Trojan.DownLoader26.43285

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'SkypeC0SvcService.exe' = '"%APPDATA%\LocalDataNT\SkypeC0SvcService.exe" r'

Creates or modifies the following files:

%HOMEPATH%\Start Menu\Programs\Startup\Service Manager.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Startup\Service Manager.lnk

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\usbhubsvc4] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\usbhubsvc4] 'ImagePath' = '<SYSTEM32>\svchost.exe -k "MsHubSvc4" -svcr "SkypeC0SvcService.exe"'
[<HKLM>\SYSTEM\ControlSet001\Services\usbhubsvc4\Parameters] 'ServiceDLL' = '%APPDATA%\LocalDataNT\msimg32.dll'

Modifies file system:

Creates the following files:

%TEMP%\NS-TPF65.tmp\NS-BQCMH.tmp
%TEMP%\Cab2D.tmp
%TEMP%\Cab2B.tmp
%TEMP%\Cab29.tmp
%TEMP%\Cab27.tmp
%TEMP%\Cab25.tmp
%TEMP%\Cab23.tmp
%TEMP%\Cab21.tmp
%TEMP%\Cab1F.tmp
%TEMP%\Cab1D.tmp
%TEMP%\Cab1B.tmp
%TEMP%\Cab19.tmp
%TEMP%\Cab17.tmp
%TEMP%\Cab15.tmp
%TEMP%\Cab13.tmp
%TEMP%\Cab11.tmp
%TEMP%\CabD.tmp
%TEMP%\CabF.tmp
%TEMP%\Cab2F.tmp
%TEMP%\Cab31.tmp
%TEMP%\Cab51.tmp
%TEMP%\Cab4F.tmp
%TEMP%\Cab4D.tmp
%TEMP%\Cab4B.tmp
%TEMP%\Cab49.tmp
%TEMP%\Cab47.tmp
%TEMP%\Cab45.tmp
%TEMP%\Cab41.tmp
%APPDATA%\LocalDataNT\tv_x64.exe
%TEMP%\Cab3F.tmp
%TEMP%\Cab3D.tmp
%TEMP%\Cab3B.tmp
%TEMP%\Cab39.tmp
%TEMP%\Cab37.tmp
%TEMP%\Cab35.tmp
%TEMP%\Cab33.tmp
%TEMP%\CabB.tmp
%TEMP%\Cab9.tmp
%TEMP%\Cab7.tmp
%TEMP%\NS-485O1.tmp\UPD\NS-1JCSS.tmp
%TEMP%\NS-485O1.tmp\UPD\NS-4V6GE.tmp
%TEMP%\NS-485O1.tmp\UPD\NS-NNSG0.tmp
%TEMP%\NS-485O1.tmp\UPD\NS-1N57C.tmp
%TEMP%\NS-485O1.tmp\UPD\NS-R9S03.tmp
%TEMP%\NS-485O1.tmp\UPD\NS-TKJPM.tmp
%TEMP%\NS-485O1.tmp\UPD\NS-HBO82.tmp
%TEMP%\NS-485O1.tmp\UPD\NS-FJSJ6.tmp
%TEMP%\NS-485O1.tmp\UPD\NS-M8ON2.tmp
%TEMP%\NS-485O1.tmp\UPD\NS-G6DMS.tmp
%TEMP%\NS-485O1.tmp\UPD\NS-GLGQG.tmp
%TEMP%\NS-485O1.tmp\UPD\NS-N5M12.tmp
%TEMP%\NS-485O1.tmp\_iscrypt.dll
%TEMP%\NS-485O1.tmp\_shfoldr.dll
%TEMP%\NS-485O1.tmp\UPD\NS-UHA63.tmp
%APPDATA%\LocalDataNT\msimg32.dll
%TEMP%\NS-485O1.tmp\UPD\NS-NOQEC.tmp
%APPDATA%\LocalDataNT\pp2.pdf
%TEMP%\Cab5.tmp
%APPDATA%\LocalDataNT\SkypeC0SvcService.exe
%TEMP%\Cab3.tmp
%TEMP%\Cab1.tmp
%APPDATA%\LocalDataNT\tv.ini
%APPDATA%\LocalDataNT\TeamViewer.ini
%APPDATA%\LocalDataNT\vpn86.cab
%APPDATA%\LocalDataNT\vpn64.cab
%TEMP%\Cab43.tmp
%TEMP%\Cab53.tmp
%APPDATA%\LocalDataNT\tv_x64.dll
%APPDATA%\LocalDataNT\tv_w32.exe
%APPDATA%\LocalDataNT\tv_w32.dll
%APPDATA%\LocalDataNT\tvr.cfg
%APPDATA%\LocalDataNT\TeamViewer_StaticRes.dll
%APPDATA%\LocalDataNT\TeamViewer_Resource_en.dll
%APPDATA%\LocalDataNT\TeamViewer_Desktop.exe
%APPDATA%\LocalDataNT\updatecache.bat
%TEMP%\Cab55.tmp

Sets the 'hidden' attribute to the following files:

%APPDATA%\LocalDataNT\TeamViewer_StaticRes.dll
%APPDATA%\LocalDataNT\TeamViewer_Resource_en.dll
%APPDATA%\LocalDataNT\TeamViewer_Desktop.exe
%APPDATA%\LocalDataNT\tv_w32.exe
%APPDATA%\LocalDataNT\tv_x64.exe
%APPDATA%\LocalDataNT\tv_w32.dll
%APPDATA%\LocalDataNT\tv_x64.dll
%APPDATA%\LocalDataNT\vpn86.cab
%APPDATA%\LocalDataNT\vpn64.cab
%APPDATA%\LocalDataNT\TeamViewer.ini
%APPDATA%\LocalDataNT\tv.ini
%APPDATA%\LocalDataNT\msimg32.dll
%APPDATA%\LocalDataNT\tvr.cfg
%APPDATA%\LocalDataNT\SkypeC0SvcService.exe

Deletes the following files:

%TEMP%\Cab1.tmp
%TEMP%\NS-485O1.tmp\_shfoldr.dll
%TEMP%\Cab25.tmp
%TEMP%\Cab27.tmp
%TEMP%\Cab29.tmp
%TEMP%\Cab2B.tmp
%TEMP%\Cab2D.tmp
%TEMP%\Cab2F.tmp
%TEMP%\Cab31.tmp
%TEMP%\Cab33.tmp
%TEMP%\Cab35.tmp
%TEMP%\Cab37.tmp
%TEMP%\NS-485O1.tmp\UPD\vpn86.cab
%TEMP%\NS-485O1.tmp\_iscrypt.dll
%TEMP%\Cab39.tmp
%TEMP%\Cab3F.tmp
%TEMP%\Cab41.tmp
%TEMP%\Cab43.tmp
%TEMP%\Cab45.tmp
%TEMP%\Cab47.tmp
%TEMP%\Cab49.tmp
%TEMP%\Cab4B.tmp
%TEMP%\Cab4D.tmp
%TEMP%\NS-TPF65.tmp\NS-BQCMH.tmp
%TEMP%\Cab4F.tmp
%TEMP%\Cab51.tmp
%TEMP%\Cab3B.tmp
%TEMP%\Cab3D.tmp
%TEMP%\NS-485O1.tmp\UPD\vpn64.cab
%TEMP%\NS-485O1.tmp\UPD\updatecache.bat
%TEMP%\NS-485O1.tmp\UPD\tv_x64.exe
%TEMP%\Cab5.tmp
%TEMP%\Cab7.tmp
%TEMP%\Cab9.tmp
%TEMP%\CabB.tmp
%TEMP%\CabD.tmp
%TEMP%\CabF.tmp
%TEMP%\Cab11.tmp
%TEMP%\Cab13.tmp
%TEMP%\Cab15.tmp
%TEMP%\Cab17.tmp
%TEMP%\Cab19.tmp
%TEMP%\Cab1B.tmp
%TEMP%\Cab3.tmp
%TEMP%\Cab1D.tmp
%TEMP%\Cab21.tmp
%TEMP%\Cab23.tmp
%TEMP%\NS-485O1.tmp\UPD\msimg32.dll
%TEMP%\NS-485O1.tmp\UPD\pp2.pdf
%TEMP%\NS-485O1.tmp\UPD\SkypeC0SvcService.exe
%TEMP%\NS-485O1.tmp\UPD\TeamViewer_Desktop.exe
%TEMP%\NS-485O1.tmp\UPD\TeamViewer_Resource_en.dll
%TEMP%\NS-485O1.tmp\UPD\TeamViewer_StaticRes.dll
%TEMP%\NS-485O1.tmp\UPD\tvr.cfg
%TEMP%\NS-485O1.tmp\UPD\tv_w32.dll
%TEMP%\NS-485O1.tmp\UPD\tv_w32.exe
%TEMP%\NS-485O1.tmp\UPD\tv_x64.dll
%TEMP%\Cab1F.tmp
%TEMP%\Cab53.tmp
%TEMP%\Cab55.tmp

Moves the following files:

from %TEMP%\NS-485O1.tmp\UPD\NS-N5M12.tmp to %TEMP%\NS-485O1.tmp\UPD\msimg32.dll
from %TEMP%\NS-485O1.tmp\UPD\NS-GLGQG.tmp to %TEMP%\NS-485O1.tmp\UPD\SkypeC0SvcService.exe
from %TEMP%\NS-485O1.tmp\UPD\NS-G6DMS.tmp to %TEMP%\NS-485O1.tmp\UPD\TeamViewer_Desktop.exe
from %TEMP%\NS-485O1.tmp\UPD\NS-M8ON2.tmp to %TEMP%\NS-485O1.tmp\UPD\TeamViewer_Resource_en.dll
from %TEMP%\NS-485O1.tmp\UPD\NS-FJSJ6.tmp to %TEMP%\NS-485O1.tmp\UPD\TeamViewer_StaticRes.dll
from %TEMP%\NS-485O1.tmp\UPD\NS-HBO82.tmp to %TEMP%\NS-485O1.tmp\UPD\tvr.cfg
from %TEMP%\NS-485O1.tmp\UPD\NS-TKJPM.tmp to %TEMP%\NS-485O1.tmp\UPD\tv_w32.dll
from %TEMP%\NS-485O1.tmp\UPD\NS-R9S03.tmp to %TEMP%\NS-485O1.tmp\UPD\tv_w32.exe
from %TEMP%\NS-485O1.tmp\UPD\NS-1N57C.tmp to %TEMP%\NS-485O1.tmp\UPD\tv_x64.dll
from %TEMP%\NS-485O1.tmp\UPD\NS-NNSG0.tmp to %TEMP%\NS-485O1.tmp\UPD\tv_x64.exe
from %TEMP%\NS-485O1.tmp\UPD\NS-4V6GE.tmp to %TEMP%\NS-485O1.tmp\UPD\updatecache.bat
from %TEMP%\NS-485O1.tmp\UPD\NS-1JCSS.tmp to %TEMP%\NS-485O1.tmp\UPD\vpn64.cab
from %TEMP%\NS-485O1.tmp\UPD\NS-NOQEC.tmp to %TEMP%\NS-485O1.tmp\UPD\vpn86.cab
from %TEMP%\NS-485O1.tmp\UPD\NS-UHA63.tmp to %TEMP%\NS-485O1.tmp\UPD\pp2.pdf

Network activity:

Connects to:

'wp#d':80
'download.windowsupdate.com':80
'pi###.#eamviewer.com':5938
'pi###.#eamviewer.com':443
'pi###.#eamviewer.com':80
'ma#####6.teamviewer.com':80
'ma#####.teamviewer.com':80
'ma#####2.teamviewer.com':80

TCP:

HTTP GET requests:

http://11#.#11.111.1/wpad.dat via wp#d
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt via download.windowsupdate.com
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab via download.windowsupdate.com
http://pi###.#eamviewer.com/din.aspx?s=#####################################################
http://ma#####6.teamviewer.com/din.aspx?s=#####################################################
http://pi###.#eamviewer.com/din.aspx?s=####################################################
http://ma#####.teamviewer.com/din.aspx?s=#####################################################
http://ma#####.teamviewer.com/din.aspx?s=####################################################
http://ma#####2.teamviewer.com/din.aspx?s=#####################################################
http://ma#####2.teamviewer.com/din.aspx?s=####################################################

UDP:

DNS ASK wp#d
DNS ASK www.download.windowsupdate.com
DNS ASK pi###.#eamviewer.com
DNS ASK ma#####6.teamviewer.com
DNS ASK ma#####.teamviewer.com
DNS ASK ma#####0.teamviewer.com
DNS ASK ma#####1.teamviewer.com
DNS ASK ma#####2.teamviewer.com
DNS ASK ma#####3.teamviewer.com
DNS ASK ma#####4.teamviewer.com
DNS ASK ma#####5.teamviewer.com

Miscellaneous:

Creates and executes the following:

'%TEMP%\NS-TPF65.tmp\NS-BQCMH.tmp' /SL4 $30092 <Full path to file> 3570186 61952 /password=Windows /verysilent
'%APPDATA%\LocalDataNT\SkypeC0SvcService.exe'

Executes the following:

'<SYSTEM32>\cmd.exe' /C ""%TEMP%\NS-485O1.tmp\UPD\updatecache.bat""
'<SYSTEM32>\xcopy.exe' /Y /I "%TEMP%\NS-485O1.tmp\UPD\*" "%APPDATA%\LocalDataNT\"
'<SYSTEM32>\rundll32.exe' <SYSTEM32>\shell32.dll,OpenAs_RunDLL %APPDATA%\LocalDataNT\pp2.pdf
'<SYSTEM32>\svchost.exe' -k "MsHubSvc4" -svcr "SkypeC0SvcService.exe"

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней