Trojan.Inject1.45267

Technical Information

Malicious functions:

Creates and executes the following:

'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 14 47 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 15 46 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 16 45 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 13 48 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 10 49 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 11 49 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 12 48 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 9 53 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 10 53 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 11 54 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 16 41 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 16 44 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 17 43 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 17 42 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 15 36 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 14 37 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 9 43 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 15 35 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 15 32 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 15 33 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 15 34 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 13 45 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 14 46 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 9 50 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 13 44 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 10 42 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 11 42 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 12 43 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 15 68 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 15 69 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 15 70 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 16 67 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 14 65 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 15 65 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 16 66 1 1 4
'%TEMP%\ztmp\tmp6426.exe' h5CoUrw9k1 25, 1
'%TEMP%\ztmp\tmp6426.exe' f3GcN7SrE4 0 0
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 25 1 1 42 4
'%TEMP%\ztmp\tmp6426.exe' f87Vy9HaCx If you have the Azyul SVN already, put this program inside of it. 24 11 0
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 14 71 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 20 1 2 80 4
'%TEMP%\ztmp\tmp6426.exe' f87Vy9HaCx Push anything to download the Azyul SVN. 23 11 0
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 9 61 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 5 70 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 6 69 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 10 61 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 12 54 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 12 60 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 11 61 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 11 68 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 12 67 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 13 66 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 10 68 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 7 69 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 8 68 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 9 68 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 14 31 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 6 19 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 5 19 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 4 20 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 7 18 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 10 17 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 9 17 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 8 18 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 9 23 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 10 24 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 11 25 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 8 23 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 5 21 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 6 22 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 7 22 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 13 10 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 14 10 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 15 11 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 12 11 1 1 4
'%TEMP%\ztmp\tmp6426.exe' f3GcN7SrE4 11 0
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 13 13 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 12 12 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 13 16 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 12 16 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 11 16 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 14 15 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 15 12 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 15 13 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 15 14 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 9 35 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 9 36 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 9 37 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 9 34 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 10 31 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 9 32 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 9 33 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 12 34 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 13 33 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 13 32 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 12 35 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 10 38 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 11 37 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 11 36 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 11 14 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 10 13 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 9 14 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 15 27 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 12 25 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 13 25 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 14 26 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 9 20 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 9 21 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 8 22 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 10 19 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 9 15 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 10 16 1 1 4
'%TEMP%\ztmp\tmp6426.exe' jH6o8Vcr2u 10 18 1 1 4

Executes the following:

'<SYSTEM32>\attrib.exe' /pid=2920
'<SYSTEM32>\attrib.exe' +h %TEMP%\ztmp

Injects code into

the following system processes:

<SYSTEM32>\cmd.exe

Modifies file system :

Creates the following files:

%TEMP%\afolder\msvcp100.dll
%TEMP%\afolder\libsvn_wc-1.dll
%TEMP%\afolder\libsvn_subr-1.dll
%TEMP%\afolder\msvcr100.dll
%TEMP%\ztmp\tmp6426.exe
%TEMP%\ztmp\tmp6374.bat
%TEMP%\afolder\svn.exe
%TEMP%\afolder\libsvn_repos-1.dll
%TEMP%\afolder\libsvn_client-1.dll
%TEMP%\afolder\libaprutil-1.dll
%TEMP%\afolder\libapr-1.dll
%TEMP%\afolder\libsvn_delta-1.dll
%TEMP%\afolder\libsvn_ra-1.dll
%TEMP%\afolder\libsvn_fs-1.dll
%TEMP%\afolder\libsvn_diff-1.dll

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations

Free trial