Trojan.DownLoader33.39944

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'fa280178bd55348ab39c6738d80c9542' = '"%APPDATA%\servsss.exe" ..'
[<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'fa280178bd55348ab39c6738d80c9542' = '"%APPDATA%\servsss.exe" ..'

Malicious functions

Executes the following

'%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "%APPDATA%\servsss.exe" "servsss.exe" ENABLE

Modifies file system

Creates the following files

%APPDATA%\flashplayer32pp_ka_install.exe
%LOCALAPPDATA%\adobe\b9f32474-1b93-4272-ab45-c6a4f550376c\progressbar_pole_null_200.png
%LOCALAPPDATA%\adobe\b9f32474-1b93-4272-ab45-c6a4f550376c\progressbar_pole_null_100.png
%LOCALAPPDATA%\adobe\b9f32474-1b93-4272-ab45-c6a4f550376c\progressbar_pole_null_125.png
%LOCALAPPDATA%\adobe\b9f32474-1b93-4272-ab45-c6a4f550376c\progressbar_pole_null_150.png
%LOCALAPPDATA%\adobe\b9f32474-1b93-4272-ab45-c6a4f550376c\yellow_button_200.png
%LOCALAPPDATA%\adobe\b9f32474-1b93-4272-ab45-c6a4f550376c\yellow_button_100.png
%LOCALAPPDATA%\adobe\b9f32474-1b93-4272-ab45-c6a4f550376c\yellow_button_125.png
%LOCALAPPDATA%\adobe\b9f32474-1b93-4272-ab45-c6a4f550376c\gray_button_200.png
%LOCALAPPDATA%\adobe\b9f32474-1b93-4272-ab45-c6a4f550376c\close_200.png
%LOCALAPPDATA%\adobe\b9f32474-1b93-4272-ab45-c6a4f550376c\yellow_button_150.png
%LOCALAPPDATA%\adobe\b9f32474-1b93-4272-ab45-c6a4f550376c\yellow_button_mini_125.png
%LOCALAPPDATA%\adobe\b9f32474-1b93-4272-ab45-c6a4f550376c\yellow_button_mini_150.png
%LOCALAPPDATA%\adobe\b9f32474-1b93-4272-ab45-c6a4f550376c\yellow_button_short_200.png
%LOCALAPPDATA%\adobe\b9f32474-1b93-4272-ab45-c6a4f550376c\yellow_button_short_100.png
%LOCALAPPDATA%\adobe\b9f32474-1b93-4272-ab45-c6a4f550376c\yellow_button_short_125.png
%LOCALAPPDATA%\adobe\b9f32474-1b93-4272-ab45-c6a4f550376c\yellow_button_short_150.png
%LOCALAPPDATA%\adobe\b9f32474-1b93-4272-ab45-c6a4f550376c\info_icon_100.png
%LOCALAPPDATA%\adobe\b9f32474-1b93-4272-ab45-c6a4f550376c\yellow_button_mini_200.png
%LOCALAPPDATA%\adobe\b9f32474-1b93-4272-ab45-c6a4f550376c\yellow_button_mini_100.png
%LOCALAPPDATA%\adobe\b9f32474-1b93-4272-ab45-c6a4f550376c\transparent.gif
%LOCALAPPDATA%\adobe\b9f32474-1b93-4272-ab45-c6a4f550376c\progressbar_blue_active_150.png
%LOCALAPPDATA%\adobe\b9f32474-1b93-4272-ab45-c6a4f550376c\progressbar_blue_active_125.png
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\160[1]
%LOCALAPPDATA%\adobe\b9f32474-1b93-4272-ab45-c6a4f550376c\warning_icon_200.png
%LOCALAPPDATA%\adobe\b9f32474-1b93-4272-ab45-c6a4f550376c\status_icon_caution_200.png
%LOCALAPPDATA%\adobe\b9f32474-1b93-4272-ab45-c6a4f550376c\status_icon_caution_100.png
%LOCALAPPDATA%\adobe\b9f32474-1b93-4272-ab45-c6a4f550376c\status_icon_caution_125.png
%LOCALAPPDATA%\adobe\b9f32474-1b93-4272-ab45-c6a4f550376c\status_icon_caution_150.png
%LOCALAPPDATA%\adobe\b9f32474-1b93-4272-ab45-c6a4f550376c\status_icon_x_200.png
%LOCALAPPDATA%\adobe\b9f32474-1b93-4272-ab45-c6a4f550376c\status_icon_x_100.png
%APPDATA%\google.exe
%LOCALAPPDATA%\adobe\b9f32474-1b93-4272-ab45-c6a4f550376c\status_icon_x_125.png
%LOCALAPPDATA%\adobe\b9f32474-1b93-4272-ab45-c6a4f550376c\status_icon_check_200.png
%LOCALAPPDATA%\adobe\b9f32474-1b93-4272-ab45-c6a4f550376c\status_icon_check_100.png
%LOCALAPPDATA%\adobe\b9f32474-1b93-4272-ab45-c6a4f550376c\status_icon_check_125.png
%LOCALAPPDATA%\adobe\b9f32474-1b93-4272-ab45-c6a4f550376c\status_icon_check_150.png
%LOCALAPPDATA%\adobe\b9f32474-1b93-4272-ab45-c6a4f550376c\progressbar_darkgray_base_200.png
%LOCALAPPDATA%\adobe\b9f32474-1b93-4272-ab45-c6a4f550376c\progressbar_darkgray_base_100.png
%LOCALAPPDATA%\adobe\b9f32474-1b93-4272-ab45-c6a4f550376c\progressbar_blue_active_200.png
%LOCALAPPDATA%\adobe\b9f32474-1b93-4272-ab45-c6a4f550376c\progressbar_blue_active_100.png
%LOCALAPPDATA%\adobe\b9f32474-1b93-4272-ab45-c6a4f550376c\status_icon_x_150.png
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\sc[1]
%APPDATA%\servsss.exe

Substitutes the following files

%TEMP%\Adobe_ADMLogs\Adobe_ADM.log
%TEMP%\Adobe_ADMLogs\Adobe_GDE.log

Network activity

Connects to

'go######rcpics16.ddns.net':2222

TCP

HTTP GET requests

http://stats.adobe.com/b/ss/adbacdcprod/1/H.25.4/s51362933467220?AQ##############################################################################################################################...

'get.adobe.com':443

'dlmping2.adobe.com':443

UDP

DNS ASK get.adobe.com
DNS ASK stats.adobe.com
DNS ASK dlmping2.adobe.com
DNS ASK go######rcpics16.ddns.net

Miscellaneous

Searches for the following windows

ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebCheckMonitor' WindowName: ''

Creates and executes the following

'%APPDATA%\flashplayer32pp_ka_install.exe'
'%APPDATA%\google.exe'
'%APPDATA%\servsss.exe'
'%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "%APPDATA%\servsss.exe" "servsss.exe" ENABLE' (with hidden window)