Trojan.DownLoader25.57257

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Profile Experience Panel' = 'C:\xxchezjnisfw\mjdzodzyn.exe'

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\Defender Files Compatibility Isolation] 'ImagePath' = 'C:\xxchezjnisfw\mjdzodzyn.exe'
[<HKLM>\SYSTEM\ControlSet001\Services\Defender Files Compatibility Isolation] 'Start' = '00000002'

Malicious functions:

Creates and executes the following:

'C:\xxchezjnisfw\frmvtbyl.exe' "c:\xxchezjnisfw\mjdzodzyn.exe"
'C:\xxchezjnisfw\mjdzodzyn.exe'
'C:\xxchezjnisfw\qu2juustrqugq9vz.exe'

Modifies file system:

Creates the following files:

C:\xxchezjnisfw\mjdzodzyn.exe
C:\xxchezjnisfw\frmvtbyl.exe
C:\xxchezjnisfw\qu2juustrqugq9vz.exe
%WINDIR%\xxchezjnisfw\gtcijppn
C:\xxchezjnisfw\gtcijppn

Sets the 'hidden' attribute to the following files:

C:\xxchezjnisfw\frmvtbyl.exe
C:\xxchezjnisfw\mjdzodzyn.exe

Deletes the following files:

C:\xxchezjnisfw\qu2juustrqugq9vz.exe
%WINDIR%\xxchezjnisfw\gtcijppn

Substitutes the following files:

%WINDIR%\xxchezjnisfw\gtcijppn

Network activity:

Connects to:

'de####finger.net':80
'la###until.net':80
'de####shoulder.net':80
'ni###finger.net':80
'ca####nabove.net':80
'la####houlder.net':80
'ca####nuntil.net':80
'la###above.net':80
'do###finger.net':80
'ni###until.net':80
'do####houlder.net':80
'ag####tfinger.net':80
'de###eabove.net':80
'ni####houlder.net':80
'de###euntil.net':80
'ni###above.net':80
'ca####nshoulder.net':80
'st###tuntil.net':80
'tr###until.net':80
're####finger.net':80
'el####icfinger.net':80
'st####shoulder.net':80
'tr####houlder.net':80
'st###tabove.net':80
'tr###above.net':80
're###duntil.net':80
'el####icuntil.net':80
'la###finger.net':80
'ca####nfinger.net':80
're####shoulder.net':80
'el#####cshoulder.net':80
're###dabove.net':80
'el####icabove.net':80
'ag####tshoulder.net':80
'ga####become.net':80
'be####company.net':80
'ga###rcover.net':80
'be####become.net':80
'br####urther.net':80
'fl###cover.net':80
'ga####company.net':80
'fl####urther.net':80
'tr###become.net':80
'st####company.net':80
'tr###cover.net':80
'st####become.net':80
'ga####further.net':80
'be###rcover.net':80
'tr####ompany.net':80
'be####further.net':80
'br###cover.net':80
'qu####ompany.net':80
'se####company.net':80
'qu###become.net':80
'se####become.net':80
'ag####tabove.net':80
'do###above.net':80
'ag####tuntil.net':80
'do###until.net':80
'fl####ompany.net':80
'br####ompany.net':80
'fl###become.net':80
'br###become.net':80
'qu###cover.net':80
'se###ncover.net':80
'qu####urther.net':80
'se####further.net':80

TCP:

HTTP GET requests:

http://de####finger.net/index.php
http://la###until.net/index.php
http://de####shoulder.net/index.php
http://ni###finger.net/index.php
http://ca####nabove.net/index.php
http://la####houlder.net/index.php
http://ca####nuntil.net/index.php
http://la###above.net/index.php
http://do###finger.net/index.php
http://ni###until.net/index.php
http://do####houlder.net/index.php
http://ag####tfinger.net/index.php
http://de###eabove.net/index.php
http://ni####houlder.net/index.php
http://de###euntil.net/index.php
http://ni###above.net/index.php
http://ca####nshoulder.net/index.php
http://st###tuntil.net/index.php
http://tr###until.net/index.php
http://re####finger.net/index.php
http://el####icfinger.net/index.php
http://st####shoulder.net/index.php
http://tr####houlder.net/index.php
http://st###tabove.net/index.php
http://tr###above.net/index.php
http://re###duntil.net/index.php
http://el####icuntil.net/index.php
http://la###finger.net/index.php
http://ca####nfinger.net/index.php
http://re####shoulder.net/index.php
http://el#####cshoulder.net/index.php
http://re###dabove.net/index.php
http://el####icabove.net/index.php
http://ag####tshoulder.net/index.php
http://ga####become.net/index.php
http://be####company.net/index.php
http://ga###rcover.net/index.php
http://be####become.net/index.php
http://br####urther.net/index.php
http://fl###cover.net/index.php
http://ga####company.net/index.php
http://fl####urther.net/index.php
http://tr###become.net/index.php
http://st####company.net/index.php
http://tr###cover.net/index.php
http://st####become.net/index.php
http://ga####further.net/index.php
http://be###rcover.net/index.php
http://tr####ompany.net/index.php
http://be####further.net/index.php
http://br###cover.net/index.php
http://qu####ompany.net/index.php
http://se####company.net/index.php
http://qu###become.net/index.php
http://se####become.net/index.php
http://ag####tabove.net/index.php
http://do###above.net/index.php
http://ag####tuntil.net/index.php
http://do###until.net/index.php
http://fl####ompany.net/index.php
http://br####ompany.net/index.php
http://fl###become.net/index.php
http://br###become.net/index.php
http://qu###cover.net/index.php
http://se###ncover.net/index.php
http://qu####urther.net/index.php
http://se####further.net/index.php

UDP:

DNS ASK la###until.net
DNS ASK ca####nuntil.net
DNS ASK ni###finger.net
DNS ASK de####finger.net
DNS ASK la####houlder.net
DNS ASK ca####nshoulder.net
DNS ASK la###above.net
DNS ASK ca####nabove.net
DNS ASK de####shoulder.net
DNS ASK do###finger.net
DNS ASK ni###until.net
DNS ASK do####houlder.net
DNS ASK ag####tfinger.net
DNS ASK de###eabove.net
DNS ASK ni####houlder.net
DNS ASK de###euntil.net
DNS ASK ni###above.net
DNS ASK tr###until.net
DNS ASK st###tabove.net
DNS ASK el####icfinger.net
DNS ASK st###tuntil.net
DNS ASK tr####houlder.net
DNS ASK st####finger.net
DNS ASK tr###above.net
DNS ASK st####shoulder.net
DNS ASK re####finger.net
DNS ASK re###duntil.net
DNS ASK el####icuntil.net
DNS ASK la###finger.net
DNS ASK ca####nfinger.net
DNS ASK re####shoulder.net
DNS ASK el#####cshoulder.net
DNS ASK re###dabove.net
DNS ASK el####icabove.net
DNS ASK be####company.net
DNS ASK ga####company.net
DNS ASK be####become.net
DNS ASK ga####become.net
DNS ASK fl###cover.net
DNS ASK br###cover.net
DNS ASK fl####urther.net
DNS ASK br####urther.net
DNS ASK ga###rcover.net
DNS ASK tr###become.net
DNS ASK st####company.net
DNS ASK tr###cover.net
DNS ASK st####become.net
DNS ASK ga####further.net
DNS ASK be###rcover.net
DNS ASK tr####ompany.net
DNS ASK be####further.net
DNS ASK se####company.net
DNS ASK ag####tuntil.net
DNS ASK se####become.net
DNS ASK qu####ompany.net
DNS ASK do###above.net
DNS ASK ag####tshoulder.net
DNS ASK do###until.net
DNS ASK ag####tabove.net
DNS ASK qu###become.net
DNS ASK fl####ompany.net
DNS ASK br####ompany.net
DNS ASK fl###become.net
DNS ASK br###become.net
DNS ASK qu###cover.net
DNS ASK se###ncover.net
DNS ASK qu####urther.net
DNS ASK se####further.net

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations

Free trial