Trojan.DownLoader17.41018

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Extensible Protocol Microsoft' = '<SYSTEM32>\cqwabdazeqtn.exe'

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\Web Transaction Portable Topology] 'Start' = '00000002'

Malicious functions:

To complicate detection of its presence in the operating system,

blocks the following features:

Windows Security Center

Creates and executes the following:

'<SYSTEM32>\aqxelhlpfbas.exe' "<SYSTEM32>\cqwabdazeqtn.exe"
'%WINDIR%\Temp\susbnsrm3nidncyk9.exe' -r 48269 tcp
'%TEMP%\susbnsrm3c7oncyk9gjsb3ivp.exe'
'<SYSTEM32>\cqwabdazeqtn.exe'

Modifies file system :

Creates the following files:

<SYSTEM32>\ikklkkcipnp\run
<SYSTEM32>\ikklkkcipnp\rng
%WINDIR%\Temp\susbnsrm3nidncyk9.exe
<SYSTEM32>\ikklkkcipnp\cfg
<SYSTEM32>\aqxelhlpfbas.exe
%TEMP%\susbnsrm3c7oncyk9gjsb3ivp.exe
<SYSTEM32>\ikklkkcipnp\tst
<SYSTEM32>\cqwabdazeqtn.exe
<SYSTEM32>\ikklkkcipnp\etc

Sets the 'hidden' attribute to the following files:

<SYSTEM32>\aqxelhlpfbas.exe
<SYSTEM32>\cqwabdazeqtn.exe

Deletes the following files:

%WINDIR%\Temp\susbnsrm3nidncyk9.exe
<DRIVERS>\etc\hosts
%TEMP%\susbnsrm3c7oncyk9gjsb3ivp.exe

Substitutes the HOSTS file.

Network activity:

Connects to:

'vi###wear.net':80
'sp###hurt.net':80
'sp###wear.net':80
'sp###find.net':80
'vi###find.net':80
'wa###find.net':80
'fa###ind.net':80
'fa###old.net':80
'vi###hurt.net':80
'wa###told.net':80
'gr###find.net':80
'eq###wear.net':80
'eq###find.net':80
'eq###told.net':80
'gr###told.net':80
'sp###told.net':80
'vi###told.net':80
'gr###hurt.net':80
'gr###wear.net':80
'eq###hurt.net':80
'so###slow.net':80
'ar####ebruary.net':80
'ar###slow.net':80
'dr###hurt.net':80
'th###urt.net':80
'ar####ovember.net':80
'so####ovember.net':80
'so###help.net':80
'so####ebruary.net':80
'ar###help.net':80
'fa###urt.net':80
'dr###told.net':80
'wa###hurt.net':80
'wa###wear.net':80
'fa###ear.net':80
'dr###wear.net':80
'th###ear.net':80
'th###ind.net':80
'th###old.net':80
'dr###find.net':80
'ta###hurt.net':80
'ar###wear.net':80
'so###wear.net':80
'so###find.net':80
'be##lxc.com':80
'ar###find.net':80
'wh###told.net':80
'up###ind.net':80
'up###old.net':80
'ar###hurt.net':80
'so###hurt.net':80
'mi###hown.net':80
'ab###ell.net':80
'mo###ugust.net':80
'cr#####onaraminta.net':80
'le###form.net':80
'al###being.net':80
'ri###nstorm.net':80
'ca####nbring.net':80
'mo###olor.net':80
'pr####tbottom.net':80
'gl###old.net':80
'ta###told.net':80
'sa###urt.net':80
'sa###ear.net':80
'sp###urt.net':80
'ta###wear.net':80
'gl###urt.net':80
'gl###ear.net':80
'gl###ind.net':80
'ta###find.net':80
'up###urt.net':80
'wh###hurt.net':80
'wh###wear.net':80
'wh###find.net':80
'up###ear.net':80
'sa###ind.net':80
'sp###ear.net':80
'sp###ind.net':80
'sp###old.net':80
'sa###old.net':80

TCP:

HTTP GET requests:

http://vi###wear.net/index.php
http://sp###hurt.net/index.php
http://sp###wear.net/index.php
http://sp###find.net/index.php
http://vi###find.net/index.php
http://wa###find.net/index.php
http://fa###ind.net/index.php
http://fa###old.net/index.php
http://vi###hurt.net/index.php
http://wa###told.net/index.php
http://gr###find.net/index.php
http://eq###wear.net/index.php
http://eq###find.net/index.php
http://eq###told.net/index.php
http://gr###told.net/index.php
http://sp###told.net/index.php
http://vi###told.net/index.php
http://gr###hurt.net/index.php
http://gr###wear.net/index.php
http://eq###hurt.net/index.php
http://so###slow.net/index.php
http://ar####ebruary.net/index.php
http://ar###slow.net/index.php
http://dr###hurt.net/index.php
http://th###urt.net/index.php
http://ar####ovember.net/index.php
http://so####ovember.net/index.php
http://so###help.net/index.php
http://so####ebruary.net/index.php
http://ar###help.net/index.php
http://fa###urt.net/index.php
http://dr###told.net/index.php
http://wa###hurt.net/index.php
http://wa###wear.net/index.php
http://fa###ear.net/index.php
http://dr###wear.net/index.php
http://th###ear.net/index.php
http://th###ind.net/index.php
http://th###old.net/index.php
http://dr###find.net/index.php
http://ta###hurt.net/index.php
http://ar###wear.net/index.php
http://so###wear.net/index.php
http://so###find.net/index.php
http://be##lxc.com/index.php
http://ar###find.net/index.php
http://wh###told.net/index.php
http://up###ind.net/index.php
http://up###old.net/index.php
http://ar###hurt.net/index.php
http://so###hurt.net/index.php
http://mi###hown.net/index.php
http://ab###ell.net/index.php
http://mo###ugust.net/index.php
http://cr#####onaraminta.net/index.php
http://le###form.net/index.php
http://al###being.net/index.php
http://ri###nstorm.net/index.php
http://ca####nbring.net/index.php
http://mo###olor.net/index.php
http://pr####tbottom.net/index.php
http://gl###old.net/index.php
http://ta###told.net/index.php
http://sa###urt.net/index.php
http://sa###ear.net/index.php
http://sp###urt.net/index.php
http://ta###wear.net/index.php
http://gl###urt.net/index.php
http://gl###ear.net/index.php
http://gl###ind.net/index.php
http://ta###find.net/index.php
http://up###urt.net/index.php
http://wh###hurt.net/index.php
http://wh###wear.net/index.php
http://wh###find.net/index.php
http://up###ear.net/index.php
http://sa###ind.net/index.php
http://sp###ear.net/index.php
http://sp###ind.net/index.php
http://sp###old.net/index.php
http://sa###old.net/index.php

UDP:

DNS ASK vi###wear.net
DNS ASK sp###hurt.net
DNS ASK sp###wear.net
DNS ASK sp###find.net
DNS ASK vi###find.net
DNS ASK wa###find.net
DNS ASK fa###ind.net
DNS ASK fa###old.net
DNS ASK vi###hurt.net
DNS ASK wa###told.net
DNS ASK gr###find.net
DNS ASK eq###wear.net
DNS ASK eq###find.net
DNS ASK eq###told.net
DNS ASK gr###told.net
DNS ASK sp###told.net
DNS ASK vi###told.net
DNS ASK gr###hurt.net
DNS ASK gr###wear.net
DNS ASK eq###hurt.net
DNS ASK wa###wear.net
DNS ASK ar####ebruary.net
DNS ASK so####ebruary.net
DNS ASK so###slow.net
DNS ASK th###urt.net
DNS ASK ar###slow.net
DNS ASK so####ovember.net
DNS ASK up###low.net
DNS ASK ar####ovember.net
DNS ASK ar###help.net
DNS ASK so###help.net
DNS ASK dr###told.net
DNS ASK th###old.net
DNS ASK fa###urt.net
DNS ASK fa###ear.net
DNS ASK wa###hurt.net
DNS ASK th###ear.net
DNS ASK dr###hurt.net
DNS ASK dr###wear.net
DNS ASK dr###find.net
DNS ASK th###ind.net
DNS ASK ta###hurt.net
DNS ASK ar###wear.net
DNS ASK so###wear.net
DNS ASK so###find.net
DNS ASK be##lxc.com
DNS ASK ar###find.net
DNS ASK wh###told.net
DNS ASK up###ind.net
DNS ASK up###old.net
DNS ASK ar###hurt.net
DNS ASK so###hurt.net
DNS ASK mi###hown.net
DNS ASK ab###ell.net
DNS ASK mo###ugust.net
DNS ASK cr#####onaraminta.net
DNS ASK le###form.net
DNS ASK al###being.net
DNS ASK ri###nstorm.net
DNS ASK ca####nbring.net
DNS ASK mo###olor.net
DNS ASK pr####tbottom.net
DNS ASK gl###old.net
DNS ASK ta###told.net
DNS ASK sa###urt.net
DNS ASK sa###ear.net
DNS ASK sp###urt.net
DNS ASK ta###wear.net
DNS ASK gl###urt.net
DNS ASK gl###ear.net
DNS ASK gl###ind.net
DNS ASK ta###find.net
DNS ASK up###urt.net
DNS ASK wh###hurt.net
DNS ASK wh###wear.net
DNS ASK wh###find.net
DNS ASK up###ear.net
DNS ASK sa###ind.net
DNS ASK sp###ear.net
DNS ASK sp###ind.net
DNS ASK sp###old.net
DNS ASK sa###old.net
'23#.#55.255.250':1900

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations

Free trial