Trojan.DownLoader5.47022

Malicious functions

Searches for windows to

detect analytical utilities:

ClassName: 'OLLYDBG', WindowName: ''
ClassName: 'GBDYLLO', WindowName: ''
ClassName: 'pediy06', WindowName: ''
ClassName: 'FilemonClass', WindowName: ''
ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
ClassName: 'RegmonClass', WindowName: ''
ClassName: '', WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'

Modifies settings of Windows Internet Explorer

[<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1C00' = '{00,00,00,00}'
[<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] 'CurrentLevel' = '{00,00,00,00}'
[<HKCU>\Software\Microsoft\windows\CurrentVersion\Internet Settings] 'ProxyEnable' = '00000001'
[<HKCU>\Software\Microsoft\windows\CurrentVersion\Internet Settings] 'ProxyServer' = '127.0.0.1:9666'
[<HKCU>\Software\Microsoft\windows\CurrentVersion\Internet Settings] 'ProxyOverride' = '127.0.0.1'

Modifies file system

Creates the following files

%TEMP%\u1103.exe
%LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\index.dat
%APPDATA%\microsoft\windows\cookies\low\index.dat
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\00scw2ke\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\1zn2q6qo\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\4mbm2whn\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\hckc2o82\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
%LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
%LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
%TEMP%\utmp\~nubwuutlpty5i4e
%TEMP%\utmp\~khdfhpjkijd5f5s
%TEMP%\utmp\~hflxfzwacwz6j5n
%TEMP%\utmp\~mmozijiehic6c3x
%HOMEPATH%\putty.rnd
%TEMP%\utmp\~faadlfxgixa5m7h

Sets the 'hidden' attribute to the following files

%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\hckc2o82\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\4mbm2whn\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\1zn2q6qo\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\00scw2ke\desktop.ini
%LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
%LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini

Network activity

TCP

HTTP GET requests

http://www.google.com/
http://17#.#17.168.196/gwt/n?u=####################################################################################
http://go##le.by/gwt/n?u=####################################
http://17#.#17.17.36/gwt/n?u=################################################################################
http://17#.#17.17.132/gwt/n?u=#############################################################################
http://17#.#17.168.196/gwt/n?u=#####################################################################
http://21#.#8.211.99/gwt/n?u=############################################################################
http://17#.#17.17.35/gwt/n?u=###########################################################################

'sm##.gmail.com':587

's3.###zonaws.com':443

'ib#.com':443

'localhost':9999

UDP