Trojan.InstallCore.2676

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'DAEMON Tools Lite Automount' = '"%ProgramFiles%\DAEMON Tools Lite\DTAgent.exe" -autorun'

Modifies file system

Creates the following files

%TEMP%\rarsfx0\crack64.exe
%ProgramFiles%\daemon tools lite\lang\cht.dll
%ProgramFiles%\daemon tools lite\lang\chs.dll
%ProgramFiles%\daemon tools lite\lang\bih.dll
%ProgramFiles%\daemon tools lite\lang\bgr.dll
%ProgramFiles%\daemon tools lite\uninst.exe
%ProgramFiles%\daemon tools lite\plugins\grabbers\tages.dll
%ProgramFiles%\daemon tools lite\plugins\grabbers\gensub.dll
%ProgramFiles%\daemon tools lite\plugins\grabbers\gendpm.dll
%ProgramFiles%\daemon tools lite\plugins\grabbers\safedisc.dll
%ProgramFiles%\daemon tools lite\lang\deu.dll
%ProgramFiles%\daemon tools lite\lang\csy.dll
%ProgramFiles%\daemon tools lite\extractor.exe
%ProgramFiles%\daemon tools lite\dtlitehelper.exe
%ProgramFiles%\daemon tools lite\dotnetcommon.dll
%ProgramFiles%\daemon tools lite\dtlite.exe
%ProgramFiles%\daemon tools lite\sptdintf.dll
%ProgramFiles%\daemon tools lite\discsoftbusservicelite.exe
%ProgramFiles%\daemon tools lite\imgengine.dll
%ProgramFiles%\daemon tools lite\dthelper.exe
%ProgramFiles%\daemon tools lite\vdrivelib.dll
%ProgramFiles%\daemon tools lite\plugins\grabbers\gendisc.dll
%TEMP%\nsz2ba3.tmp\lang\srl.dll
%ProgramFiles%\daemon tools lite\lang\enu.dll
%TEMP%\{361e1ec0-9a65-16ce-0c69-cd06fb18772a}\setc8e9.tmp
%ProgramFiles%\daemon tools lite\dtlitescsibus.cat
%ProgramFiles%\daemon tools lite\dtlitescsibus.inf
%ProgramFiles%\daemon tools lite\dtlitescsibus.sys
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\daemon tools lite\daemon tools lite.lnk
C:\users\public\desktop\daemon tools lite.lnk
%ProgramFiles%\daemon tools lite\lang\ukr.dll
%ProgramFiles%\daemon tools lite\lang\trk.dll
%ProgramFiles%\daemon tools lite\lang\sve.dll
%ProgramFiles%\daemon tools lite\lang\srl.dll
%ProgramFiles%\daemon tools lite\lang\rus.dll
%ProgramFiles%\daemon tools lite\lang\ptb.dll
%ProgramFiles%\daemon tools lite\lang\plk.dll
%ProgramFiles%\daemon tools lite\lang\jpn.dll
%ProgramFiles%\daemon tools lite\lang\ita.dll
%ProgramFiles%\daemon tools lite\lang\ind.dll
%ProgramFiles%\daemon tools lite\lang\hye.dll
%ProgramFiles%\daemon tools lite\lang\hun.dll
%ProgramFiles%\daemon tools lite\lang\heb.dll
%ProgramFiles%\daemon tools lite\lang\fra.dll
%ProgramFiles%\daemon tools lite\lang\fin.dll
%ProgramFiles%\daemon tools lite\sptdinst-x64.exe
%ProgramFiles%\daemon tools lite\profiles.ini
%ProgramFiles%\daemon tools lite\dtcommonres.dll
%ProgramFiles%\daemon tools lite\engine.dll
%ProgramFiles%\daemon tools lite\dtlauncher.exe
%TEMP%\nsz2ba3.tmp\lang\enu.dll
%TEMP%\nsz2ba3.tmp\lang\jpn.dll
%TEMP%\nsz2ba3.tmp\lang\ita.dll
%TEMP%\nsz2ba3.tmp\lang\ind.dll
%TEMP%\nsz2ba3.tmp\lang\hye.dll
%TEMP%\nsz2ba3.tmp\lang\hun.dll
%TEMP%\nsz2ba3.tmp\lang\heb.dll
%TEMP%\nsz2ba3.tmp\lang\fra.dll
%TEMP%\nsz2ba3.tmp\lang\fin.dll
%TEMP%\nsz2ba3.tmp\lang\esn.dll
%TEMP%\nsz2ba3.tmp\lang\deu.dll
%TEMP%\nsz2ba3.tmp\lang\ptb.dll
%TEMP%\nsz2ba3.tmp\lang\csy.dll
%TEMP%\nsz2ba3.tmp\lang\cht.dll
%TEMP%\nsz2ba3.tmp\lang\chs.dll
%TEMP%\nsz2ba3.tmp\lang\bih.dll
%TEMP%\nsz2ba3.tmp\lang\bgr.dll
%TEMP%\nsk2b93.tmp
%TEMP%\rarsfx0\install.bat
%TEMP%\rarsfx0\daemon-tools-lite.exe
%TEMP%\rarsfx0\crackx86.exe
%TEMP%\{361e1ec0-9a65-16ce-0c69-cd06fb18772a}\setc977.tmp
%ProgramFiles%\daemon tools lite\lang\esn.dll
%TEMP%\nsz2ba3.tmp\lang\rus.dll
%TEMP%\nsz2ba3.tmp\lang\trk.dll
%TEMP%\nsz2ba3.tmp\lang\plk.dll
%ProgramFiles%\daemon tools lite\dtagent.exe
%TEMP%\nsz2ba3.tmp\fusion.dll
%ALLUSERSPROFILE%\daemon tools lite\license.dat
%TEMP%\nsz2ba3.tmp\setuphlp.dll
%TEMP%\nsz2ba3.tmp\setupwaitpage.bmp
%TEMP%\nsz2ba3.tmp\waitpage.ini
%TEMP%\nsz2ba3.tmp\daemonwizard.bmp
%TEMP%\nsz2ba3.tmp\license.bmp
%TEMP%\nsz2ba3.tmp\setuphelper.exe
%TEMP%\nsz2ba3.tmp\dtsetuphelper.exe
%TEMP%\nsz2ba3.tmp\sptdintf.dll
%TEMP%\nsz2ba3.tmp\license.rtf
%TEMP%\nsz2ba3.tmp\regpagetrialinfo.ini
%TEMP%\nsz2ba3.tmp\regpageemail.ini
%TEMP%\nsz2ba3.tmp\regpagepaidinfo.ini
%TEMP%\nsz2ba3.tmp\regpagetypelite.ini
%TEMP%\nsz2ba3.tmp\regpagetype.ini
%TEMP%\nsz2ba3.tmp\reinstpage.ini
%TEMP%\nsz2ba3.tmp\system.dll
%TEMP%\nsz2ba3.tmp\lang\ukr.dll
%TEMP%\nsz2ba3.tmp\lang\sve.dll
%TEMP%\{361e1ec0-9a65-16ce-0c69-cd06fb18772a}\setca33.tmp

Moves the following files

from %TEMP%\{361e1ec0-9a65-16ce-0c69-cd06fb18772a}\setc8e9.tmp to %TEMP%\{361e1ec0-9a65-16ce-0c69-cd06fb18772a}\dtlitescsibus.cat
from %TEMP%\{361e1ec0-9a65-16ce-0c69-cd06fb18772a}\setc977.tmp to %TEMP%\{361e1ec0-9a65-16ce-0c69-cd06fb18772a}\dtlitescsibus.inf
from %TEMP%\{361e1ec0-9a65-16ce-0c69-cd06fb18772a}\setca33.tmp to %TEMP%\{361e1ec0-9a65-16ce-0c69-cd06fb18772a}\dtlitescsibus.sys

Network activity

Connects to

'go#####a###ytics.com':80

TCP

HTTP GET requests

http://www.go#####a###ytics.com/collect?v=#################################################################################################################################################

UDP