Trojan.DownLoader18.27023

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Isolation Experience Session Manager' = '<SYSTEM32>\yxnwjuxdrwu.exe'

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\Print Cryptographic Gateway] 'Start' = '00000002'

Malicious functions:

To complicate detection of its presence in the operating system,

blocks the following features:

Windows Security Center

Creates and executes the following:

'<SYSTEM32>\wyraqgm.exe' "<SYSTEM32>\yxnwjuxdrwu.exe"
'%WINDIR%\Temp\argbaqglxrsdicbi.exe' -r 28361 tcp
'%TEMP%\argbaqglo4j99gbib5rdbwix.exe'
'<SYSTEM32>\yxnwjuxdrwu.exe'

Modifies file system :

Creates the following files:

<SYSTEM32>\ecrpwvcyof\run
<SYSTEM32>\ecrpwvcyof\rng
%WINDIR%\Temp\argbaqglxrsdicbi.exe
<SYSTEM32>\ecrpwvcyof\cfg
%TEMP%\argbaqglo4j99gbib5rdbwix.exe
<SYSTEM32>\ecrpwvcyof\tst
<SYSTEM32>\wyraqgm.exe
<SYSTEM32>\yxnwjuxdrwu.exe

Sets the 'hidden' attribute to the following files:

<SYSTEM32>\wyraqgm.exe
<SYSTEM32>\yxnwjuxdrwu.exe

Deletes the following files:

%WINDIR%\Temp\argbaqglxrsdicbi.exe
%TEMP%\argbaqglo4j99gbib5rdbwix.exe

Network activity:

Connects to:

'ta###kill.net':80
'le###ill.net':80
'ta###stood.net':80
'le###tood.net':80
'ta###first.net':80
'le###uess.net':80
'po###stood.net':80
'le###irst.net':80
'ta###guess.net':80
'we###uess.net':80
'fe###tood.net':80
'we###tood.net':80
'th###guess.net':80
'li###uess.net':80
'fe###ill.net':80
'we###irst.net':80
'fe###uess.net':80
'we###ill.net':80
'fe###irst.net':80
'ca###tood.net':80
'ri###ill.net':80
'fa###kill.net':80
'ri###tood.net':80
'fa###stood.net':80
'ri###irst.net':80
'fa###guess.net':80
'so###taste.net':80
'fa###first.net':80
'ri###uess.net':80
'no###uess.net':80
'po###first.net':80
'ca###irst.net':80
'po###kill.net':80
'ca###ill.net':80
'po###guess.net':80
'no###ill.net':80
'no###irst.net':80
'ca###uess.net':80
'no###tood.net':80
'ro###orty.net':80
'de###ther.net':80
'ef###tbuilt.net':80
'th###while.net':80
'ro###ther.net':80
'wr###free.net':80
'ma###ree.net':80
'de###all.net':80
'ro###all.net':80
'ri###nstorm.net':80
'de####promise.net':80
'se####strong.net':80
'or###thrown.net':80
'jo####ymeasure.net':80
'si######edwerryhouse.net':80
'gw#####ynhuddleston.net':80
'of####urprise.net':80
'mo####gduring.net':80
'ch####nother.net':80
'wr###forty.net':80
'fi###guess.net':80
'th###stood.net':80
'fi###first.net':80
'so###guess.net':80
'li###tood.net':80
'th###first.net':80
'li###irst.net':80
'th###kill.net':80
'li###ill.net':80
'so###first.net':80
'ma###ther.net':80
'wr###wall.net':80
'ma###orty.net':80
'wr###other.net':80
'ma###all.net':80
'so###kill.net':80
'fi###kill.net':80
'so###stood.net':80
'fi###stood.net':80

TCP:

HTTP GET requests:

http://ta###kill.net/index.php
http://le###ill.net/index.php
http://ta###stood.net/index.php
http://le###tood.net/index.php
http://ta###first.net/index.php
http://le###uess.net/index.php
http://po###stood.net/index.php
http://le###irst.net/index.php
http://ta###guess.net/index.php
http://we###uess.net/index.php
http://fe###tood.net/index.php
http://we###tood.net/index.php
http://th###guess.net/index.php
http://li###uess.net/index.php
http://fe###ill.net/index.php
http://we###irst.net/index.php
http://fe###uess.net/index.php
http://we###ill.net/index.php
http://fe###irst.net/index.php
http://ca###tood.net/index.php
http://ri###ill.net/index.php
http://fa###kill.net/index.php
http://ri###tood.net/index.php
http://fa###stood.net/index.php
http://ri###irst.net/index.php
http://fa###guess.net/index.php
http://so###taste.net/index.php
http://fa###first.net/index.php
http://ri###uess.net/index.php
http://no###uess.net/index.php
http://po###first.net/index.php
http://ca###irst.net/index.php
http://po###kill.net/index.php
http://ca###ill.net/index.php
http://po###guess.net/index.php
http://no###ill.net/index.php
http://no###irst.net/index.php
http://ca###uess.net/index.php
http://no###tood.net/index.php
http://ro###orty.net/index.php
http://de###ther.net/index.php
http://ef###tbuilt.net/index.php
http://th###while.net/index.php
http://ro###ther.net/index.php
http://wr###free.net/index.php
http://ma###ree.net/index.php
http://de###all.net/index.php
http://ro###all.net/index.php
http://ri###nstorm.net/index.php
http://de####promise.net/index.php
http://se####strong.net/index.php
http://or###thrown.net/index.php
http://jo####ymeasure.net/index.php
http://si######edwerryhouse.net/index.php
http://gw#####ynhuddleston.net/index.php
http://of####urprise.net/index.php
http://mo####gduring.net/index.php
http://ch####nother.net/index.php
http://wr###forty.net/index.php
http://fi###guess.net/index.php
http://th###stood.net/index.php
http://fi###first.net/index.php
http://so###guess.net/index.php
http://li###tood.net/index.php
http://th###first.net/index.php
http://li###irst.net/index.php
http://th###kill.net/index.php
http://li###ill.net/index.php
http://so###first.net/index.php
http://ma###ther.net/index.php
http://wr###wall.net/index.php
http://ma###orty.net/index.php
http://wr###other.net/index.php
http://ma###all.net/index.php
http://so###kill.net/index.php
http://fi###kill.net/index.php
http://so###stood.net/index.php
http://fi###stood.net/index.php

UDP:

DNS ASK le###ill.net
DNS ASK ta###first.net
DNS ASK ta###kill.net
DNS ASK ta###stood.net
DNS ASK le###tood.net
DNS ASK po###stood.net
DNS ASK ca###tood.net
DNS ASK le###uess.net
DNS ASK le###irst.net
DNS ASK ta###guess.net
DNS ASK we###tood.net
DNS ASK fe###ill.net
DNS ASK fe###tood.net
DNS ASK th###guess.net
DNS ASK li###uess.net
DNS ASK fe###uess.net
DNS ASK we###uess.net
DNS ASK we###irst.net
DNS ASK we###ill.net
DNS ASK fe###irst.net
DNS ASK fa###kill.net
DNS ASK ri###irst.net
DNS ASK ri###ill.net
DNS ASK ri###tood.net
DNS ASK fa###stood.net
DNS ASK so###taste.net
DNS ASK fi###taste.net
DNS ASK fa###guess.net
DNS ASK fa###first.net
DNS ASK ri###uess.net
DNS ASK ca###irst.net
DNS ASK po###guess.net
DNS ASK po###first.net
DNS ASK po###kill.net
DNS ASK ca###ill.net
DNS ASK no###irst.net
DNS ASK no###uess.net
DNS ASK no###ill.net
DNS ASK ca###uess.net
DNS ASK no###tood.net
DNS ASK ro###orty.net
DNS ASK de###ther.net
DNS ASK ef###tbuilt.net
DNS ASK th###while.net
DNS ASK ro###ther.net
DNS ASK wr###free.net
DNS ASK ma###ree.net
DNS ASK de###all.net
DNS ASK ro###all.net
DNS ASK ri###nstorm.net
DNS ASK de####promise.net
DNS ASK se####strong.net
DNS ASK or###thrown.net
DNS ASK jo####ymeasure.net
DNS ASK si######edwerryhouse.net
DNS ASK gw#####ynhuddleston.net
DNS ASK of####urprise.net
DNS ASK mo####gduring.net
DNS ASK ch####nother.net
DNS ASK wr###forty.net
DNS ASK fi###guess.net
DNS ASK th###stood.net
DNS ASK fi###first.net
DNS ASK so###guess.net
DNS ASK li###tood.net
DNS ASK th###first.net
DNS ASK li###irst.net
DNS ASK th###kill.net
DNS ASK li###ill.net
DNS ASK so###first.net
DNS ASK ma###ther.net
DNS ASK wr###wall.net
DNS ASK ma###orty.net
DNS ASK wr###other.net
DNS ASK ma###all.net
DNS ASK so###kill.net
DNS ASK fi###kill.net
DNS ASK so###stood.net
DNS ASK fi###stood.net
'23#.#55.255.250':1900

技术

术语

教育培训

误区

Technical Information

Curing recommendations

Free trial