Trojan.DownLoader23.52194

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'uTorrent' = '%APPDATA%\uTorrent\uTorrent.exe /MINIMIZED'

Malicious functions:

To bypass firewall, removes or modifies the following registry keys:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%APPDATA%\uTorrent\uTorrent.exe' = '%APPDATA%\uTorrent\uTorrent.exe:*:...

Executes the following:

'%APPDATA%\uTorrent\updates\3.4.9_43085\utorrentie.exe' uTorrent_3308_0017BA18_1680996719 µTorrent4823DF041B09 uTorrent
'%APPDATA%\uTorrent\updates\3.4.9_43085\utorrentie.exe' uTorrent_3308_0017BAB0_277725677 µTorrent4823DF041B09 uTorrent
'%APPDATA%\uTorrent\uTorrent.exe' /NOINSTALL /BRINGTOFRONT /S
'%TEMP%\SL.exe'
'%TEMP%\setup.exe' /S

Modifies file system:

Creates the following files:

%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\443a351ca7e0b0922bb6b31a53ed86c4_23ef5514-3059-436f-a4a7-4cefaab20eb1
%TEMP%\utt6.tmp
%APPDATA%\uTorrent\updates\3.4.9_43085\utorrentie.exe
%HOMEPATH%\Cookies\%USERNAME%@localhost[2].txt
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\µTorrent.lnk
%HOMEPATH%\Desktop\µTorrent.lnk
%TEMP%\utt5.tmp
%APPDATA%\uTorrent\maindoc.ico
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\index[1].html
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\start[1].html
%APPDATA%\uTorrent\43085-utorrent.e8f6.dmp
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\index[2].html
%APPDATA%\uTorrent\utorrent.lng.new
%TEMP%\~DF7F67.tmp
%APPDATA%\uTorrent\apps\featuredContent.btapp
%TEMP%\~DFC207.tmp
%TEMP%\settings.exe
%TEMP%\aut3.tmp
%TEMP%\utt4.tmp
%APPDATA%\uTorrent\utorrent.lng
%TEMP%\SL.exe
%TEMP%\aut1.tmp
%TEMP%\setup.exe
%TEMP%\aut2.tmp
%APPDATA%\uTorrent\settings.dat.new
%APPDATA%\uTorrent\updates.dat
%HOMEPATH%\Start Menu\µTorrent.lnk
%APPDATA%\uTorrent\uTorrent.exe
%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\1f91d2d17ea675d4c2c3192e241743f9_23ef5514-3059-436f-a4a7-4cefaab20eb1
%APPDATA%\Microsoft\Protect\CREDHIST
%HOMEPATH%\Cookies\%USERNAME%@localhost[1].txt
%APPDATA%\uTorrent\updates\3.4.9_43085.exe

Deletes the following files:

Moves the following files:

from %APPDATA%\uTorrent\utorrent.lng to %APPDATA%\uTorrent\utorrent.lng.28424.tmp
from %APPDATA%\uTorrent\settings.dat to %APPDATA%\uTorrent\settings.dat.old
from %APPDATA%\uTorrent\settings.dat.new to %APPDATA%\uTorrent\settings.dat

Network activity:

Connects to:

TCP:

HTTP GET requests:

http://no#.bt.co/inclient
http://cd#.###medianetwork.com/network/start.html?la######
http://cd#.###medianetwork.com/network/index.html?ad###################################################################################################################
http://up####.utorrent.li/installstats.php?cl####################################################################################################################
http://up####.utorrent.li/installstats.php?cl#############################################################################################################################################
http://ut###ent.com/download/langpacks/dl.php?bu##################################################################

HTTP POST requests: