Trojan.DownLoader32.60826

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'searchMessenger' = 'C:\sMessenger\searchMessenger.exe'

Creates or modifies the following files

%APPDATA%\microsoft\windows\start menu\programs\startup\yesformoffice_auto_update.exe

Modifies file system

Creates the following files

%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
C:\smessenger\update\searchmessenger.exe
C:\smessenger\update\searchmessenger_upgrade.exe
C:\smessenger\update\searchmessenger_uninstall.exe
C:\smessenger\update\searchmessenger_ulist.dta
%LOCALAPPDATA%low\microsoft\internet explorer\services\search_{1fe67845-4ed4-47b9-cb29-2e3363d9b8e6}.ico
%APPDATA%\yesform\yesform.ico
%HOMEPATH%\favorites\예스폼 - 문서서식.url
%LOCALAPPDATA%low\microsoft\internet explorer\services\search_{b1a7197f-acc3-54ba-2661-43feeb408097}.ico
C:\smessenger\searchmessenger.pid
%APPDATA%\thinkzon\thinkzon.ico
%HOMEPATH%\favorites\씽크존 - 지식거래.url
%HOMEPATH%\favorites\links\씽크존 - 지식거래.url
C:\smessenger\update\yesformoffice_auto_update.exe
C:\smessenger\예스폼 문서메신저.lnk
%PROGRAMDATA%\microsoft\windows\start menu\programs\예스폼 문서메신저\예스폼 문서메신저.lnk
%PROGRAMDATA%\microsoft\windows\start menu\programs\예스폼 문서메신저\예스폼 문서메신저 삭제.lnk
C:\smessenger\update\searchmessenger_tray.ico
%HOMEPATH%\favorites\links\예스폼 - 문서서식.url
C:\smessenger\searchmessenger_update.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\aevn8rsx\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
%LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
%LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\e6vxzxlu\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\ryiba9p9\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\dzpye8pq\desktop.ini
%APPDATA%\microsoft\windows\cookies\low\index.dat
C:\smessenger\searchmessenger_upchk.txt
%LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\index.dat
<Current directory>\searchmessenger_netchk.txt
C:\smessenger\searchmessenger_ulist.dta
<Current directory>\searchmessenger.pid
<Current directory>\searchmessenger.ini
C:\smessenger\update\searchmessenger_update.ini
C:\smessenger\searchmessenger_upgrade.exe
C:\smessenger\update\searchmessenger.ico
C:\smessenger\searchmessenger.ini

Sets the 'hidden' attribute to the following files

%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\e6vxzxlu\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\ryiba9p9\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\dzpye8pq\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\aevn8rsx\desktop.ini
%LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
%LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
C:\smessenger\searchmessenger_ulist.dta

Deletes the following files

<Current directory>\searchmessenger_netchk.txt
C:\smessenger\update\searchmessenger_update.ini
C:\smessenger\searchmessenger_ulist.dta
C:\smessenger\update\yesformoffice_auto_update.exe
C:\smessenger\searchmessenger_upgrade.exe

Moves the following files

from C:\smessenger\update\searchmessenger.ico to C:\smessenger\searchmessenger.ico
from C:\smessenger\update\searchmessenger_tray.ico to C:\smessenger\searchmessenger_tray.ico
from C:\smessenger\update\searchmessenger.exe to C:\smessenger\searchmessenger.exe
from C:\smessenger\update\searchmessenger_uninstall.exe to C:\smessenger\searchmessenger_uninstall.exe

Substitutes the following files

<Current directory>\searchmessenger_netchk.txt
C:\smessenger\update\searchmessenger_update.ini
C:\smessenger\searchmessenger_ulist.dta
C:\smessenger\searchmessenger_upgrade.exe

Network activity

TCP

HTTP GET requests

http://wu#####e.yesform.com/active/searchMessenger/update2/searchMessenger_update.ini
http://wu#####e.yesform.com/active/searchMessenger/update2/searchMessenger_ulist.dta
http://wu######check.yesform.com/active/searchMessenger/update_check.php?n=###############
http://wu#####e.yesform.com/active/searchMessenger/update2/searchMessenger_upgrade.exe
http://wu#####e.yesform.com/active/searchMessenger/update2/searchMessenger.ico
http://wu#####e.yesform.com/active/searchMessenger/update2/searchMessenger_tray.ico
http://wu#####e.yesform.com/active/searchMessenger/update2/searchMessenger.exe
http://wu#####e.yesform.com/active/searchMessenger/update2/searchMessenger_uninstall.exe
http://www.ye##orm.com/favicon.ico
http://www.th###zon.com/favicon.ico
http://wi####.yesform.com/yesform_office/upgrade/yesformoffice_auto_update.exe