Trojan.DownLoader10.25402

Technical Information

To ensure autorun and distribution:

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\prvdisk] 'Start' = '00000001'
[<HKLM>\SYSTEM\ControlSet001\Services\ianoSvrup] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\PolicyAgent] 'Start' = '00000002'

Malicious functions:

Creates and executes the following:

'%PROGRAM_FILES%\yfevcoocgn\acbcrbwgckq.exe' -p Pass1 -r Pass1 -f 125.39.100.74+0 -n PASS -x
'%TEMP%\nsz2.tmp\ns10.tmp' acbcrbwgckq.exe -p Pass2 -r Pass2 -f 220.181.126.15+0 -n PASS -x
'%TEMP%\nsz2.tmp\nsF.tmp' acbcrbwgckq.exe -p Pass1 -r Pass1 -f 125.39.100.74+0 -n PASS -x
'%CommonProgramFiles%\Intel\ianotife.exe'
'%TEMP%\nsnA.tmp\nsE.tmp' sc create prvdisk binpath= <SYSTEM32>\PrvMon\prvdisk.sys type= kernel start= system group= Base tag= yes
'%PROGRAM_FILES%\yfevcoocgn\un0511001001409.exe'
'%TEMP%\~nsu.tmp\Au_.exe' _?=%PROGRAM_FILES%\yfevcoocgn\
'%PROGRAM_FILES%\yfevcoocgn\acbcrbwgckq.exe' -p Pass3 -r Pass3 -f 220.181.126.7+0 -n PASS -x
'%PROGRAM_FILES%\yfevcoocgn\acbcrbwgckq.exe' -p Pass2 -r Pass2 -f 220.181.126.15+0 -n PASS -x
'%TEMP%\nsz2.tmp\ns11.tmp' acbcrbwgckq.exe -p Pass3 -r Pass3 -f 220.181.126.7+0 -n PASS -x
'%TEMP%\nsnA.tmp\nsD.tmp' sc start ianoSvrup
'%TEMP%\nsz2.tmp\ns5.tmp' regedit /s info.reg
'%TEMP%\nsz2.tmp\ns6.tmp' sc stop PolicyAgent
'%PROGRAM_FILES%\yfevcoocgn\acbcrbwgckq.exe' -file ssxk7ca14ltro.txt
'%TEMP%\nsz2.tmp\ns3.tmp' sc start PolicyAgent
'%TEMP%\nsz2.tmp\ns4.tmp' "acbcrbwgckq.exe" -file ssxk7ca14ltro.txt
'%TEMP%\nsnA.tmp\nsB.tmp' sc create ianoSvrup binpath= "%CommonProgramFiles%\Intel\ianotife.exe" type= share start= auto displayname= "Ianno Web Cache Services"
'%TEMP%\nsnA.tmp\nsC.tmp' sc description ianoSvrup "К№УГIanno Web CahceјјКхМб№©ЅшРР»ҐБЄНшдЇААФ¤¶БјУЛЩ·юОсЎЈИз№ыНЈЦ№ёГ·юОсЈ¬ФтјЖЛг»ъЅ«І»ѕЯ±ёХвР©јјКхМб№©µДјУЛЩ№¦ДЬЎЈ"
'%PROGRAM_FILES%\yfevcoocgn\mysetup.exe'
'%TEMP%\nsz2.tmp\ns7.tmp' sc start PolicyAgent
'%TEMP%\nsz2.tmp\ns8.tmp' sc config PolicyAgent start= auto

Executes the following:

'<SYSTEM32>\sc.exe' start ianoSvrup
'<SYSTEM32>\sc.exe' description ianoSvrup "К№УГIanno Web CahceјјКхМб№©ЅшРР»ҐБЄНшдЇААФ¤¶БјУЛЩ·юОсЎЈИз№ыНЈЦ№ёГ·юОсЈ¬ФтјЖЛг»ъЅ«І»ѕЯ±ёХвР©јјКхМб№©µДјУЛЩ№¦ДЬЎЈ"
'<SYSTEM32>\wscript.exe' "%CommonProgramFiles%\Intel\note.vbs"
'<SYSTEM32>\sc.exe' create prvdisk binpath= <SYSTEM32>\PrvMon\prvdisk.sys type= kernel start= system group= Base tag= yes
'<SYSTEM32>\sc.exe' create ianoSvrup binpath= "%CommonProgramFiles%\Intel\ianotife.exe" type= share start= auto displayname= "Ianno Web Cache Services"
'%WINDIR%\regedit.exe' /s info.reg
'<SYSTEM32>\sc.exe' start PolicyAgent
'<SYSTEM32>\sc.exe' config PolicyAgent start= auto
'<SYSTEM32>\sc.exe' stop PolicyAgent

Modifies file system :

Creates the following files:

%TEMP%\nsnA.tmp\AccessControl.dll
%CommonProgramFiles%\Intel\config-n.xml
%CommonProgramFiles%\Intel\config-s.xml
%TEMP%\nsnA.tmp\nsB.tmp
%TEMP%\nsnA.tmp\nsExec.dll
%TEMP%\nsnA.tmp\System.dll
%CommonProgramFiles%\Intel\vison.txt
%CommonProgramFiles%\Intel\note.txt
%CommonProgramFiles%\Intel\ypac.txt
%CommonProgramFiles%\Intel\prvdisk.sys
%CommonProgramFiles%\Intel\suject.db
%CommonProgramFiles%\Intel\ianotife.exe
%TEMP%\nsnA.tmp\nsC.tmp
%TEMP%\nsz2.tmp\ns10.tmp
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\CJCTQ25G\ol[1].asp
%TEMP%\nsz2.tmp\nsF.tmp
%CommonProgramFiles%\Intel\suject.db-journal
%TEMP%\~nsu.tmp\Au_.exe
%TEMP%\nsz2.tmp\ns11.tmp
%WINDIR%\tudouva.pac
%CommonProgramFiles%\Intel\pro.txt
%TEMP%\nsnA.tmp\nsD.tmp
%CommonProgramFiles%\Intel\note.vbs
%TEMP%\nsnA.tmp\nsE.tmp
<SYSTEM32>\PrvMon\prvdisk.sys
%TEMP%\nsz2.tmp\InetLoad.dll
%TEMP%\nsz2.tmp\nsRandom.dll
%PROGRAM_FILES%\yfevcoocgn\un0511001001409.exe
<Current directory>\op.ini
%TEMP%\nsz2.tmp\nsplugin.dll
%TEMP%\nsz2.tmp\Internet.dll
%PROGRAM_FILES%\yfevcoocgn\reginfo.xml
%PROGRAM_FILES%\yfevcoocgn\s0001.xml
%PROGRAM_FILES%\yfevcoocgn\menu.xml
%PROGRAM_FILES%\yfevcoocgn\temp0511001001409.ini
%TEMP%\nsz2.tmp\System.dll
%PROGRAM_FILES%\yfevcoocgn\ser000.xml
%PROGRAM_FILES%\yfevcoocgn\acbcrbwgckq.exe
%TEMP%\nsz2.tmp\ns7.tmp
%TEMP%\nsz2.tmp\ns6.tmp
%TEMP%\nsz2.tmp\ns5.tmp
%CommonProgramFiles%\Intel\sqlite3.dll
%PROGRAM_FILES%\yfevcoocgn\mysetup.exe
%TEMP%\nsz2.tmp\ns8.tmp
%TEMP%\nsz2.tmp\nsExec.dll
%PROGRAM_FILES%\yfevcoocgn\ssxk7ca14ltro.txt
<Current directory>\tx.ini
%PROGRAM_FILES%\yfevcoocgn\info.reg
%TEMP%\nsz2.tmp\ns4.tmp
%TEMP%\nsz2.tmp\ns3.tmp

Deletes the following files:

<Current directory>\tx.ini
%PROGRAM_FILES%\yfevcoocgn\acbcrbwgckq.exe
%TEMP%\nsz2.tmp\InetLoad.dll
<Current directory>\op.ini
%CommonProgramFiles%\Intel\note.vbs
%TEMP%\nsz2.tmp\nsF.tmp
%PROGRAM_FILES%\yfevcoocgn\info.reg
%TEMP%\nsz2.tmp\ns11.tmp
%TEMP%\nsz2.tmp\ns10.tmp
%PROGRAM_FILES%\yfevcoocgn\temp0511001001409.ini
%PROGRAM_FILES%\yfevcoocgn\un0511001001409.exe
%CommonProgramFiles%\Intel\suject.db-journal
%PROGRAM_FILES%\yfevcoocgn\ssxk7ca14ltro.txt
%TEMP%\nsz2.tmp\System.dll
%TEMP%\nsz2.tmp\nsExec.dll
%TEMP%\nsz2.tmp\Internet.dll
%TEMP%\nsz2.tmp\nsRandom.dll
%TEMP%\nsz2.tmp\nsplugin.dll
%PROGRAM_FILES%\yfevcoocgn\reginfo.xml
%TEMP%\nsnA.tmp\nsB.tmp
%TEMP%\nsz2.tmp\ns8.tmp
%TEMP%\nsnA.tmp\nsD.tmp
%TEMP%\nsnA.tmp\nsC.tmp
%TEMP%\nsz2.tmp\ns7.tmp
%TEMP%\nsz2.tmp\ns4.tmp
%TEMP%\nsz2.tmp\ns3.tmp
%TEMP%\nsz2.tmp\ns6.tmp
%TEMP%\nsz2.tmp\ns5.tmp
%PROGRAM_FILES%\yfevcoocgn\ser000.xml
%PROGRAM_FILES%\yfevcoocgn\mysetup.exe
%PROGRAM_FILES%\yfevcoocgn\menu.xml
%PROGRAM_FILES%\yfevcoocgn\s0001.xml
%TEMP%\nsnA.tmp\System.dll
%CommonProgramFiles%\Intel\prvdisk.sys
%TEMP%\nsnA.tmp\nsE.tmp
%TEMP%\nsnA.tmp\nsExec.dll
%TEMP%\nsnA.tmp\AccessControl.dll

Deletes itself.

Network activity:

Connects to:

'localhost':1040
'tj.###mitogu.com':80
'm.###nong.com':888
'tj.##nzhuan.co':80

TCP:

HTTP GET requests:

tj.###mitogu.com/ps.txt
tj.###mitogu.com/wl.txt
tj.##nzhuan.co/svr.asp?c=########################################
tj.###mitogu.com/ol.asp?c=###########################

UDP:

DNS ASK tj.###mitogu.com
DNS ASK tj.##nzhuan.co
DNS ASK m.###nong.com

Miscellaneous:

Searches for the following windows:

ClassName: 'RegEdit_RegEdit' WindowName: '(null)'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations

Free trial