Trojan.DownLoader25.4789

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'run' = 'E:\Thunder\266774.EXE'

Creates the following files on removable media:

<Drive name for removable media>:\Thunder\deleteme.bat
<Drive name for removable media>:\Thunder\Safte.exe
<Drive name for removable media>:\Thunder\2667741.EXE
<Drive name for removable media>:\Thunder\LogMePath.dat
<Drive name for removable media>:\ndsafeocx\ndsafeocx.DLL
<Drive name for removable media>:\Thunder\AliTask.exe
<Drive name for removable media>:\Thunder\266774.EXE

Malicious functions:

Executes the following:

'%ProgramFiles%\Internet Explorer\IEXPLORE.EXE'
'<SYSTEM32>\cmd.exe' /c %WINDIR%\SysWOW64\Regsvr32.exe /s "E:\ndsafeocx\ndsafeocx.dll"
'<SYSTEM32>\taskkill.exe' /f /im 360se.exe
'<SYSTEM32>\regsvr32.exe' /s "E:\ndsafeocx\ndsafeocx.dll"
'<SYSTEM32>\cmd.exe' /c Regsvr32 /s "E:\ndsafeocx\ndsafeocx.dll"
'<SYSTEM32>\cmd.exe' /c taskkill/f /im 360se.exe
'<SYSTEM32>\cmd.exe' /c E:\Thunder\deleteme.bat
'<Drive name for removable media>:\Thunder\AliTask.exe'

Injects code into

the following user processes:

AliTask.exe

Terminates or attempts to terminate

the following user processes:

chrome.exe

Modifies settings of Windows Internet Explorer:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1607' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '2101' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '120B' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] 'CurrentLevel' = '00002904'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1609' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '1607' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '2101' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '120B' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] 'CurrentLevel' = '00002904'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '1609' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1607' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '2101' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '120B' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] 'CurrentLevel' = '00002904'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1609' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1607' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2101' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '120B' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] 'CurrentLevel' = '00002904'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1609' = '00000001'

Modifies file system:

Deletes the following files:

<Drive name for removable media>:\Thunder\266774.EXE

Deletes itself.

Network activity:

Connects to:

'ad##201.com':80

TCP:

HTTP GET requests:

http://ad##201.com/update/data.iso
http://ad##201.com/tjaz.php?wo###############################################################
http://ad##201.com/ko.php

UDP: