Trojan.DownLoader6.58263

Technical Information

To ensure autorun and distribution:

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\QuickDownload Update] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\QuickDownload Service] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\QuickDownload Agent] 'Start' = '00000002'

Malicious functions:

To bypass firewall, removes or modifies the following registry keys:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\QuickDownloadService\qdownservice.exe' = '%PROGRAM_FILES%\QuickDownloadService\qdownservice.exe:*:Enabled:QuickDownloadSvc'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\QuickDownloadService\qdownservice.exe' = '%PROGRAM_FILES%\QuickDownloadService\qdownservice.exe:*:Enabled:QuickDownloadService'

Creates and executes the following:

%PROGRAM_FILES%\QuickDownloadService\sc.exe STOP "QuickDownload Update"
%PROGRAM_FILES%\QuickDownloadService\sc.exe DELETE "QuickDownload Agent"
%PROGRAM_FILES%\QuickDownloadService\sc.exe STOP "QuickDownload Agent"
%PROGRAM_FILES%\QuickDownloadService\sc.exe STOP "QuickDownload Service"
%PROGRAM_FILES%\QuickDownloadService\sc.exe DELETE "QuickDownload Service"
%PROGRAM_FILES%\QuickDownloadService\qdownservice.exe
%PROGRAM_FILES%\QuickDownloadService\qdownupdate.exe
%PROGRAM_FILES%\QuickDownloadService\sc.exe DELETE "QuickDownload Update"
%PROGRAM_FILES%\QuickDownloadService\qdownagent.exe
%PROGRAM_FILES%\QuickDownloadService\StopMegaService.exe
%PROGRAM_FILES%\QuickDownloadService\sc.exe STOP "Mega Network Manager"
%TEMP%\is-JBQNP.tmp\<Virus name>.tmp /SL5="$30092,225503,54272,<Full path to virus>"
%PROGRAM_FILES%\QuickDownloadService\ElevationWrap.exe
%PROGRAM_FILES%\QuickDownloadService\sc.exe DELETE "Mega Network Manager"
%PROGRAM_FILES%\QuickDownloadService\sc.exe STOP "Mega Network Update"
%PROGRAM_FILES%\QuickDownloadService\sc.exe DELETE "Mega Network Update"
%PROGRAM_FILES%\QuickDownloadService\sc.exe STOP "Mega Network Service"
%PROGRAM_FILES%\QuickDownloadService\sc.exe DELETE "Mega Network Service"

Executes the following:

<SYSTEM32>\sc.exe FAILURE "QuickDownload Service" reset= 180 actions= "restart/180000/restart/180000/restart/180000"
<SYSTEM32>\sc.exe FAILURE "QuickDownload Agent" reset= 180 actions= "restart/180000/restart/180000/restart/180000"
<SYSTEM32>\sc.exe start "QuickDownload Update"
<SYSTEM32>\sc.exe FAILURE "QuickDownload Update" reset= 180 actions= "restart/180000/restart/180000/restart/180000"
<SYSTEM32>\sc.exe description "QuickDownload Update" "°нјУ ґЩїо·Оµе јєсЅєАЗ »уЕВё¦ ЗЧ»у ГЦ»уАё·О АЇБцЗП±в А§ЗС ѕчµҐАМЖ®ё¦ Б¦°шЗХґПґЩ"
<SYSTEM32>\sc.exe description "QuickDownload Service" "ДБЕЩГч ґЩїо·ОµеЅГ ґЩїо·Оµе јУµµ Зв»уА» А§ЗС јєсЅєё¦ Б¦°шЗХґПґЩ."
<SYSTEM32>\sc.exe description "QuickDownload Agent" "ДБЕЩГч ґЩїо·ОµеЅГ ґЩїо·Оµе јУµµ Зв»уА» А§ЗС јєсЅєё¦ Б¦°шЗХґПґЩ."
<SYSTEM32>\sc.exe create "QuickDownload Agent" binPath= "%PROGRAM_FILES%\QuickDownloadService\qdownagent.exe" start= auto error= ignore
<SYSTEM32>\netsh.exe firewall add allowedprogram "%PROGRAMFILES%\QuickDownloadService\qdownservice.exe" "QuickDownloadService" ENABLE
<SYSTEM32>\wscript.exe "%PROGRAM_FILES%\QuickDownloadService\Firewall.vbs"
<SYSTEM32>\sc.exe create "QuickDownload Service" binPath= "%PROGRAM_FILES%\QuickDownloadService\qdownservice.exe" start= auto error= ignore
<SYSTEM32>\sc.exe start "QuickDownload Service"
<SYSTEM32>\sc.exe start "QuickDownload Agent"
<SYSTEM32>\sc.exe create "QuickDownload Update" binPath= "%PROGRAM_FILES%\QuickDownloadService\qdownupdate.exe" start= auto error= ignore

Modifies file system :

Creates the following files:

%PROGRAM_FILES%\QuickDownloadService\conf\data3.cfg
%PROGRAM_FILES%\QuickDownloadService\unins000.dat
%PROGRAM_FILES%\QuickDownloadService\is-OV4KC.tmp
%PROGRAM_FILES%\QuickDownloadService\conf\is-GQKB4.tmp
%PROGRAM_FILES%\QuickDownloadService\conf\data4.cfg
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\CJCTQ25G\maxuploadspeed[1].txt
%PROGRAM_FILES%\QuickDownloadService\maxuploadspeed.txt
%PROGRAM_FILES%\QuickDownloadService\conf\data2.cfg
%PROGRAM_FILES%\QuickDownloadService\conf\data6.tmp
%PROGRAM_FILES%\QuickDownloadService\conf\data2.tmp
%PROGRAM_FILES%\QuickDownloadService\is-FHGI9.tmp
%PROGRAM_FILES%\QuickDownloadService\is-C8SVP.tmp
%PROGRAM_FILES%\QuickDownloadService\is-2IKPT.tmp
%TEMP%\is-9OD5K.tmp\_isetup\_shfoldr.dll
%TEMP%\is-JBQNP.tmp\<Virus name>.tmp
%TEMP%\is-9OD5K.tmp\_isetup\_RegDLL.tmp
%PROGRAM_FILES%\QuickDownloadService\is-MMVGM.tmp
%PROGRAM_FILES%\QuickDownloadService\is-E9MSF.tmp
%PROGRAM_FILES%\QuickDownloadService\is-FSS1N.tmp
%PROGRAM_FILES%\QuickDownloadService\is-3Q5UR.tmp
%PROGRAM_FILES%\QuickDownloadService\is-UAV7Q.tmp
%PROGRAM_FILES%\QuickDownloadService\is-MJOLP.tmp

Deletes the following files:

%TEMP%\is-9OD5K.tmp\_isetup\_RegDLL.tmp
%PROGRAM_FILES%\QuickDownloadService\Firewall.vbs
%TEMP%\is-JBQNP.tmp\<Virus name>.tmp
%TEMP%\is-9OD5K.tmp\_isetup\_shfoldr.dll
%PROGRAM_FILES%\QuickDownloadService\conf\data2.tmp
%PROGRAM_FILES%\QuickDownloadService\conf\data6.tmp
%PROGRAM_FILES%\QuickDownloadService\sc.exe
%PROGRAM_FILES%\QuickDownloadService\StopMegaService.exe

Moves the following files:

from %PROGRAM_FILES%\QuickDownloadService\is-FSS1N.tmp to %PROGRAM_FILES%\QuickDownloadService\qdownagent.exe
from %PROGRAM_FILES%\QuickDownloadService\is-E9MSF.tmp to %PROGRAM_FILES%\QuickDownloadService\HoleAddon.dll
from %PROGRAM_FILES%\QuickDownloadService\is-FHGI9.tmp to %PROGRAM_FILES%\QuickDownloadService\qdownservice.exe
from %PROGRAM_FILES%\QuickDownloadService\conf\is-GQKB4.tmp to %PROGRAM_FILES%\QuickDownloadService\conf\Version.cfg
from %PROGRAM_FILES%\QuickDownloadService\is-OV4KC.tmp to %PROGRAM_FILES%\QuickDownloadService\qdownupdate.exe
from %PROGRAM_FILES%\QuickDownloadService\is-3Q5UR.tmp to %PROGRAM_FILES%\QuickDownloadService\sc.exe
from %PROGRAM_FILES%\QuickDownloadService\is-2IKPT.tmp to %PROGRAM_FILES%\QuickDownloadService\Firewall.vbs
from %PROGRAM_FILES%\QuickDownloadService\is-C8SVP.tmp to %PROGRAM_FILES%\QuickDownloadService\unins000.exe
from %PROGRAM_FILES%\QuickDownloadService\is-MMVGM.tmp to %PROGRAM_FILES%\QuickDownloadService\ElevationWrap.exe
from %PROGRAM_FILES%\QuickDownloadService\is-MJOLP.tmp to %PROGRAM_FILES%\QuickDownloadService\StopMegaService.exe
from %PROGRAM_FILES%\QuickDownloadService\is-UAV7Q.tmp to %PROGRAM_FILES%\QuickDownloadService\Firewall.exe

Network activity:

Connects to:

'localhost':1040
'in##cdn.com':80
'12#.#8.119.138':30555
'sv##.#imesis.co.kr':30294

TCP:

HTTP GET requests:

in##cdn.com/service/maxuploadspeed.txt

UDP:

DNS ASK in##cdn.com
DNS ASK sv##.#imesis.co.kr

Miscellaneous:

Searches for the following windows:

ClassName: 'Shell_TrayWnd' WindowName: ''

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations

Free trial