Trojan.DownLoader32.57522

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'prueba' = '<SYSTEM32>\cmd.exe /c start http://fainbory.com/7jTl & start chrome.exe http://fainbory.com/7jTl & start chrome.exe http://fai...
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'system' = 'C:\system.bat'

Modifies file system

Creates the following files

<Current directory>\texto.bat
<Current directory>\segundo.bat
<Current directory>\inocente.jpg
<Current directory>\primero.bat
nul
C:\system.bat
%LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012020020320200204\index.dat

Network activity

Connects to

'si######der-admin.omb11.com':443

TCP

HTTP GET requests

http://fa###ory.com/7jTl
http://sc###ami.net/2market.php?i=###############################################################################################################################################################...
http://cd#.##useami.net/static/image/d_bottom_bg2.png
http://cd#.##useami.net/static/image/delete2.png
http://www.fa###ook.com/plugins/like.php?hr######################################################################################################################################################...
http://cd#.##useami.net/static/image/d_top_bg.png
http://ad#.ly/funcript1580722143870.php?pu#######################################################################################################################################################...
http://www.go#####analytics.com/ga.js
http://cd#.##useami.net/static/image/skip_ad/en_tran.png
http://cd#.##useami.net/static/image/spinner.gif
http://cd#.##useami.net/static/image/ahl6532.gif
http://cd#.##useami.net/static/image/ad_top_bg2.png?&a########
http://cd#.##useami.net/static/image/logo_fb2.png
http://sc###ami.net/js/display.js
http://cd#.##useami.net/static/js/main.js
http://d1#######lx627.cloudfront.net/?ix##########
http://cd#.##useami.net/static/js/b64.js
http://cd#.##useami.net/static/js/view111.js
http://cd#.##useami.net/static/js/amvn.js
http://cd#.##useami.net/static/css/adfly_7.css
http://aj##.#oogleapis.com/ajax/libs/jquery/1.7.1/jquery.min.js
http://sc###ami.net/fp.rev11.php?ve#######################
http://sc###ami.net/-67568ZUIC/7jTl?rn#########################
http://cd#.##useami.net/static/image/favicon.ico

'fa###ook.com':443

'of####.builderall.com':443

'st####.xx.fbcdn.net':443

'dm##in.com':443

'cd#.####rialdesignicons.com':443

'fo###.#oogleapis.com':443

'ch######api.builderall.com':443

'fo###.gstatic.com':443

UDP

DNS ASK fa###ory.com
DNS ASK sc###ami.net
DNS ASK aj##.#oogleapis.com
DNS ASK cd#.##useami.net
DNS ASK d1#######lx627.cloudfront.net
DNS ASK ad#.ly
DNS ASK go#####analytics.com
DNS ASK fa###ook.com
DNS ASK of####.builderall.com
DNS ASK st####.xx.fbcdn.net
DNS ASK dm##in.com
DNS ASK fo###.#oogleapis.com
DNS ASK cd#.####rialdesignicons.com
DNS ASK ch######api.builderall.com
DNS ASK fo###.gstatic.com
DNS ASK si######der-admin.omb11.com

Miscellaneous

Searches for the following windows

ClassName: 'EDIT' WindowName: ''
ClassName: 'DDEMLMom' WindowName: ''
ClassName: 'IEFrame' WindowName: ''
ClassName: 'Static' WindowName: ''
ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebCheckMonitor' WindowName: ''

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c ""<Current directory>\texto.bat" "
'%WINDIR%\syswow64\cmd.exe' /K primero.bat
'%WINDIR%\syswow64\cmd.exe' /K segundo.bat
'%WINDIR%\syswow64\reg.exe' add HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v prueba /d "<SYSTEM32>\cmd.exe /c start http://fa###ory.com/7jTl & start chrome.exe http://fa###ory.com/7jTl & start chrome...
'%WINDIR%\syswow64\net.exe' FILE
'%WINDIR%\syswow64\net1.exe' FILE
'%WINDIR%\syswow64\reg.exe' add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v system /d "C:\system.bat" /f