Trojan.DownLoader25.65166

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'SkypeC0SvcService.exe' = '"<SYSTEM32>\regsvr32.exe" /s "%APPDATA%\AdobeUdpate\MSIMG32.dll" "%APPDATA%\AdobeUdpate\SkypeC0SvcService.exe"'

Malicious functions:

Searches for windows to

detect analytical utilities:

Modifies file system:

Creates the following files:

%TEMP%\Cab33.tmp
%TEMP%\Cab31.tmp
%TEMP%\Cab2F.tmp
%TEMP%\Cab35.tmp
%TEMP%\Cab3B.tmp
%TEMP%\Cab39.tmp
%TEMP%\Cab37.tmp
%TEMP%\Cab2D.tmp
%TEMP%\Cab23.tmp
%TEMP%\Cab21.tmp
%TEMP%\Cab1F.tmp
%TEMP%\Cab25.tmp
%TEMP%\Cab2B.tmp
%TEMP%\Cab29.tmp
%TEMP%\Cab27.tmp
%APPDATA%\Microsoft\Protect\CREDHIST
%TEMP%\Cab4F.tmp
%TEMP%\Cab4D.tmp
%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\ec702f375e1b12d218f67ab9ef19ca23_23ef5514-3059-436f-a4a7-4cefaab20eb1
%TEMP%\Cab55.tmp
%TEMP%\Cab53.tmp
%TEMP%\Cab51.tmp
%TEMP%\Cab4B.tmp
%TEMP%\Cab41.tmp
%TEMP%\Cab3F.tmp
%TEMP%\Cab3D.tmp
%TEMP%\Cab43.tmp
%TEMP%\Cab49.tmp
%TEMP%\Cab47.tmp
%TEMP%\Cab45.tmp
%APPDATA%\AdobeUdpate\tv_w32.exe
%APPDATA%\AdobeUdpate\tv_w32.dll
%APPDATA%\AdobeUdpate\tvr.cfg
%APPDATA%\AdobeUdpate\tv_x64.dll
%APPDATA%\AdobeUdpate\tv.ini
%APPDATA%\AdobeUdpate\TeamViewer.ini
%APPDATA%\AdobeUdpate\tv_x64.exe
%APPDATA%\AdobeUdpate\TeamViewer_StaticRes.dll
%APPDATA%\AdobeUdpate\KOHKYEPEHTY1.xlsx
%TEMP%\sfxzip1010
%TEMP%\sfx39D3.tmp
%APPDATA%\AdobeUdpate\msimg32.dll
%APPDATA%\AdobeUdpate\TeamViewer_Resource_en.dll
%APPDATA%\AdobeUdpate\TeamViewer_Desktop.exe
%APPDATA%\AdobeUdpate\SkypeC0SvcService.exe
%TEMP%\Cab15.tmp
%TEMP%\Cab13.tmp
%TEMP%\Cab11.tmp
%TEMP%\Cab17.tmp
%TEMP%\Cab1D.tmp
%TEMP%\Cab1B.tmp
%TEMP%\Cab19.tmp
%TEMP%\CabF.tmp
%TEMP%\Cab5.tmp
%TEMP%\Cab3.tmp
%TEMP%\Cab1.tmp
%TEMP%\Cab7.tmp
%TEMP%\CabD.tmp
%TEMP%\CabB.tmp
%TEMP%\Cab9.tmp

Sets the 'hidden' attribute to the following files:

Deletes the following files:

Network activity:

Connects to:

TCP:

HTTP GET requests:

http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt
http://11#.#11.111.1/wpad.dat via wp#d

UDP: