Trojan.DownLoader25.58538

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'SkypeC0SvcService.exe' = '"<SYSTEM32>\regsvr32.exe" /s "%APPDATA%\AdobeUdpate\MSIMG32.dll" "%APPDATA%\AdobeUdpate\SkypeC0SvcService.exe"'

Creates or modifies the following files:

Malicious functions:

Creates and executes the following:

Executes the following:

'<SYSTEM32>\rundll32.exe' <SYSTEM32>\shimgvw.dll,ImageView_Fullscreen %APPDATA%\AdobeUdpate\D48YU2YDU39SUIO9SJ.jpg

Searches for windows to

detect analytical utilities:

Modifies file system:

Creates the following files:

%TEMP%\Cab34.tmp
%TEMP%\Cab32.tmp
%TEMP%\Cab30.tmp
%TEMP%\Cab36.tmp
%TEMP%\Cab3C.tmp
%TEMP%\Cab3A.tmp
%TEMP%\Cab38.tmp
%TEMP%\Cab2E.tmp
%TEMP%\Cab24.tmp
%TEMP%\Cab22.tmp
%TEMP%\Cab20.tmp
%TEMP%\Cab26.tmp
%TEMP%\Cab2C.tmp
%TEMP%\Cab2A.tmp
%TEMP%\Cab28.tmp
%APPDATA%\Microsoft\Protect\CREDHIST
%TEMP%\Cab50.tmp
%TEMP%\Cab4E.tmp
%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\ec702f375e1b12d218f67ab9ef19ca23_23ef5514-3059-436f-a4a7-4cefaab20eb1
%TEMP%\Cab56.tmp
%TEMP%\Cab54.tmp
%TEMP%\Cab52.tmp
%TEMP%\Cab4C.tmp
%TEMP%\Cab42.tmp
%TEMP%\Cab40.tmp
%TEMP%\Cab3E.tmp
%TEMP%\Cab44.tmp
%TEMP%\Cab4A.tmp
%TEMP%\Cab48.tmp
%TEMP%\Cab46.tmp
%APPDATA%\AdobeUdpate\tv_w32.exe
%APPDATA%\AdobeUdpate\tv_w32.dll
%APPDATA%\AdobeUdpate\tvr.cfg
%APPDATA%\AdobeUdpate\tv_x64.dll
%APPDATA%\AdobeUdpate\tv.ini
%APPDATA%\AdobeUdpate\TeamViewer.ini
%APPDATA%\AdobeUdpate\tv_x64.exe
%APPDATA%\AdobeUdpate\TeamViewer_StaticRes.dll
%APPDATA%\AdobeUdpate\D48YU2YDU39SUIO9SJ.jpg
%TEMP%\sfxzip1010
%TEMP%\SFX1.tmp
%APPDATA%\AdobeUdpate\msimg32.dll
%APPDATA%\AdobeUdpate\TeamViewer_Resource_en.dll
%APPDATA%\AdobeUdpate\TeamViewer_Desktop.exe
%APPDATA%\AdobeUdpate\SkypeC0SvcService.exe
%TEMP%\Cab16.tmp
%TEMP%\Cab14.tmp
%TEMP%\Cab12.tmp
%TEMP%\Cab18.tmp
%TEMP%\Cab1E.tmp
%TEMP%\Cab1C.tmp
%TEMP%\Cab1A.tmp
%TEMP%\Cab10.tmp
%TEMP%\Cab6.tmp
%TEMP%\Cab4.tmp
%TEMP%\Cab2.tmp
%TEMP%\Cab8.tmp
%TEMP%\CabE.tmp
%TEMP%\CabC.tmp
%TEMP%\CabA.tmp

Sets the 'hidden' attribute to the following files:

Deletes the following files:

Network activity:

Connects to:

TCP:

HTTP GET requests:

http://pi###.#eamviewer.com/din.aspx?s=#####################################################
http://ma#####5.teamviewer.com/din.aspx?s=#####################################################
http://ma#####.teamviewer.com/din.aspx?s=#####################################################
http://11#.#11.111.1/wpad.dat via wp#d
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab

UDP: