Trojan.DownLoader25.186

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%WINDIR%\Tasks\Driver Easy Scheduled Scan.job

Malicious functions:

To bypass firewall, removes or modifies the following registry keys:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%ProgramFiles%\Easeware\DriverEasy\DriverEasy.exe' = '%ProgramFiles%\E...
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] '%ProgramFiles%\Easeware\DriverEasy\DriverEasy.exe' = '%ProgramFiles%\Eas...

Executes the following:

'%ProgramFiles%\Easeware\DriverEasy\Easeware.ConfigLanguageFromSetup.exe' DriverEasy en
'%ProgramFiles%\Easeware\DriverEasy\DriverEasy.exe'
'<SYSTEM32>\netsh.exe' firewall add allowedprogram program="%ProgramFiles%\Easeware\DriverEasy\DriverEasy.exe" name="Driver Easy" mode=ENABLE profile=ALL
'%CommonProgramFiles%\~orpodhs.ibo' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
'%TEMP%\is-A4U7K.tmp\~orpodhs.tmp' /SL5="$100E0,3492144,395264,%CommonProgramFiles%\~orpodhs.ibo" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
'%ProgramFiles%\Easeware\DriverEasy\Easeware.CheckScheduledScan.exe' -create "Driver Easy Scheduled Scan" "%ProgramFiles%\Easeware\DriverEasy\DriverEasy.exe"

Modifies file system:

Creates the following files:

%ProgramFiles%\Easeware\DriverEasy\HardwareInfo\is-KNKLK.tmp
%ProgramFiles%\Easeware\DriverEasy\HardwareInfo\is-1M09I.tmp
%ALLUSERSPROFILE%\Start Menu\Programs\Driver Easy\Driver Easy.lnk
%ProgramFiles%\Easeware\DriverEasy\is-1IM66.tmp
%ProgramFiles%\Easeware\DriverEasy\7z\is-9T8VJ.tmp
%ProgramFiles%\Easeware\DriverEasy\7z\is-3AB9S.tmp
%ALLUSERSPROFILE%\Start Menu\Programs\Driver Easy\Uninstall Driver Easy.lnk
%APPDATA%\Easeware\DriverEasy\settings.dat
%TEMP%\aut2.tmp
%ProgramFiles%\Easeware\DriverEasy\Easeware.Driver.Core.dll
%ALLUSERSPROFILE%\Desktop\Driver Easy.lnk
%ProgramFiles%\Easeware\DriverEasy\unins000.msg
%ProgramFiles%\Easeware\DriverEasy\unins000.dat
%ProgramFiles%\Easeware\DriverEasy\is-131KO.tmp
%ProgramFiles%\Easeware\DriverEasy\is-VVS74.tmp
%ProgramFiles%\Easeware\DriverEasy\is-H5NQJ.tmp
%ProgramFiles%\Easeware\DriverEasy\is-UJH06.tmp
%TEMP%\aut1.tmp
%CommonProgramFiles%\~orpodhs.ibo
%ProgramFiles%\Easeware\DriverEasy\is-P8VU9.tmp
%ProgramFiles%\Easeware\DriverEasy\is-EN2HA.tmp
%ProgramFiles%\Easeware\DriverEasy\is-MKVN0.tmp
%ProgramFiles%\Easeware\DriverEasy\is-EUO8O.tmp
%ProgramFiles%\Easeware\DriverEasy\is-BKM0N.tmp
%ProgramFiles%\Easeware\DriverEasy\is-SV4H6.tmp
%ProgramFiles%\Easeware\DriverEasy\is-H9A3S.tmp
%ProgramFiles%\Easeware\DriverEasy\is-R0O1G.tmp

Sets the 'hidden' attribute to the following files:

%CommonProgramFiles%\~orpodhs.ibo

Deletes the following files:

%TEMP%\is-184OV.tmp\_isetup\_shfoldr.dll
%TEMP%\is-A4U7K.tmp\~orpodhs.tmp
%TEMP%\aut2.tmp
%TEMP%\is-184OV.tmp\isxdl.dll
%TEMP%\aut1.tmp
<SYSTEM32>\d3d9caps.dat
%TEMP%\is-184OV.tmp\InstallDotNet.bat

Moves the following files:

from %ProgramFiles%\Easeware\DriverEasy\is-131KO.tmp to %ProgramFiles%\Easeware\DriverEasy\Map.xml
from %ProgramFiles%\Easeware\DriverEasy\is-1IM66.tmp to %ProgramFiles%\Easeware\DriverEasy\SevenZipSharp.dll
from %ProgramFiles%\Easeware\DriverEasy\is-EUO8O.tmp to %ProgramFiles%\Easeware\DriverEasy\Easeware.Driver.Core.dll
from %ProgramFiles%\Easeware\DriverEasy\is-BKM0N.tmp to %ProgramFiles%\Easeware\DriverEasy\Interop.WUApiLib.dll
from %ProgramFiles%\Easeware\DriverEasy\HardwareInfo\is-KNKLK.tmp to %ProgramFiles%\Easeware\DriverEasy\HardwareInfo\HardwareInfo.dll
from %ProgramFiles%\Easeware\DriverEasy\HardwareInfo\is-1M09I.tmp to %ProgramFiles%\Easeware\DriverEasy\HardwareInfo\HardwareInfo64.dll
from %ProgramFiles%\Easeware\DriverEasy\7z\is-9T8VJ.tmp to %ProgramFiles%\Easeware\DriverEasy\7z\7z.dll
from %ProgramFiles%\Easeware\DriverEasy\7z\is-3AB9S.tmp to %ProgramFiles%\Easeware\DriverEasy\7z\7z86.dll
from %ProgramFiles%\Easeware\DriverEasy\is-MKVN0.tmp to %ProgramFiles%\Easeware\DriverEasy\Easeware.Driver.Backup.dll
from %ProgramFiles%\Easeware\DriverEasy\is-H5NQJ.tmp to %ProgramFiles%\Easeware\DriverEasy\DriverEasy.exe
from %ProgramFiles%\Easeware\DriverEasy\is-UJH06.tmp to %ProgramFiles%\Easeware\DriverEasy\DriverEasy.exe.config
from %ProgramFiles%\Easeware\DriverEasy\is-P8VU9.tmp to %ProgramFiles%\Easeware\DriverEasy\unins000.exe
from %ProgramFiles%\Easeware\DriverEasy\is-VVS74.tmp to %ProgramFiles%\Easeware\DriverEasy\7zip_license.txt
from %ProgramFiles%\Easeware\DriverEasy\is-H9A3S.tmp to %ProgramFiles%\Easeware\DriverEasy\Easeware.ConfigLanguageFromSetup.exe
from %ProgramFiles%\Easeware\DriverEasy\is-R0O1G.tmp to %ProgramFiles%\Easeware\DriverEasy\Easeware.ConfigLanguageFromSetup.exe.config
from %ProgramFiles%\Easeware\DriverEasy\is-EN2HA.tmp to %ProgramFiles%\Easeware\DriverEasy\Easeware.CheckScheduledScan.exe
from %ProgramFiles%\Easeware\DriverEasy\is-SV4H6.tmp to %ProgramFiles%\Easeware\DriverEasy\Easeware.CheckScheduledScan.exe.config