Trojan.DownLoader26.45918

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Group Trap COM Now Notification' = 'C:\gqipahabiwtz\mb66rsol.exe'

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\Internet Multimedia Window Acquisition] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\Internet Multimedia Window Acquisition] 'ImagePath' = 'C:\gqipahabiwtz\mb66rsol.exe'

Modifies file system:

Creates the following files:

%WINDIR%\gqipahabiwtz\lopnb7flrgn
C:\gqipahabiwtz\lopnb7flrgn
C:\gqipahabiwtz\kqjkem2p2shuommkllci.exe
C:\gqipahabiwtz\mb66rsol.exe
C:\gqipahabiwtz\htz4uqzhknf.exe
C:\gqipahabiwtz\jnnaaw

Sets the 'hidden' attribute to the following files:

C:\gqipahabiwtz\mb66rsol.exe
C:\gqipahabiwtz\htz4uqzhknf.exe

Deletes the following files:

%WINDIR%\gqipahabiwtz\lopnb7flrgn
C:\gqipahabiwtz\kqjkem2p2shuommkllci.exe

Substitutes the following files:

%WINDIR%\gqipahabiwtz\lopnb7flrgn

Network activity:

Connects to:

'se#####ancharlize.net':80
'pr#####lasheenagh.net':80
'ma#####ansheenagh.net':80
'pr#####lasherilyn.net':80
'ma#####ansherilyn.net':80
'pr#####lacharlize.net':80
'ma#####ancharlize.net':80
'ch#####taaraminta.net':80
'pr#####laaraminta.net':80
'ka#####rasheenagh.net':80
'ch#####tasheenagh.net':80
'ka#####rasherilyn.net':80
'ch#####tasherilyn.net':80
'ka#####racharlize.net':80
'ch#####tacharlize.net':80
'ma#####anaraminta.net':80
'ka#####raaraminta.net':80
'de#####staraminta.net':80
'se#####anbroadbent.net':80
'ch#####nebroadbent.net':80
'se#####anharrelson.net':80
'ch#####naharrelson.net':80
'se#####anbannerman.net':80
'ch#####nabannerman.net':80
'se#####ansanderson.net':80
'de#####stcharlize.net':80
'la#####iaaraminta.net':80
'ch#####nabroadbent.net':80
'la#####iasheenagh.net':80
'de#####stsheenagh.net':80
'la#####iasherilyn.net':80
'de#####stsherilyn.net':80
'la#####iacharlize.net':80
'ch#####nasanderson.net':80
'co#####cesheenagh.net':80
'ha#####tasheenagh.net':80
'co#####cesherilyn.net':80
'cr#####onaraminta.net':80
'cl#####ndsheenagh.net':80
'ch#####nesheenagh.net':80
'cl#####ndsherilyn.net':80
'ch#####nesherilyn.net':80
'cr#####oncharlize.net':80
'cl#####ndcharlize.net':80
'cl#####ndaraminta.net':80
'ch#####nearaminta.net':80
'se#####ansheenagh.net':80
'ch#####nasheenagh.net':80
'se#####ansherilyn.net':80
'ch#####nasherilyn.net':80
'ch#####necharlize.net':80
'ja#####yncharlize.net':80
'ja#####ynaraminta.net':80
'cr#####onsherilyn.net':80
'ha#####tasherilyn.net':80
'ja#####tasherilyn.net':80
'co#####cecharlize.net':80
'ha#####tacharlize.net':80
'co#####cearaminta.net':80
'ha#####taaraminta.net':80
'ja#####tasheenagh.net':80
'ro#####nesheenagh.net':80
'ro#####nesherilyn.net':80
'ja#####ynsherilyn.net':80
'ja#####tacharlize.net':80
'ro#####necharlize.net':80
'ja#####taaraminta.net':80
'ro#####nearaminta.net':80
'ja#####ynsheenagh.net':80
'cr#####onsheenagh.net':80
'cl#####ndbroadbent.net':80
'ch#####nesanderson.net':80

TCP:

HTTP GET requests:

http://se#####ancharlize.net/index.php
http://pr#####lasheenagh.net/index.php
http://ma#####ansheenagh.net/index.php
http://pr#####lasherilyn.net/index.php
http://ma#####ansherilyn.net/index.php
http://pr#####lacharlize.net/index.php
http://ma#####ancharlize.net/index.php
http://ch#####taaraminta.net/index.php
http://pr#####laaraminta.net/index.php
http://ka#####rasheenagh.net/index.php
http://ch#####tasheenagh.net/index.php
http://ka#####rasherilyn.net/index.php
http://ch#####tasherilyn.net/index.php
http://ka#####racharlize.net/index.php
http://ch#####tacharlize.net/index.php
http://ma#####anaraminta.net/index.php
http://ka#####raaraminta.net/index.php
http://de#####staraminta.net/index.php
http://se#####anbroadbent.net/index.php
http://ch#####nebroadbent.net/index.php
http://se#####anharrelson.net/index.php
http://ch#####naharrelson.net/index.php
http://se#####anbannerman.net/index.php
http://ch#####nabannerman.net/index.php
http://se#####ansanderson.net/index.php
http://de#####stcharlize.net/index.php
http://la#####iaaraminta.net/index.php
http://ch#####nabroadbent.net/index.php
http://la#####iasheenagh.net/index.php
http://de#####stsheenagh.net/index.php
http://la#####iasherilyn.net/index.php
http://de#####stsherilyn.net/index.php
http://la#####iacharlize.net/index.php
http://ch#####nasanderson.net/index.php
http://co#####cesheenagh.net/index.php
http://ha#####tasheenagh.net/index.php
http://co#####cesherilyn.net/index.php
http://cr#####onaraminta.net/index.php
http://cl#####ndsheenagh.net/index.php
http://ch#####nesheenagh.net/index.php
http://cl#####ndsherilyn.net/index.php
http://ch#####nesherilyn.net/index.php
http://cr#####oncharlize.net/index.php
http://cl#####ndcharlize.net/index.php
http://cl#####ndaraminta.net/index.php
http://ch#####nearaminta.net/index.php
http://se#####ansheenagh.net/index.php
http://ch#####nasheenagh.net/index.php
http://se#####ansherilyn.net/index.php
http://ch#####nasherilyn.net/index.php
http://ch#####necharlize.net/index.php
http://ja#####yncharlize.net/index.php
http://ja#####ynaraminta.net/index.php
http://cr#####onsherilyn.net/index.php
http://ha#####tasherilyn.net/index.php
http://ja#####tasherilyn.net/index.php
http://co#####cecharlize.net/index.php
http://ha#####tacharlize.net/index.php
http://co#####cearaminta.net/index.php
http://ha#####taaraminta.net/index.php
http://ja#####tasheenagh.net/index.php
http://ro#####nesheenagh.net/index.php
http://ro#####nesherilyn.net/index.php
http://ja#####ynsherilyn.net/index.php
http://ja#####tacharlize.net/index.php
http://ro#####necharlize.net/index.php
http://ja#####taaraminta.net/index.php
http://ro#####nearaminta.net/index.php
http://ja#####ynsheenagh.net/index.php
http://cr#####onsheenagh.net/index.php
http://cl#####ndbroadbent.net/index.php
http://ch#####nesanderson.net/index.php

UDP:

DNS ASK se#####ancharlize.net
DNS ASK ma#####ansheenagh.net
DNS ASK pr#####lasherilyn.net
DNS ASK ma#####ansherilyn.net
DNS ASK pr#####lacharlize.net
DNS ASK ma#####ancharlize.net
DNS ASK pr#####laaraminta.net
DNS ASK pr#####lasheenagh.net
DNS ASK ma#####anaraminta.net
DNS ASK ch#####tasheenagh.net
DNS ASK ka#####rasherilyn.net
DNS ASK ch#####tasherilyn.net
DNS ASK ka#####racharlize.net
DNS ASK ch#####tacharlize.net
DNS ASK ka#####raaraminta.net
DNS ASK ka#####rasheenagh.net
DNS ASK de#####staraminta.net
DNS ASK la#####iaaraminta.net
DNS ASK de#####stcharlize.net
DNS ASK cl#####ndbroadbent.net
DNS ASK ch#####nebroadbent.net
DNS ASK se#####anharrelson.net
DNS ASK ch#####naharrelson.net
DNS ASK se#####anbannerman.net
DNS ASK ch#####nabannerman.net
DNS ASK se#####ansanderson.net
DNS ASK ch#####nasanderson.net
DNS ASK se#####anbroadbent.net
DNS ASK ch#####nabroadbent.net
DNS ASK la#####iasheenagh.net
DNS ASK de#####stsheenagh.net
DNS ASK la#####iasherilyn.net
DNS ASK de#####stsherilyn.net
DNS ASK la#####iacharlize.net
DNS ASK ch#####taaraminta.net
DNS ASK ch#####nesanderson.net
DNS ASK co#####cesheenagh.net
DNS ASK co#####cesherilyn.net
DNS ASK ja#####ynaraminta.net
DNS ASK cr#####onaraminta.net
DNS ASK cl#####ndsheenagh.net
DNS ASK ch#####nesheenagh.net
DNS ASK cl#####ndsherilyn.net
DNS ASK ch#####nesherilyn.net
DNS ASK cr#####oncharlize.net
DNS ASK cl#####ndcharlize.net
DNS ASK cl#####ndaraminta.net
DNS ASK ch#####nearaminta.net
DNS ASK se#####ansheenagh.net
DNS ASK ch#####nasheenagh.net
DNS ASK se#####ansherilyn.net
DNS ASK ch#####nasherilyn.net
DNS ASK ch#####necharlize.net
DNS ASK ja#####yncharlize.net
DNS ASK cr#####onsherilyn.net
DNS ASK ja#####ynsherilyn.net
DNS ASK ha#####tasherilyn.net
DNS ASK co#####cecharlize.net
DNS ASK ha#####tacharlize.net
DNS ASK co#####cearaminta.net
DNS ASK ha#####taaraminta.net
DNS ASK ja#####tasheenagh.net
DNS ASK ro#####nesheenagh.net
DNS ASK ja#####tasherilyn.net
DNS ASK ro#####nesherilyn.net
DNS ASK ja#####tacharlize.net
DNS ASK ro#####necharlize.net
DNS ASK ja#####taaraminta.net
DNS ASK ro#####nearaminta.net
DNS ASK ja#####ynsheenagh.net
DNS ASK cr#####onsheenagh.net
DNS ASK ha#####tasheenagh.net
DNS ASK cl#####ndsanderson.net

Miscellaneous:

Creates and executes the following:

'C:\gqipahabiwtz\kqjkem2p2shuommkllci.exe'
'C:\gqipahabiwtz\mb66rsol.exe'
'C:\gqipahabiwtz\htz4uqzhknf.exe' "c:\gqipahabiwtz\mb66rsol.exe"

Технології

Терміни

Навчання

Міфи

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней