Trojan.DownLoader29.45529

Technical Information

To ensure autorun and distribution

Creates the following services

[<HKLM>\System\CurrentControlSet\Services\WINIO] 'ImagePath' = '%WINDIR%\SysWOW64\winio.sys'

Modifies file system

Creates the following files

%TEMP%\e_n4\krnln.fnr
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\http_404_weboc[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\caasbycl\errorpagetemplate[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\errorpagestrings[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\httperrorpagesscripts[2]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\background_gradient[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\info_48[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\bullet[2]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\down[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\css[1].css
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\caasbycl\css[1].css
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\tongji[1].js
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\tongji[1].js
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\j2011[1].js
<Current directory>\winio.dll
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\j2011[1].js
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\1[1].jpg
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\1[2].jpg
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\01[2].jpg
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\caasbycl\11[2].jpg
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\caasbycl\11[1].jpg
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\21[1].jpg
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\21[1].jpg
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\31[1].jpg
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\31[2].jpg
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\nav[1].png
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\nav-b[1].png
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\caasbycl\nav[1].png
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\bk-line[1].png
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\info_48[2]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\bullet[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\background_gradient[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\down[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\bullet[1]
%TEMP%\e_n4\eapi.fne
%TEMP%\e_n4\shell.fne
%TEMP%\e_n4\ecompress.fne
%WINDIR%\syswow64\skinh_el.dll
%TEMP%\royale.she
<Current directory>\1.zip
<Current directory>\qmdispatch.dll
<Current directory>\avjbgm.dll
<Current directory>\bexception.dll
<Current directory>\cfgdll.dll
<Current directory>\cooper.dll
<Current directory>\dob.dll
<Current directory>\helper.dll
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\caasbycl\nav-b[1].png
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\01[1].jpg
<Current directory>\rename.ini
%WINDIR%\qmdispatch.dll
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\caasbycl\http_404_weboc[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\http_500_weboc[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\caasbycl\dict_yurbbs_cn[1].txt
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\caasbycl\yurbbs_cn[1].txt
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\errorpagetemplate[2]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\errorpagestrings[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\httperrorpagesscripts[2]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\errorpagetemplate[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\errorpagestrings[2]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\httperrorpagesscripts[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\background_gradient[2]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\info_48[1]
%TEMP%\e_n4\htmlview.fne
<Current directory>\qmhelper.dll
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\bk-line[2].png

Deletes the following files

<Current directory>\1.zip
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\bullet[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\info_48[2]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\background_gradient[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\httperrorpagesscripts[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\errorpagestrings[2]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\errorpagetemplate[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\tongji[1].js
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\caasbycl\http_404_weboc[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\bullet[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\info_48[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\background_gradient[2]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\httperrorpagesscripts[2]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\errorpagestrings[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\errorpagetemplate[2]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\down[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\j2011[1].js

Substitutes the following files

<LS_APPDATA>\Microsoft\Windows\<INETFILES>\Content.IE5\RE1N75KR\down[1]

Network activity

TCP

HTTP GET requests

http://di##.yurbbs.cn/
http://di##.yurbbs.cn/tem/default/images/bk-line.png
http://www.yu##bs.cn/tem/default/images/nav.png
http://di##.yurbbs.cn/tem/default/images/nav-b.png
http://di##.yurbbs.cn/tem/default/images/nav.png
http://www.yu##bs.cn//tem/default/images/31.jpg
http://di##.yurbbs.cn//tem/default/images/31.jpg
http://www.yu##bs.cn//tem/default/images/21.jpg
http://di##.yurbbs.cn//tem/default/images/21.jpg
http://www.yu##bs.cn//tem/default/images/11.jpg
http://di##.yurbbs.cn//tem/default/images/11.jpg
http://di##.yurbbs.cn//tem/default/images/1.jpg
http://www.yu##bs.cn//tem/default/images/1.jpg
http://www.yu##bs.cn//tem/default/images/01.jpg
http://di##.yurbbs.cn//tem/default/images/01.jpg
http://vt##6ks.xyz/j2011.js
http://vt##6ks.xyz/j2012.js
http://vt##6ks.xyz/tongji.js
http://di##.yurbbs.cn/tem/default/css/css.css
http://www.yu##bs.cn/tem/default/css/css.css
http://bb#.#urbbs.cn/cf/wg2.html
http://www.yu##bs.cn/
http://bb#.#urbbs.cn/
http://bb#.#urbbs.cn/cf/wg.html
http://www.yu##bs.cn/tem/default/images/nav-b.png
http://www.yu##bs.cn/tem/default/images/bk-line.png

UDP

DNS ASK di##.yurbbs.cn
DNS ASK bb#.#urbbs.cn
DNS ASK yu##bs.cn
DNS ASK vt##6ks.xyz
DNS ASK js.##ers.51.la

Miscellaneous

Searches for the following windows

ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebCheckMonitor' WindowName: ''
ClassName: 'Static' WindowName: ''

Creates and executes the following

'%ProgramFiles%\internet explorer\iexplore.exe' ' (with hidden window)

Executes the following

'%ProgramFiles%\internet explorer\iexplore.exe'
'%WINDIR%\syswow64\regsvr32.exe' %WINDIR%\QMDispatch.dll -s

Технології

Терміни

Навчання

Міфи

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней