Trojan.DownLoader21.23803

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Locator DHCP Class Location Audio' = 'C:\fsynophgjwxxcc\orngevlctid.exe'

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\Tracking Program Offline Font Wired] 'ImagePath' = 'C:\fsynophgjwxxcc\orngevlctid.exe'
[<HKLM>\SYSTEM\ControlSet001\Services\Tracking Program Offline Font Wired] 'Start' = '00000002'

Malicious functions:

Creates and executes the following:

'C:\fsynophgjwxxcc\bzjhtifua.exe' "c:\fsynophgjwxxcc\orngevlctid.exe"
'C:\fsynophgjwxxcc\orngevlctid.exe'
'C:\fsynophgjwxxcc\hwzd2ln3fslrydjxp.exe'

Modifies file system:

Creates the following files:

C:\fsynophgjwxxcc\orngevlctid.exe
C:\fsynophgjwxxcc\bzjhtifua.exe
C:\fsynophgjwxxcc\umhyanjf2
%WINDIR%\fsynophgjwxxcc\fukhyxqmgklz
C:\fsynophgjwxxcc\fukhyxqmgklz
C:\fsynophgjwxxcc\hwzd2ln3fslrydjxp.exe

Sets the 'hidden' attribute to the following files:

C:\fsynophgjwxxcc\bzjhtifua.exe
C:\fsynophgjwxxcc\orngevlctid.exe

Deletes the following files:

C:\fsynophgjwxxcc\hwzd2ln3fslrydjxp.exe
%WINDIR%\fsynophgjwxxcc\fukhyxqmgklz

Network activity:

Connects to:

'be####except.net':80
'ga####except.net':80
'st###twhose.net':80
'tr###whose.net':80
'be####bridge.net':80
'ga####bicycle.net':80
'be###rwhose.net':80
'ga####bridge.net':80
'be####bicycle.net':80
'el####icwhose.net':80
'st####except.net':80
'el####icbicycle.net':80
're###dwhose.net':80
'tr###except.net':80
'st####bicycle.net':80
'tr####icycle.net':80
'st####bridge.net':80
'tr###bridge.net':80
'qu###bridge.net':80
'se####bridge.net':80
'qu###except.net':80
'se####except.net':80
'qu####icycle.net':80
'se###nwhose.net':80
'ag####twagon.net':80
'se####bicycle.net':80
'qu###whose.net':80
'br###except.net':80
'fl###bridge.net':80
'ga###rwhose.net':80
'fl###except.net':80
'br###bridge.net':80
'fl###whose.net':80
'br###whose.net':80
'fl####icycle.net':80
'br####icycle.net':80
're####bicycle.net':80
'do###bridge.net':80
'ag####tbicycle.net':80
'do###except.net':80
'ag####tbridge.net':80
'do####icycle.net':80
'ni###except.net':80
'de####except.net':80
'ag####twhose.net':80
'do###whose.net':80
'qu###ladder.net':80
'se####ladder.net':80
'qu####haracter.net':80
'se####character.net':80
'qu###board.net':80
'se###nenter.net':80
'ag####texcept.net':80
'se###nboard.net':80
'qu###enter.net':80
'ca####nbicycle.net':80
'la###whose.net':80
'ca####nbridge.net':80
'la####icycle.net':80
'ca####nwhose.net':80
're####bridge.net':80
'el####icbridge.net':80
're####except.net':80
'el####icexcept.net':80
'ni####icycle.net':80
'de####bicycle.net':80
'ni###bridge.net':80
'de####bridge.net':80
'ni###whose.net':80
'ca####nexcept.net':80
'la###bridge.net':80
'de###ewhose.net':80
'la###except.net':80

TCP:

HTTP GET requests:

http://be####except.net/index.php
http://ga####except.net/index.php
http://st###twhose.net/index.php
http://tr###whose.net/index.php
http://be####bridge.net/index.php
http://ga####bicycle.net/index.php
http://be###rwhose.net/index.php
http://ga####bridge.net/index.php
http://be####bicycle.net/index.php
http://el####icwhose.net/index.php
http://st####except.net/index.php
http://el####icbicycle.net/index.php
http://re###dwhose.net/index.php
http://tr###except.net/index.php
http://st####bicycle.net/index.php
http://tr####icycle.net/index.php
http://st####bridge.net/index.php
http://tr###bridge.net/index.php
http://qu###bridge.net/index.php
http://se####bridge.net/index.php
http://qu###except.net/index.php
http://se####except.net/index.php
http://qu####icycle.net/index.php
http://se###nwhose.net/index.php
http://ag####twagon.net/index.php
http://se####bicycle.net/index.php
http://qu###whose.net/index.php
http://br###except.net/index.php
http://fl###bridge.net/index.php
http://ga###rwhose.net/index.php
http://fl###except.net/index.php
http://br###bridge.net/index.php
http://fl###whose.net/index.php
http://br###whose.net/index.php
http://fl####icycle.net/index.php
http://br####icycle.net/index.php
http://re####bicycle.net/index.php
http://do###bridge.net/index.php
http://ag####tbicycle.net/index.php
http://do###except.net/index.php
http://ag####tbridge.net/index.php
http://do####icycle.net/index.php
http://ni###except.net/index.php
http://de####except.net/index.php
http://ag####twhose.net/index.php
http://do###whose.net/index.php
http://qu###ladder.net/index.php
http://se####ladder.net/index.php
http://qu####haracter.net/index.php
http://se####character.net/index.php
http://qu###board.net/index.php
http://se###nenter.net/index.php
http://ag####texcept.net/index.php
http://se###nboard.net/index.php
http://qu###enter.net/index.php
http://ca####nbicycle.net/index.php
http://la###whose.net/index.php
http://ca####nbridge.net/index.php
http://la####icycle.net/index.php
http://ca####nwhose.net/index.php
http://re####bridge.net/index.php
http://el####icbridge.net/index.php
http://re####except.net/index.php
http://el####icexcept.net/index.php
http://ni####icycle.net/index.php
http://de####bicycle.net/index.php
http://ni###bridge.net/index.php
http://de####bridge.net/index.php
http://ni###whose.net/index.php
http://ca####nexcept.net/index.php
http://la###bridge.net/index.php
http://de###ewhose.net/index.php
http://la###except.net/index.php

UDP:

DNS ASK be####except.net
DNS ASK ga####except.net
DNS ASK st###twhose.net
DNS ASK tr###whose.net
DNS ASK be####bridge.net
DNS ASK ga####bicycle.net
DNS ASK be###rwhose.net
DNS ASK ga####bridge.net
DNS ASK be####bicycle.net
DNS ASK el####icwhose.net
DNS ASK st####except.net
DNS ASK el####icbicycle.net
DNS ASK re###dwhose.net
DNS ASK tr###except.net
DNS ASK st####bicycle.net
DNS ASK tr####icycle.net
DNS ASK st####bridge.net
DNS ASK tr###bridge.net
DNS ASK ga###rwhose.net
DNS ASK se####bridge.net
DNS ASK qu####icycle.net
DNS ASK se####except.net
DNS ASK qu###bridge.net
DNS ASK se####bicycle.net
DNS ASK ag####twagon.net
DNS ASK do###wagon.net
DNS ASK qu###whose.net
DNS ASK se###nwhose.net
DNS ASK fl###bridge.net
DNS ASK br###bridge.net
DNS ASK fl###except.net
DNS ASK br###except.net
DNS ASK fl####icycle.net
DNS ASK br###whose.net
DNS ASK qu###except.net
DNS ASK br####icycle.net
DNS ASK fl###whose.net
DNS ASK do###bridge.net
DNS ASK ag####tbicycle.net
DNS ASK do###except.net
DNS ASK ag####tbridge.net
DNS ASK do####icycle.net
DNS ASK ni###except.net
DNS ASK de####except.net
DNS ASK ag####twhose.net
DNS ASK do###whose.net
DNS ASK qu###ladder.net
DNS ASK se####ladder.net
DNS ASK qu####haracter.net
DNS ASK se####character.net
DNS ASK qu###board.net
DNS ASK se###nenter.net
DNS ASK ag####texcept.net
DNS ASK se###nboard.net
DNS ASK qu###enter.net
DNS ASK ni###bridge.net
DNS ASK la###whose.net
DNS ASK ca####nwhose.net
DNS ASK la####icycle.net
DNS ASK ca####nbicycle.net
DNS ASK re####except.net
DNS ASK el####icbridge.net
DNS ASK re####bicycle.net
DNS ASK el####icexcept.net
DNS ASK re####bridge.net
DNS ASK de####bicycle.net
DNS ASK ni###whose.net
DNS ASK de####bridge.net
DNS ASK ni####icycle.net
DNS ASK de###ewhose.net
DNS ASK la###bridge.net
DNS ASK ca####nbridge.net
DNS ASK la###except.net
DNS ASK ca####nexcept.net

Miscellaneous:

Searches for the following windows:

ClassName: 'Shell_TrayWnd' WindowName: ''

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations

Free trial