Trojan.DownLoader11.50195

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '*ApexSvr' = '"%ALLUSERSPROFILE%\ApexSvr\wireshark.exe"'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe] 'Debugger' = 'wuauclt.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Firewall.cpl] 'Debugger' = 'wuauclt.exe'

Changes the following executable system files:

<SYSTEM32>\mmc.exe.i16r2yZ
<SYSTEM32>\Firewall.cpl.0eo9j78

Malicious functions:

To bypass firewall, removes or modifies the following registry keys:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DoNotAllowExceptions' = '00000000'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] 'EnableFirewall' = '00000000'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] 'DoNotAllowExceptions' = '00000000'

To complicate detection of its presence in the operating system,

forces the system hide from view:

hidden files

Executes the following:

'<SYSTEM32>\wbem\wmiadap.exe' /R /T
'<SYSTEM32>\netsh.exe' firewall set opmode mode=disable profile=all
'<SYSTEM32>\sc.exe' config SharedAccess start= disabled

Modifies file system :

Creates the following files:

%ALLUSERSPROFILE%\ApexSvr\rundll32.exe
<SYSTEM32>\mmc.exe:Zone.Identifier
<SYSTEM32>\firewall.cpl:Zone.Identifier

Sets the 'hidden' attribute to the following files:

%ALLUSERSPROFILE%\ApexSvr\rundll32.exe

Deletes the following files:

<SYSTEM32>\wbem\Performance\WmiApRpl.ini
<SYSTEM32>\QYxaLFXfuMCUJgwV
<SYSTEM32>\UdUhrBYEsXWwHjibYFBu

Moves the following system files:

from <SYSTEM32>\ddZVWccPaZadmoXlpFu to <SYSTEM32>\xbhayPTgLLfXSJklgY
from <SYSTEM32>\jeSSYiroqUvNLNnvEm to <SYSTEM32>\ddZVWccPaZadmoXlpFu
from <SYSTEM32>\kiJkAtVyeubAMrQaUVE to <SYSTEM32>\JVyTxJnTknxsoAeOax
from <SYSTEM32>\xbhayPTgLLfXSJklgY to <SYSTEM32>\kiJkAtVyeubAMrQaUVE
from <SYSTEM32>\BfDVMmCXZAjayGTneWj to <SYSTEM32>\LuovnCFkJUKTutlI
from <SYSTEM32>\MrZUmvtGsTNqxFRREel to <SYSTEM32>\BfDVMmCXZAjayGTneWj
from <SYSTEM32>\RxIGcqckUaaqfSi to <SYSTEM32>\jeSSYiroqUvNLNnvEm
from <SYSTEM32>\LuovnCFkJUKTutlI to <SYSTEM32>\RxIGcqckUaaqfSi
from <SYSTEM32>\JVyTxJnTknxsoAeOax to <SYSTEM32>\GchjYshgVXTvyre
from <SYSTEM32>\JRlejRTMMuzDIOp to <SYSTEM32>\qYDYSFyuaRprEXzO
from <SYSTEM32>\lNhWHuswoHrtMKocMeH to <SYSTEM32>\JRlejRTMMuzDIOp
from <SYSTEM32>\eCVceHYrGPcxWRzL to <SYSTEM32>\QYxaLFXfuMCUJgwV
from <SYSTEM32>\qYDYSFyuaRprEXzO to <SYSTEM32>\eCVceHYrGPcxWRzL
from <SYSTEM32>\qDSVISixLdHQWAtt to <SYSTEM32>\piFkvjAniXSGeaFr
from <SYSTEM32>\GchjYshgVXTvyre to <SYSTEM32>\qDSVISixLdHQWAtt
from <SYSTEM32>\RvYMDDDcjfgNMhcrr to <SYSTEM32>\lNhWHuswoHrtMKocMeH
from <SYSTEM32>\piFkvjAniXSGeaFr to <SYSTEM32>\RvYMDDDcjfgNMhcrr
from <SYSTEM32>\bjeCYMybTauhHhsabEpE to <SYSTEM32>\pqzbPBpffTeUukAnzfvE
from <SYSTEM32>\XfsVxvqKnjHYNaDnkfOVQH to <SYSTEM32>\bjeCYMybTauhHhsabEpE
from <SYSTEM32>\GfvJNKClMtpeEvcoFIRAcsq to <SYSTEM32>\xttJekkdk[qkNYwMWErBS
from <SYSTEM32>\pqzbPBpffTeUukAnzfvE to <SYSTEM32>\GfvJNKClMtpeEvcoFIRAcsq
from <SYSTEM32>\Firewall.cpl.0eo9j78 to <SYSTEM32>\zlYBeuPxnZcRwQpKSNyF
from <SYSTEM32>\firewall.cpl to <SYSTEM32>\Firewall.cpl.0eo9j78
from <SYSTEM32>\pzWCNMoDoBmhySzuoiDRv to <SYSTEM32>\XfsVxvqKnjHYNaDnkfOVQH
from <SYSTEM32>\zlYBeuPxnZcRwQpKSNyF to <SYSTEM32>\pzWCNMoDoBmhySzuoiDRv
from <SYSTEM32>\xttJekkdk[qkNYwMWErBS to <SYSTEM32>\qyljuyKpBElJZILckDlbq
from <SYSTEM32>\wTcjvtwHaJZndWMSHMzz to <SYSTEM32>\UdUhrBYEsXWwHjibYFBu
from <SYSTEM32>\aeWyizRotNSNfFxFDahLkYLc to <SYSTEM32>\wTcjvtwHaJZndWMSHMzz
from <SYSTEM32>\mmc.exe.i16r2yZ to <SYSTEM32>\MrZUmvtGsTNqxFRREel
from <SYSTEM32>\mmc.exe to <SYSTEM32>\mmc.exe.i16r2yZ
from <SYSTEM32>\BAHFSHwDpSsDhSTiXwzY to <SYSTEM32>\BPwcNVoPTwfBHKlRAeYccGgL
from <SYSTEM32>\qyljuyKpBElJZILckDlbq to <SYSTEM32>\BAHFSHwDpSsDhSTiXwzY
from <SYSTEM32>\xelyCcApHmVIPwLToJkGjA to <SYSTEM32>\aeWyizRotNSNfFxFDahLkYLc
from <SYSTEM32>\BPwcNVoPTwfBHKlRAeYccGgL to <SYSTEM32>\xelyCcApHmVIPwLToJkGjA

Moves itself:

from <Full path to virus> to %ALLUSERSPROFILE%\ApexSvr\wireshark.exe

Network activity:

Connects to:

'as###esus.pw':80

TCP:

HTTP POST requests:

as###esus.pw/Jhs8smsdkhsd/jsdsda/john.php

UDP:

DNS ASK as###esus.pw

Miscellaneous:

Searches for the following windows:

ClassName: 'Shell_TrayWnd' WindowName: ''

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations

Free trial