Trojan.DownLoader25.55165

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'PPLiveVA' = '%ProgramFiles%\PPLiveVA\PPLiveVA.exe /LoadModule PPVA.DLL /M REAL /S 0 /T 0'

Malicious functions:

To bypass firewall, removes or modifies the following registry keys:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%ProgramFiles%\PPLiveVA\PPLiveVA.exe' = '%ProgramFiles%\PPLiveVA\PPLiv...

Creates and executes the following:

'%ProgramFiles%\PPLiveVA\PPLiveVA.exe' /LoadModule ProductUpdateVA.DLL
'%ProgramFiles%\PPLiveVA\PPLiveVAMonitor.exe' "DefaultConnectionSettings" "none" "9" "SavedLegacySettings" "none" "9" 3140
'%TEMP%\nsr2.tmp\ns3.tmp' netsh firewall add allowedprogram "%ProgramFiles%\PPLiveVA\PPLiveVA.exe" PPLiveVA Enable
'%ProgramFiles%\PPLiveVA\PPLiveVA.exe'

Executes the following:

'<SYSTEM32>\netsh.exe' firewall add allowedprogram "%ProgramFiles%\PPLiveVA\PPLiveVA.exe" PPLiveVA Enable

Modifies file system:

Creates the following files:

%TEMP%\nsr2.tmp\PPVA.INI
%ProgramFiles%\PPLiveVA\PPLiveVA.ico
%TEMP%\nsr2.tmp\PPLiveVA.ico
<LS_APPDATA>\VirtualStore\ProgramData\PPLiveVA\PPVA.INI
<LS_APPDATA>\VirtualStore\ProgramData\PPLiveVA\Language\CH.INI
%TEMP%\nsr2.tmp\CH.INI
%ALLUSERSPROFILE%\Application Data\PPLiveVA\PPVA.INI
%ProgramFiles%\PPLiveVA\ppvaActiveX.ocx
%TEMP%\nsr2.tmp\ppvaActiveX.ocx
%ProgramFiles%\PPLiveVA\ProductUpdateVA.dll
%TEMP%\nsr2.tmp\FWUpnp.dll
%ProgramFiles%\PPLiveVA\PP.tv.ico
%TEMP%\nsr2.tmp\PP.tv.ico
%ProgramFiles%\PPLiveVA\FWUpnp.dll
%TEMP%\nsr2.tmp\EN.INI
%TEMP%\nsr2.tmp\cmpver.dll
%TEMP%\nsr2.tmp\ns3.tmp
%TEMP%\nsr2.tmp\nsExec.dll
%ProgramFiles%\PPLiveVA\uninst.exe
%ALLUSERSPROFILE%\Application Data\PPLiveVA\LogFile.txt
%ALLUSERSPROFILE%\Application Data\PPLiveVA\ppvaconfig.ini
%ALLUSERSPROFILE%\Application Data\PPLiveVA\resconfig\ResourceInfo.dat
%ALLUSERSPROFILE%\Application Data\PPLiveVA\Language\EN.INI
%ALLUSERSPROFILE%\Application Data\PPLiveVA\Language\CH.INI
<LS_APPDATA>\VirtualStore\ProgramData\PPLiveVA\Language\EN.INI
%ALLUSERSPROFILE%\Start Menu\Programs\PPLive\PP.tv.lnk
%ProgramFiles%\PPLiveVA\PPLiveVA.url
%ALLUSERSPROFILE%\Start Menu\Programs\PPLive\PPLiveVA.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\PPLive\Uninstall PPLiveVA.lnk
%ProgramFiles%\PPLiveVA\MngModule.dll
%TEMP%\nsr2.tmp\MngModule.dll
%ProgramFiles%\PPLiveVA\PPLiveVAMonitor.exe
%TEMP%\nsr2.tmp\NetTools.dll
%ProgramFiles%\PPLiveVA\peer.dll
%TEMP%\nsr2.tmp\peer.dll
%ProgramFiles%\PPLiveVA\NetTools.dll
%TEMP%\nsr2.tmp\SynaLiveSetupRelat.ini
%TEMP%\nsr2.tmp\FindProcDLL.dll
%TEMP%\nsr2.tmp\System.dll
%TEMP%\nsr2.tmp\AdditionalTask.ini
%TEMP%\nsr2.tmp\PPLiveVAMonitor.exe
%TEMP%\nsr2.tmp\recommend.ini
%TEMP%\nsr2.tmp\category.ini
%TEMP%\nsr2.tmp\PPLiveVA.exe
%TEMP%\nsr2.tmp\DownloaderManager.dll
%ProgramFiles%\PPLiveVA\DownloadProgress.exe
%TEMP%\nsr2.tmp\DownloadProgress.exe
%ProgramFiles%\PPLiveVA\DownloaderManager.dll
%TEMP%\nsr2.tmp\ProductUpdateVA.dll
%ProgramFiles%\PPLiveVA\VAProxyD.dll
%TEMP%\nsr2.tmp\VAProxyD.dll
%ProgramFiles%\PPLiveVA\PPVA.dll
%TEMP%\nsr2.tmp\PPVA.dll
%ProgramFiles%\PPLiveVA\PPLiveVA.exe
%TEMP%\nsr2.tmp\CrashUpload.exe
%ProgramFiles%\PPLiveVA\Download.exe
%TEMP%\nsr2.tmp\Download.exe
%ProgramFiles%\PPLiveVA\CrashUpload.exe

Deletes the following files:

%TEMP%\nsr2.tmp\PPLiveVA.ico
%TEMP%\nsr2.tmp\PPLiveVAMonitor.exe
%TEMP%\nsr2.tmp\PPVA.dll
%TEMP%\nsr2.tmp\PPLiveVA.exe
%TEMP%\nsr2.tmp\nsExec.dll
%TEMP%\nsr2.tmp\peer.dll
%TEMP%\nsr2.tmp\PP.tv.ico
%TEMP%\nsr2.tmp\SynaLiveSetupRelat.ini
%TEMP%\nsr2.tmp\System.dll
%TEMP%\nsr2.tmp\VAProxyD.dll
%TEMP%\nsr2.tmp\recommend.ini
%TEMP%\nsr2.tmp\PPVA.INI
%TEMP%\nsr2.tmp\ppvaActiveX.ocx
%TEMP%\nsr2.tmp\ProductUpdateVA.dll
%TEMP%\nsr2.tmp\cmpver.dll
%TEMP%\nsr2.tmp\CrashUpload.exe
%TEMP%\nsr2.tmp\Download.exe
%TEMP%\nsr2.tmp\CH.INI
%TEMP%\nsr2.tmp\ns3.tmp
%TEMP%\nsr2.tmp\AdditionalTask.ini
%TEMP%\nsr2.tmp\category.ini
%TEMP%\nsr2.tmp\FWUpnp.dll
%TEMP%\nsr2.tmp\MngModule.dll
%TEMP%\nsr2.tmp\NetTools.dll
%TEMP%\nsr2.tmp\FindProcDLL.dll
%TEMP%\nsr2.tmp\DownloaderManager.dll
%TEMP%\nsr2.tmp\DownloadProgress.exe
%TEMP%\nsr2.tmp\EN.INI

Network activity:

Connects to:

'<L###LNET>.0.2':80
'pp#####ate.pplive.com':80
'p.##d.net':80
'pp#######va.datamaster.com.cn':80

TCP:

HTTP GET requests:

http://p2.pplive.com/http_time.dll via <L###LNET>.0.2
http://pp#####ate.pplive.com/ppva/self/all/self_all.ini
http://p.##d.net/1.html?xt#######################################################################################################################################################################...
http://pp#######va.datamaster.com.cn/_ppva.gif?sq########################################################################################################################

UDP: