Trojan.DownLoader27.15288

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'JL' = '<Current directory>\SFISKernel.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'JL1' = '<Current directory>\SFISKernelS.exe'

Modifies file system:

Creates the following files:

<Current directory>\b662ef4l.exe
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\pc[7].aspx
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\pc[7].aspx
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\pc[8].aspx
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\pc[8].aspx
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\pc[8].aspx
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\pc[8].aspx
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\pc[9].aspx
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\pc[9].aspx
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\pc[9].aspx
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\pc[9].aspx
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\pc[3].aspx
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\pc[10].aspx
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\pc[10].aspx
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\pc[10].aspx
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\pc[11].aspx
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\pc[11].aspx
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\pc[11].aspx
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\pc[11].aspx
<Current directory>\domain.txt
%TEMP%\tmp1.tmp
%TEMP%\tmp2.tmp
<SYSTEM32>\wbem\AutoRecover\C8463ECBE33BC240263A0B094E46D510.mof
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\pc[7].aspx
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\pc[7].aspx
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\pc[6].aspx
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\pc[6].aspx
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\pc[6].aspx
<Current directory>\softwarelist.bat
<Current directory>\list.txt
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\pc[1].aspx
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\pc[1].aspx
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\pc[1].aspx
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\pc[1].aspx
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\pc[2].aspx
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\pc[2].aspx
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\pc[2].aspx
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\pc[2].aspx
%TEMP%\tmp3.tmp
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\pc[10].aspx
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\pc[3].aspx
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\pc[3].aspx
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\pc[4].aspx
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\pc[4].aspx
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\pc[4].aspx
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\pc[4].aspx
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\pc[5].aspx
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\pc[5].aspx
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\pc[5].aspx
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\pc[5].aspx
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\pc[6].aspx
<Current directory>\b662ef4S.exe
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\pc[3].aspx
<SYSTEM32>\wbem\AutoRecover\23BDE61F1F4FACE17E9B0C01F2A1FD9B.mof

Deletes the following files:

<Current directory>\list.txt
%TEMP%\tmp1.tmp
%TEMP%\tmp2.tmp
%TEMP%\tmp3.tmp

Network activity:

Connects to:

'10.##4.81.51':80
'<LOCALNET>.0.2':445
'localhost':1052
'go###e.com.vn':80

TCP:

HTTP GET requests:

http://10.##4.81.51/pcasv2/pc.aspx?MA#######################################################################################
http://www.go###e.com.vn/ via go###e.com.vn
http://10.##4.81.51/pcasv2/pc.aspx?MA##########################################################
http://10.##4.81.51/pcasv2/pc.aspx?MA########################################################
http://10.##4.81.51/pcasv2/pc.aspx?MA###########################################################
http://10.##4.81.51/pcasv2/pc.aspx?MA#######################################################
http://10.##4.81.51/pcasv2/pc.aspx?MA#####################################################
http://10.##4.81.51/pcasv2/pc.aspx?MA##############################################################
http://10.##4.81.51/pcasv2/pc.aspx?MA##################################################################
http://10.##4.81.51/pcasv2/pc.aspx?MA#############################################################
http://10.##4.81.51/pcasv2/pc.aspx?MA#########################################################################################################
http://10.##4.81.51/pcasv2/pc.aspx?MA###############################################################
http://10.##4.81.51/pcasv2/pc.aspx?MA####################################################################
http://10.##4.81.51/PCASV2/broadcast/Gettotal.aspx
http://10.##4.81.51/pcasv2/pc.aspx?MA################################################################
http://10.##4.81.51/pcasv2/pc.aspx?MA#########################################################
http://10.##4.81.51/pcasv2/pc.aspx?MA#############################################################################################
http://10.##4.81.51/pcasv2/pc.aspx?MA############################################################################################################################
http://10.##4.81.51/pcasv2/pc.aspx?MA######################################################################

UDP:

DNS ASK www.go###e.com.vn

Miscellaneous:

Creates and executes the following:

'<Current directory>\b662ef4l.exe'

Executes the following:

'<SYSTEM32>\cmd.exe' /c <Current directory>\softwarelist.bat
'<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s
'<SYSTEM32>\findstr.exe' /B ".*DisplayName"
'<SYSTEM32>\cmd.exe' /c wmic.exe QFE get HotFixID,InstalledOn >><Current directory>\list.txt
'<SYSTEM32>\cmd.exe' /c wmic ntdomain get DnsForestName,DomainControllerAddress>><Current directory>\domain.txt