Trojan.DownLoader10.54065

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '21248' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '29468' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '13633' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '1292' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '23369' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '30946' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '10676' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '13252' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '11242' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '3934' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '12154' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '2456' = '<Full path to virus>'

Malicious functions:

To bypass firewall, removes or modifies the following registry keys:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'

Creates and executes the following:

'C:\lsass.exe' exe <Full path to virus>

Modifies file system :

Creates the following files:

C:\lsass.exe

Network activity:

Connects to:

'81.##.254.173':3128
'11#.#7.87.180':3128
'17#.#.125.145':3128
'78.##.116.159':3128
'60.##.77.133':3128
'85.##5.215.89':3128
'71.##.91.112':3128
'62.##.126.114':3128
'17#.#51.30.65':3128
'18#.#5.21.134':3128
'21#.#42.139.148':3128
'75.##9.59.21':3128
'84.##9.141.3':3128
'79.##9.179.201':3128
'85.##2.96.46':3128
'41.##9.42.39':3128
'68.##7.26.243':3128
'20#.#3.112.97':3128
'75.#38.79.2':3128
'18#.#5.35.55':3128
'20#.#52.243.171':3128
'82.##1.76.155':3128
'65.#4.68.90':3128
'19#.#11.26.219':3128
'20#.#15.26.253':3128
'12#.#46.247.177':3128
'76.##9.139.250':3128
'94.##9.169.1':3128
'84.##2.151.196':3128
'85.##7.57.116':3128
'12#.#68.245.39':3128
'21#.#27.100.32':3128
'21#.#25.194.112':3128
'87.#.1.89':3128
'84.##0.23.111':3128
'19#.#17.202.60':3128
'21#.#28.216.119':3128
'67.##.252.140':3128
'12#.#20.104.213':3128
'20#.#3.132.103':3128
'95.##6.155.254':3128
'70.##8.43.79':3128
'11#.89.9.19':3128
'65.#5.2.84':3128
'24.#.182.90':3128
'75.##3.32.225':3128
'12#.#7.84.134':3128
'99.##4.39.66':3128
'69.##1.148.110':3128
'21#.#50.232.253':3128
'19#.#.10.166':3128
'21#.#33.170.245':3128
'85.##6.118.69':3128
'72.##4.119.245':3128
'85.##.193.149':3128
'82.##7.145.221':3128
'11#.#4.56.147':3128
'11#.#7.109.140':3128
'85.##.170.232':3128
'76.##9.47.171':3128
'18#.#27.73.224':3128
'75.##9.170.144':3128
'89.##.244.228':3128
'60.##.81.137':3128
'88.##6.79.53':3128
'21#.#25.178.100':3128
'24.##7.29.118':3128
'20#.#4.35.33':3128
'19#.#42.64.152':3128
'65.##.236.70':3128
'12#.#20.213.141':3128
'21#.#19.194.130':3128
'11#.#77.81.164':3128
'20#.#68.86.168':3128
'18#.#5.41.194':3128
'83.##9.146.58':3128
'70.#1.42.71':3128
'24.##1.66.108':3128
'19#.#01.161.20':3128
'19#.#3.175.197':3128
'21#.#2.242.130':3128
'89.##7.75.85':3128
'89.##3.145.218':3128
'18#.#92.49.231':3128
'69.#7.254.8':3128
'12#.#62.239.214':3128
'85.#3.24.60':3128
'75.#4.49.37':3128
'21#.#24.52.73':3128
'21#.#12.119.73':3128
'82.##.14.108':3128
'17#.#51.154.211':3128
'76.##.228.35':3128
'20#.#25.233.8':3128
'82.##.196.74':3128
'17#.#6.15.69':3128
'41.##4.195.165':3128
'87.##8.57.137':3128
'72.##.162.189':3128
'20#.#23.81.185':3128
'20#.#65.18.11':312
'84.##0.23.124':6667
'81.##.38.194':6667
'87.#.76.107':6667
'18#.#5.21.134':6667
'41.##7.15.36':3128
'19#.#2.2.238':3128
'localhost':2
'19#.#17.58.37':3128
'19#.#06.208.220':3128
'70.##.90.171':3128
'60.##.245.220':3128
'10#.#09.244.88':3128
'21#.#44.187.200':3128
'68.##.133.85':3128
'20#.#09.60.66':3128
'24.##2.62.38':3128
'17#.#51.81.7':3128
'18#.#27.129.97':3128
'41.##9.45.216':3128
'77.##9.116.126':3128
'18#.#9.64.79':3128
'18#.#8.239.108':3128
'localhost':2124
'12#.#20.209.7':3128
'79.##8.24.207':3128
'17#.#37.25.34':3128
'84.##0.23.124':3128
'41.##2.95.12':3128
'21#.#6.112.137':3128
'17#.#51.15.100':3128
'59.##6.187.31':3128
'83.##.197.227':3128
'97.##.28.104':3128
'89.##5.44.119':3128
'17#.#51.202.150':3128
'78.##.24.108':3128
'24.#.229.177':3128
'11#.#93.123.97':3128
'68.##3.29.66':3128
'85.##8.186.30':3128
'88.##7.21.89':3128
'41.##0.10.243':3128
'24.##5.13.198':3128
'69.##1.92.187':3128
'17#.#37.97.103':3128
'99.##5.249.43':3128
'20#.#32.222.204':3128
'82.##2.103.247':3128
'22#.#31.127.13':3128
'14#.#48.224.140':3128
'81.##.38.194':3128
'76.##5.84.149':3128
'94.##4.183.33':3128
'19#.#49.49.0':3128
'76.##0.17.223':3128
'20#.#3.47.20':3128
'62.##0.172.231':3128
'20#.#3.233.211':3128
'12#.#83.227.100':3128
'94.##.202.43':3128
'89.##2.75.116':3128
'62.##.192.101':3128
'99.##5.101.168':3128
'18#.#92.80.53':3128
'83.#65.9.7':3128
'18#.#5.252.118':3128
'17#.#9.246.48':3128
'20#.#7.25.72':3128
'85.##.185.143':3128
'21#.#25.199.186':3128
'77.##6.112.114':3128
'12#.#3.105.87':3128
'20#.#09.111.198':3128
'79.##9.176.17':3128
'10#.#09.154.149':3128
'19#.#.239.217':3128
'21#.#25.194.135':3128
'41.##7.18.27':3128
'24.#.182.88':3128
'77.##1.243.150':3128
'18#.#5.19.35':3128
'80.##.128.112':3128
'81.##.243.25':3128
'16#.#94.145.150':3128
'99.##5.2.111':3128
'20#.#61.60.118':3128
'41.##9.43.225':3128
'84.##9.251.126':3128
'68.##4.42.224':3128
'72.##.200.153':3128
'20#.#3.135.186':3128
'77.##.173.135':3128
'18#.71.61.7':3128
'92.##1.94.172':3128
'78.#3.8.115':3128
'78.##.46.158':3128
'17#.#37.216.73':3128
'71.#0.86.76':3128
'41.##7.18.189':3128
'41.##9.43.208':3128
'19#.#35.168.9':3128
'82.##3.221.63':3128
'18#.#5.38.106':3128
'74.#8.2.89':3128
'21#.#83.55.221':3128
'71.##2.224.113':3128
'85.##.213.26':3128
'20#.#3.128.109':3128
'88.##3.179.180':3128
'85.##.200.100':3128
'71.##.243.177':3128
'17#.#.86.104':3128
'78.##.185.170':3128
'70.##3.174.160':3128
'17#.#3.152.252':3128
'85.##0.242.90':3128
'74.#4.43.82':3128
'12#.#20.211.249':3128
'12#.#20.86.174':3128
'69.##4.99.56':3128
'98.##3.41.173':3128
'18#.#94.205.29':3128
'85.##5.215.163':3128
'72.##9.187.230':3128
'94.##5.55.88':3128
'62.##9.238.173':3128
'85.##1.119.167':3128
'72.##4.185.240':3128
'11#.#33.239.184':3128
'99.##4.242.27':3128
'75.##9.80.227':3128
'20#.#3.128.70':3128
'89.##.88.140':3128
'10#.#82.75.103':3128
'41.##4.158.76':3128
'84.##0.31.162':3128
'85.##8.150.200':3128
'85.##4.234.100':3128
'94.##4.156.47':3128
'93.##2.151.90':3128
'24.#.194.158':3128
'96.#.48.88':3128
'10#.#08.121.24':3128
'85.##8.175.55':3128
'20#.#3.142.46':3128
'19#.#01.90.89':3128
'89.##3.133.7':3128
'41.##6.12.78':3128
'20#.#3.133.174':3128
'71.#0.83.37':3128
'18#.#60.110.101':3128
'12#.#43.138.169':3128
'74.##2.34.129':3128
'70.##.78.138':3128
'70.##.38.112':3128
'99.##5.37.127':3128
'89.##3.151.75':3128
'69.##.66.105':3128
'19#.#28.92.90':3128
'2.##.224.157':3128
'89.##2.56.121':3128
'21#.#86.168.164':3128
'85.#1.153.1':3128
'74.##.209.166':3128
'17#.#37.148.62':3128
'89.##4.127.222':3128
'17#.#68.7.34':3128
'85.##.169.176':3128
'17#.#36.144.178':3128
'92.##.174.229':3128
'21#.#0.226.48':3128
'10#.#18.47.184':3128
'11#.#9.9.153':3128
'85.##1.122.24':3128
'87.#.77.246':3128
'61.##.240.63':3128
'10#.#82.90.75':3128
'76.##7.111.234':3128
'41.##9.38.21':3128
'59.##.23.157':3128
'78.#3.67.48':3128
'20#.#65.18.11':3128
'87.#.231.66':3128
'19#.#17.221.150':3128
'41.##7.19.130':3128
'24.#.109.170':3128
'89.#2.32.81':3128
'87.#.76.107':3128
'67.##.185.176':3128
'69.##.204.14':3128
'87.#.89.107':3128
'20#.#3.137.19':3128
'17#.#51.183.251':3128
'76.##7.155.138':3128
'20#.#3.114.77':3128
'41.##9.51.182':3128
'74.##.28.210':3128
'20#.#36.99.18':3128
'89.##4.169.235':3128
'19#.#13.102.206':3128
'66.##4.255.203':3128
'12#.#20.209.108':3128
'22#.#49.84.42':3128
'89.##2.48.88':3128
'70.#1.30.56':3128
'10.#.1.254':3128

Miscellaneous:

Searches for the following windows:

ClassName: 'Indicator' WindowName: '(null)'

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations

Free trial