Trojan.DownLoader19.33757

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'UPnP Grouping HomeGroup Group Scheduler' = '<SYSTEM32>\phxpatgggm.exe'

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\Configuration Host Authentication] 'ImagePath' = '<SYSTEM32>\phxpatgggm.exe'
[<HKLM>\SYSTEM\ControlSet001\Services\Configuration Host Authentication] 'Start' = '00000002'

Malicious functions:

To complicate detection of its presence in the operating system,

blocks the following features:

Windows Security Center

Creates and executes the following:

'<SYSTEM32>\bzpyrhklbv.exe' "<SYSTEM32>\phxpatgggm.exe"
'%WINDIR%\Temp\cpyc4va2mw8jstul.exe' -r 46869 tcp
'%TEMP%\cpyc4va2inwjstuldbgwgylj.exe'
'<SYSTEM32>\phxpatgggm.exe'

Modifies file system:

Creates the following files:

<SYSTEM32>\ayqxfvkzalgrdk\run
<SYSTEM32>\ayqxfvkzalgrdk\rng
%WINDIR%\Temp\cpyc4va2mw8jstul.exe
<SYSTEM32>\ayqxfvkzalgrdk\cfg
<SYSTEM32>\bzpyrhklbv.exe
%TEMP%\cpyc4va2inwjstuldbgwgylj.exe
<SYSTEM32>\ayqxfvkzalgrdk\tst
<SYSTEM32>\phxpatgggm.exe
<SYSTEM32>\ayqxfvkzalgrdk\etc

Sets the 'hidden' attribute to the following files:

<SYSTEM32>\bzpyrhklbv.exe
<SYSTEM32>\phxpatgggm.exe

Deletes the following files:

%WINDIR%\Temp\cpyc4va2mw8jstul.exe
<DRIVERS>\etc\hosts
%TEMP%\cpyc4va2inwjstuldbgwgylj.exe

Substitutes the HOSTS file.

Network activity:

Connects to:

'se###wrote.net':80
'le###wrote.net':80
'le###cold.net':80
'fi###ire.net':80
'se###cold.net':80
'se###bone.net':80
'to###old.net':80
'fa###old.net':80
'le###fire.net':80
'le###bone.net':80
'se###fire.net':80
'vi###ire.net':80
'pl###cold.net':80
'lr###fire.net':80
'lr###bone.net':80
'vi###one.net':80
'fi###old.net':80
'fi###one.net':80
'pl###fire.net':80
'pl###bone.net':80
'pl###wrote.net':80
'fi###rote.net':80
'pi###cold.net':80
'mu###old.net':80
've###ire.net':80
've###one.net':80
'we###ire.net':80
'pi###wrote.net':80
'pi###fire.net':80
'mu###ire.net':80
'mu###one.net':80
'mu###rote.net':80
'pi###bone.net':80
'fa###one.net':80
'to###ire.net':80
'to###one.net':80
'to###rote.net':80
'fa###rote.net':80
'fa###ire.net':80
've###rote.net':80
'we###one.net':80
'we###rote.net':80
'we###old.net':80
've###old.net':80
'vi###rote.net':80
've###eply.net':80
'we###hole.net':80
'we###eply.net':80
'we###hrow.net':80
've###hrow.net':80
've###hole.net':80
'mu###hrow.net':80
'pi###reply.net':80
'pi###throw.net':80
'pi###stock.net':80
'mu###tock.net':80
'de###lxc.com':80
'fa###hrow.net':80
'be##lxc.com':80
'ri###nstorm.net':80
'af###sllc.com':80
'to###eply.net':80
'we###tock.net':80
've###tock.net':80
'fa###hole.net':80
'fa###eply.net':80
'to###hole.net':80
'yo###rote.net':80
'tr###bone.net':80
'tr###wrote.net':80
'tr###cold.net':80
'yo###old.net':80
'yo###one.net':80
'vi###old.net':80
'lr###wrote.net':80
'lr###cold.net':80
'tr###fire.net':80
'yo###ire.net':80
'wa###tock.net':80
'ta###tock.net':80
'mu###hole.net':80
'mu###eply.net':80
'pi###whole.net':80
'wa###hrow.net':80
'wa###hole.net':80
'ta###hole.net':80
'ta###eply.net':80
'ta###hrow.net':80
'wa###eply.net':80

TCP:

HTTP GET requests:

http://se###wrote.net/index.php
http://le###wrote.net/index.php
http://le###cold.net/index.php
http://fi###ire.net/index.php
http://se###cold.net/index.php
http://se###bone.net/index.php
http://to###old.net/index.php
http://fa###old.net/index.php
http://le###fire.net/index.php
http://le###bone.net/index.php
http://se###fire.net/index.php
http://vi###ire.net/index.php
http://pl###cold.net/index.php
http://lr###fire.net/index.php
http://lr###bone.net/index.php
http://vi###one.net/index.php
http://fi###old.net/index.php
http://fi###one.net/index.php
http://pl###fire.net/index.php
http://pl###bone.net/index.php
http://pl###wrote.net/index.php
http://fi###rote.net/index.php
http://pi###cold.net/index.php
http://mu###old.net/index.php
http://ve###ire.net/index.php
http://ve###one.net/index.php
http://we###ire.net/index.php
http://pi###wrote.net/index.php
http://pi###fire.net/index.php
http://mu###ire.net/index.php
http://mu###one.net/index.php
http://mu###rote.net/index.php
http://pi###bone.net/index.php
http://fa###one.net/index.php
http://to###ire.net/index.php
http://to###one.net/index.php
http://to###rote.net/index.php
http://fa###rote.net/index.php
http://fa###ire.net/index.php
http://ve###rote.net/index.php
http://we###one.net/index.php
http://we###rote.net/index.php
http://we###old.net/index.php
http://ve###old.net/index.php
http://vi###rote.net/index.php
http://ve###eply.net/index.php
http://we###hole.net/index.php
http://we###eply.net/index.php
http://we###hrow.net/index.php
http://ve###hrow.net/index.php
http://ve###hole.net/index.php
http://mu###hrow.net/index.php
http://pi###reply.net/index.php
http://pi###throw.net/index.php
http://pi###stock.net/index.php
http://mu###tock.net/index.php
http://de###lxc.com/index.php
http://fa###hrow.net/index.php
http://be##lxc.com/index.php
http://ri###nstorm.net/index.php
http://af###sllc.com/index.php
http://to###eply.net/index.php
http://we###tock.net/index.php
http://ve###tock.net/index.php
http://fa###hole.net/index.php
http://fa###eply.net/index.php
http://to###hole.net/index.php
http://yo###rote.net/index.php
http://tr###bone.net/index.php
http://tr###wrote.net/index.php
http://tr###cold.net/index.php
http://yo###old.net/index.php
http://yo###one.net/index.php
http://vi###old.net/index.php
http://lr###wrote.net/index.php
http://lr###cold.net/index.php
http://tr###fire.net/index.php
http://yo###ire.net/index.php
http://wa###tock.net/index.php
http://ta###tock.net/index.php
http://mu###hole.net/index.php
http://mu###eply.net/index.php
http://pi###whole.net/index.php
http://wa###hrow.net/index.php
http://wa###hole.net/index.php
http://ta###hole.net/index.php
http://ta###eply.net/index.php
http://ta###hrow.net/index.php
http://wa###eply.net/index.php

UDP:

DNS ASK le###cold.net
DNS ASK se###wrote.net
DNS ASK se###cold.net
DNS ASK pl###fire.net
DNS ASK fi###ire.net
DNS ASK le###wrote.net
DNS ASK le###fire.net
DNS ASK to###old.net
DNS ASK se###fire.net
DNS ASK se###bone.net
DNS ASK le###bone.net
DNS ASK lr###fire.net
DNS ASK vi###ire.net
DNS ASK vi###one.net
DNS ASK vi###rote.net
DNS ASK lr###bone.net
DNS ASK pl###cold.net
DNS ASK pl###bone.net
DNS ASK fi###one.net
DNS ASK fi###rote.net
DNS ASK fi###old.net
DNS ASK pl###wrote.net
DNS ASK fa###old.net
DNS ASK pi###cold.net
DNS ASK mu###old.net
DNS ASK ve###ire.net
DNS ASK ve###one.net
DNS ASK we###ire.net
DNS ASK pi###wrote.net
DNS ASK pi###fire.net
DNS ASK mu###ire.net
DNS ASK mu###one.net
DNS ASK mu###rote.net
DNS ASK pi###bone.net
DNS ASK fa###one.net
DNS ASK to###ire.net
DNS ASK to###one.net
DNS ASK to###rote.net
DNS ASK fa###rote.net
DNS ASK fa###ire.net
DNS ASK ve###rote.net
DNS ASK we###one.net
DNS ASK we###rote.net
DNS ASK we###old.net
DNS ASK ve###old.net
DNS ASK ve###eply.net
DNS ASK we###hole.net
DNS ASK we###eply.net
DNS ASK we###hrow.net
DNS ASK ve###hrow.net
DNS ASK ve###hole.net
DNS ASK mu###hrow.net
DNS ASK pi###reply.net
DNS ASK pi###throw.net
DNS ASK pi###stock.net
DNS ASK mu###tock.net
DNS ASK de###lxc.com
DNS ASK fa###hrow.net
DNS ASK be##lxc.com
DNS ASK ri###nstorm.net
DNS ASK af###sllc.com
DNS ASK to###eply.net
DNS ASK we###tock.net
DNS ASK ve###tock.net
DNS ASK fa###hole.net
DNS ASK fa###eply.net
DNS ASK to###hole.net
DNS ASK yo###rote.net
DNS ASK tr###bone.net
DNS ASK tr###wrote.net
DNS ASK tr###cold.net
DNS ASK yo###old.net
DNS ASK yo###one.net
DNS ASK vi###old.net
DNS ASK lr###wrote.net
DNS ASK lr###cold.net
DNS ASK tr###fire.net
DNS ASK yo###ire.net
DNS ASK wa###tock.net
DNS ASK ta###tock.net
DNS ASK mu###hole.net
DNS ASK mu###eply.net
DNS ASK pi###whole.net
DNS ASK wa###hrow.net
DNS ASK wa###hole.net
DNS ASK ta###hole.net
DNS ASK ta###eply.net
DNS ASK ta###hrow.net
DNS ASK wa###eply.net
'23#.#55.255.250':1900

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations

Free trial