Trojan.DownLoader26.59552

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'SogouGameDownload' = '%APPDATA%\SogouGameDownload\sggamedlupdate.exe -opensystem'
[<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'finderUp' = '%ProgramFiles(x86)%\sogoufinder\findermateupdate.exe -opensystem'
[<HKLM>\Software\Classes\sggamedownload\Shell\Open\command] '' = '"%APPDATA%\SogouGameDownload\SogouGameDownload.exe" "%1"'

Modifies file system

Creates the following files

%TEMP%\tengxunyouxipingtai_setupgame.ico
%APPDATA%\sogougamedownload\bin\gamefile.dll
%APPDATA%\sogougamedownload\bin\xldl.dll
%APPDATA%\sogougamedownload\sogoufinder\cloudseticon.dll
%APPDATA%\sogougamedownload\sogoufinder\exceptionreport.exe
%APPDATA%\sogougamedownload\sogoufinder\findermate.dll
%APPDATA%\sogougamedownload\sogoufinder\findermateupdate.exe
%APPDATA%\sogougamedownload\sogoufinder\gouwu1.ico
%APPDATA%\sogougamedownload\sogoufinder\sitelist.dll
%APPDATA%\sogougamedownload\sogoufinder\uninst.exe
%ProgramFiles(x86)%\sogoufinder\cloudseticon.dll
%ProgramFiles(x86)%\sogoufinder\sitelist.dll
%ProgramFiles(x86)%\sogoufinder\uninst.exe
%ProgramFiles(x86)%\sogoufinder\exceptionreport.exe
%ProgramFiles(x86)%\sogoufinder\findermateupdate.exe
%ProgramFiles(x86)%\sogoufinder\findermate.dll
%APPDATA%\microsoft\windows\start menu\programs\搜狗购物助手\搜狗购物首页.lnk
%APPDATA%\microsoft\windows\start menu\programs\搜狗购物助手\关于购物助手.lnk
%APPDATA%\sogougamedownload\bin\download\zlib1.dll
%APPDATA%\microsoft\windows\start menu\programs\搜狗购物助手\卸载.lnk
%APPDATA%\sogougamedownload\bin\download\thunderfw.exe
%APPDATA%\sogougamedownload\bin\download\msvcp71.dll
%TEMP%\tengxunyouxipingtai_game.ico
%APPDATA%\sogougamedownload\gamedata\8\setupgame.ico
%APPDATA%\sogougamedownload\gamedata\8\game.ico
%APPDATA%\sogougamedownload\sogougamedownload.exe
%APPDATA%\sogougamedownload\sglibdui.dll
%APPDATA%\sogougamedownload\auxmoddl.dll
%APPDATA%\sogougamedownload\sggamedlupdate.exe
%APPDATA%\sogougamedownload\dl.skn
%APPDATA%\sogougamedownload\downloadcom.exe
%APPDATA%\sogougamedownload\exceptionreport.exe
%APPDATA%\sogougamedownload\cloudseticon.dll
%APPDATA%\sogougamedownload\bin\download\atl71.dll
%APPDATA%\sogougamedownload\bin\download\dl_peer_id.dll
%APPDATA%\sogougamedownload\bin\download\download_engine.dll
%APPDATA%\sogougamedownload\bin\download\id.dat
%APPDATA%\sogougamedownload\bin\download\minithunderplatform.exe
%APPDATA%\sogougamedownload\bin\download\minitpfw.exe
%APPDATA%\sogougamedownload\bin\download\msvcr71.dll
%LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012022051820220519\index.dat

Deletes the following files

%APPDATA%\sogougamedownload\sogoufinder\cloudseticon.dll
%APPDATA%\sogougamedownload\sogoufinder\exceptionreport.exe
%APPDATA%\sogougamedownload\sogoufinder\findermate.dll
%APPDATA%\sogougamedownload\sogoufinder\findermateupdate.exe
%APPDATA%\sogougamedownload\sogoufinder\gouwu1.ico
%APPDATA%\sogougamedownload\sogoufinder\sitelist.dll
%APPDATA%\sogougamedownload\sogoufinder\uninst.exe

Network activity

Connects to

'yx.##gou.com':80
'pb.##gou.com':80

TCP

HTTP GET requests

http://yx.##gou.com/popupdata?so###############################################################
http://yx.##gou.com/gamedetail?ca#########################################################
http://yx.##gou.com/
http://yx.##gou.com/dwnotify/background.html
http://yx.##gou.com/dwnotify/js/jquery.min.js
http://yx.##gou.com/js/jquery.cookie.js
http://yx.##gou.com/js/Date.js
http://yx.##gou.com/dwnotify/js/storage.js
http://yx.##gou.com/js/Util.js?v=#
http://pb.##gou.com/pv.gif?ui####################################################################################################################################################################...
http://yx.##gou.com/popupdata?so######################################################################
http://pb.##gou.com/cl.gif?ui####################################################################################################################################################################...
http://yx.##gou.com/popupdata?so##########################################################
http://yx.##gou.com/popupdata?so##################################################################

UDP

DNS ASK yx.##gou.com
DNS ASK pb.##gou.com

Miscellaneous

Searches for the following windows

ClassName: 'sgdl8' WindowName: ''
ClassName: '' WindowName: '文件下载 - 安全警告'
ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebCheckMonitor' WindowName: ''

Creates and executes the following

'%APPDATA%\sogougamedownload\sogougamedownload.exe' &sp=docid:8;category:99;title:腾讯游戏平台;local:1;
'%APPDATA%\sogougamedownload\bin\download\minitpfw.exe' -n %APPDATA%\SogouGameDownload\bin\download\MiniThunderPlatform.exe
'%APPDATA%\sogougamedownload\sogougamedownload.exe' -installprotocol
'%APPDATA%\sogougamedownload\downloadcom.exe' /regserver
'%APPDATA%\sogougamedownload\sggamedlupdate.exe' -setupfinish
'%APPDATA%\sogougamedownload\sggamedlupdate.exe'
'%ProgramFiles(x86)%\sogoufinder\findermateupdate.exe' -killBD
'%APPDATA%\sogougamedownload\bin\download\minitpfw.exe' -n %APPDATA%\SogouGameDownload\bin\download\MiniThunderPlatform.exe' (with hidden window)
'%APPDATA%\sogougamedownload\sogougamedownload.exe' -installprotocol' (with hidden window)
'%APPDATA%\sogougamedownload\downloadcom.exe' /regserver' (with hidden window)
'%ProgramFiles(x86)%\sogoufinder\findermateupdate.exe' -killBD' (with hidden window)