOMEPATH%\Favorites\롯데홈쇼핑.url
%HOMEPATH%\Favorites\면세점.url
%HOMEPATH%\Favorites\롯데인터넷면세점.url
%HOMEPATH%\Favorites\롯데마트쇼핑몰.url
%HOMEPATH%\Favorites\롯데마트인터넷쇼핑몰.url
%HOMEPATH%\Favorites\신세계.url
%HOMEPATH%\Favorites\신세계몰.url
%HOMEPATH%\Favorites\신라인터넷면세점.url
%HOMEPATH%\Favorites\명품관.url
%HOMEPATH%\Favorites\신라면세점.url
%HOMEPATH%\Favorites\롯데마트.url
%HOMEPATH%\Favorites\1300k.url
%HOMEPATH%\Favorites\가방팝.url
%HOMEPATH%\Favorites\11st.url
%HOMEPATH%\Favorites\11번가.url
%HOMEPATH%\Favorites\11qjsrk.url
%HOMEPATH%\Favorites\더페이스샵.url
%HOMEPATH%\Favorites\디앤샵.url
%HOMEPATH%\Favorites\대출.url
%HOMEPATH%\Favorites\꽃배달.url
%HOMEPATH%\Favorites\농수산홈쇼핑.url
%HOMEPATH%\Favorites\우체국쇼핑.url
%HOMEPATH%\Favorites\워커힐면세점.url
%HOMEPATH%\Favorites\dhrtus.url
%HOMEPATH%\Favorites\옥션.url
%HOMEPATH%\Favorites\auction.url
%HOMEPATH%\Favorites\이마트상품.url
%HOMEPATH%\Favorites\이마트인터넷쇼핑몰.url
%HOMEPATH%\Favorites\이마트.url
%HOMEPATH%\Favorites\원어데이.url
%HOMEPATH%\Favorites\웹하드.url
%HOMEPATH%\Favorites\연예인디씨.url
%HOMEPATH%\Favorites\씨제이오쇼핑.url
%HOMEPATH%\Favorites\씨제이온마트.url
%HOMEPATH%\Favorites\씨제이쇼핑.url
%HOMEPATH%\Favorites\씨제이마트.url
%HOMEPATH%\Favorites\씨제이몰.url
%HOMEPATH%\Favorites\아이스타일24.url
%HOMEPATH%\Favorites\엔조이뉴욕.url
%HOMEPATH%\Favorites\아이스타일.url
%HOMEPATH%\Favorites\씨제이.url
%HOMEPATH%\Favorites\아싸컴.url

Sets the 'hidden' attribute to the following files:

%HOMEPATH%\Favorites\CJmall.url
%HOMEPATH%\Favorites\cjon.url
%HOMEPATH%\Favorites\cj마트.url
%HOMEPATH%\Favorites\cj쇼핑.url
%HOMEPATH%\Favorites\CJON mart.url
%HOMEPATH%\Favorites\G마켓.url
%HOMEPATH%\Favorites\gmarket.url
%HOMEPATH%\Favorites\CJON마트.url
%HOMEPATH%\Favorites\G마캣.url
%HOMEPATH%\Favorites\지에스샵.url
%HOMEPATH%\Favorites\지에스숍.url
%HOMEPATH%\Favorites\이마트상품.url
%HOMEPATH%\Favorites\이마트인터넷쇼핑몰.url
%HOMEPATH%\Favorites\지에스이샵.url
%HOMEPATH%\Favorites\AK몰.url
%HOMEPATH%\Favorites\assacom.url
%HOMEPATH%\Favorites\지에스이숍.url
%HOMEPATH%\Favorites\지에스홈쇼핑.url
%HOMEPATH%\Favorites\gmaket.url
%HOMEPATH%\Favorites\티몬.url
%HOMEPATH%\Favorites\그루폰.url
%HOMEPATH%\Favorites\플라이워치.url
%HOMEPATH%\Favorites\티켓몬스터.url
%HOMEPATH%\Favorites\groupon.url
%HOMEPATH%\Favorites\파일조.url
%TEMP%\mdmxa$$$$.bat
%HOMEPATH%\Favorites\rmfnvhs.url
%HOMEPATH%\Favorites\filejo.url
%HOMEPATH%\Favorites\GSSHOP.url
%HOMEPATH%\Favorites\gseshop.url
%HOMEPATH%\Favorites\GS SHOP.url
%HOMEPATH%\Favorites\GS샵.url
%HOMEPATH%\Favorites\H몰.url
%HOMEPATH%\Favorites\NS이숍.url
%HOMEPATH%\Favorites\wlakzpt.url
%HOMEPATH%\Favorites\Hmall.url
%HOMEPATH%\Favorites\LG패션샵.url
%HOMEPATH%\Favorites\이마트.url
%HOMEPATH%\Favorites\롯데마트인터넷쇼핑몰.url
%HOMEPATH%\Favorites\롯데인터넷면세점.url
%HOMEPATH%\Favorites\롯데마트.url
%HOMEPATH%\Favorites\롯데마트쇼핑몰.url
%HOMEPATH%\Favorites\롯데홈쇼핑.url
%HOMEPATH%\Favorites\신라면세점.url
%HOMEPATH%\Favorites\신라인터넷면세점.url
%HOMEPATH%\Favorites\면세점.url
%HOMEPATH%\Favorites\명품관.url
%HOMEPATH%\Favorites\1300k.url
%HOMEPATH%\Favorites\가방팝.url
%HOMEPATH%\Favorites\11qjsrk.url
%HOMEPATH%\Favorites\11st.url
%HOMEPATH%\Favorites\꽃배달.url
%HOMEPATH%\Favorites\더페이스샵.url
%HOMEPATH%\Favorites\디앤샵.url
%HOMEPATH%\Favorites\농수산홈쇼핑.url
%HOMEPATH%\Favorites\대출.url
%HOMEPATH%\Favorites\신세계.url
%HOMEPATH%\Favorites\연예인디씨.url
%HOMEPATH%\Favorites\auction.url
%HOMEPATH%\Favorites\아이스타일24.url
%HOMEPATH%\Favorites\엔조이뉴욕.url
%HOMEPATH%\Favorites\dhrtus.url
%HOMEPATH%\Favorites\원어데이.url
%HOMEPATH%\Favorites\웹하드.url
%HOMEPATH%\Favorites\우체국쇼핑.url
%HOMEPATH%\Favorites\워커힐면세점.url
%HOMEPATH%\Favorites\씨제이몰.url
%HOMEPATH%\Favorites\씨제이쇼핑.url
%HOMEPATH%\Favorites\신세계몰.url
%HOMEPATH%\Favorites\씨제이마트.url
%HOMEPATH%\Favorites\씨제이오쇼핑.url
%HOMEPATH%\Favorites\아싸컴.url
%HOMEPATH%\Favorites\아이스타일.url
%HOMEPATH%\Favorites\씨제이온마트.url
%HOMEPATH%\Favorites\씨제이.url

Deletes the following files:

%TEMP%\install-part12.exe

Deletes itself.

Network activity:

Connects to:

'do##.#ne-step.pe.kr':80
'www.go###va.co.kr':80

TCP:

HTTP GET requests:

do##.#ne-step.pe.kr/install/one/install-part12.exe

HTTP POST requests:

www.go###va.co.kr/pops/logs.v/set/end.php
www.go###va.co.kr/pops/logs.v/set/begin.php

UDP:

DNS ASK do##.#ne-step.pe.kr
DNS ASK www.go###va.co.kr
'<Private IP address>':1037

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations

Free trial