Trojan.DownLoader25.53664

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run] 'UserinitWindows' = '%WINDIR%\svshost.exe'

Malicious functions:

Creates and executes the following:

'%APPDATA%\satup.exe'
'%TEMP%\_ir_sf_temp_2\irsetup.exe' __IRAOFF:1811714 "__IRAFN:%APPDATA%\visual32.exe" "__IRCT:3" "__IRTSS:0" "__IRSID:S-1-5-21-2052111302-484763869-725345543-1003"
'%APPDATA%\visual32.exe'
'%APPDATA%\dirlibr.exe'
'%WINDIR%\atribut.exe'
'%WINDIR%\delete.exe'
'%APPDATA%\x64.exe'
'<Current directory>\LAUNCHERgame.exe'
'<Current directory>\game.exe'
'%TEMP%\_ir_sf_temp_0\irsetup.exe' __IRAOFF:2328322 "__IRAFN:<Full path to file>" "__IRCT:3" "__IRTSS:0" "__IRSID:S-1-5-21-2052111302-484763869-725345543-1003"
'%APPDATA%\delete.exe'
'%TEMP%\_ir_sf_temp_1\irsetup.exe' __IRAOFF:1811714 "__IRAFN:%APPDATA%\game_launcher.exe" "__IRCT:3" "__IRTSS:0" "__IRSID:S-1-5-21-2052111302-484763869-725345543-1003"
'%APPDATA%\game_launcher.exe'

Executes the following:

'<SYSTEM32>\netsh.exe' advfirewall firewall delete rule name="Blockit"
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\4.tmp\5.bat" "%APPDATA%\dirlibr.exe""
'<SYSTEM32>\cmd.exe' /k ping -n 2 localhost < nul & del /F /Q "%WINDIR%\delete.exe"
'<SYSTEM32>\cmd.exe' /k ping -n 2 localhost < nul & del /F /Q "%APPDATA%\delete.exe"
'<SYSTEM32>\ping.exe' -n 2 localhost
'<SYSTEM32>\cmd.exe' /k ping -n 2 localhost < nul & del /F /Q "<Current directory>\game.exe"
'<SYSTEM32>\attrib.exe' +s +h "delete.exe"
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\1.tmp\2.bat" %WINDIR%\atribut.exe"

Modifies file system:

Creates the following files:

%TEMP%\_ir_sf_temp_2\irsetup.dat
%TEMP%\_ir_sf_temp_2\lua5.1.dll
%TEMP%\_ir_sf_temp_2\IRIMG1.JPG
%TEMP%\_ir_sf_temp_2\jelf.ico
%TEMP%\_ir_sf_temp_2\IRIMG2.JPG
%HOMEPATH%\Start Menu\Programs\Adobe Acrobat Reader\x64.lnk
%APPDATA%\satup.exe
%HOMEPATH%\Start Menu\Programs\Adobe Acrobat Reader\delete.lnk
%TEMP%\_ir_sf_temp_2\irsetup.exe
%HOMEPATH%\Start Menu\Programs\Adobe Acrobat Reader\NewProduct 1.00 Installation .lnk
%WINDIR%\atribut.exe
%TEMP%\$inst\temp_0.tmp
%TEMP%\$inst\2.tmp
%APPDATA%\dirlibr.exe
%TEMP%\4.tmp\5.bat
%APPDATA%\ips.txt
%WINDIR%\svshost.exe
%WINDIR%\delete.exe
%HOMEPATH%\Start Menu\Programs\Adobe Acrobat Reader\atribut.lnk
%TEMP%\1.tmp\2.bat
%HOMEPATH%\Start Menu\Programs\Adobe Acrobat Reader\NT Kernel & System.lnk
<Current directory>\game.exe
%APPDATA%\game_launcher.exe
<Current directory>\LAUNCHERgame.exe
%HOMEPATH%\Start Menu\Programs\Adobe Acrobat Reader\game.lnk
%HOMEPATH%\Start Menu\Programs\Adobe Acrobat Reader\Force Borce Good Adobe.lnk
%TEMP%\_ir_sf_temp_0\lua5.1.dll
%TEMP%\_ir_sf_temp_0\irsetup.exe
%TEMP%\_ir_sf_temp_0\irsetup.dat
%TEMP%\_ir_sf_temp_0\IRIMG2.JPG
%TEMP%\_ir_sf_temp_0\IRIMG1.JPG
%HOMEPATH%\Start Menu\Programs\Adobe Acrobat Reader\LAUNCHERgame.lnk
%APPDATA%\visual32.exe
%TEMP%\_ir_sf_temp_1\jelf.ico
%APPDATA%\visual64.exe
%APPDATA%\delete.exe
%APPDATA%\x64.exe
%TEMP%\_ir_sf_temp_1\lua5.1.dll
%TEMP%\_ir_sf_temp_1\irsetup.exe
%TEMP%\_ir_sf_temp_1\irsetup.dat
%TEMP%\_ir_sf_temp_1\IRIMG2.JPG
%TEMP%\_ir_sf_temp_1\IRIMG1.JPG