Trojan.DownLoader45.25453

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Error CardSpace Spooler Volume Function' = '%HOMEPATH%\Local Settings\Application Data\ukrlghb\qtxmjvxif.exe'

Modifies file system

Creates the following files

%HOMEPATH%\local settings\application data\ukrlghb\qtxmjvxif.exe
%HOMEPATH%\local settings\application data\ukrlghb\jeletjjjamqr.exe
%HOMEPATH%\local settings\application data\ukrlghb\qtxmjvxif.uijxo

Sets the 'hidden' attribute to the following files

%HOMEPATH%\local settings\application data\ukrlghb\qtxmjvxif.exe
%HOMEPATH%\local settings\application data\ukrlghb\jeletjjjamqr.exe

Network activity

Connects to

'ge####always.net':80
'de####therefore.net':80
'ne#####ryquestion.net':80
'le####school.net':80
'he###while.net':80
'de####hunger.net':80
'fo####dtraining.net':80

TCP

HTTP GET requests

http://ge####always.net/forum/search.php?em#####################################
http://de####therefore.net/forum/search.php?em#####################################
http://ne#####ryquestion.net/forum/search.php?em#####################################
http://le####school.net/forum/search.php?em#####################################
http://he###while.net/forum/search.php?em#####################################
http://de####hunger.net/forum/search.php?em#####################################
http://fo####dtraining.net/forum/search.php?em#####################################

UDP

DNS ASK he####forest.net
DNS ASK le####school.net
DNS ASK re#####therefore.net
DNS ASK or####herefore.net
DNS ASK re####equestion.net
DNS ASK or####uestion.net
DNS ASK re####ewhile.net
DNS ASK or###while.net
DNS ASK he####school.net
DNS ASK re####eschool.net
DNS ASK ne#####rytherefore.net
DNS ASK pl#####ttherefore.net
DNS ASK ne#####ryquestion.net
DNS ASK pl#####tquestion.net
DNS ASK ne####arywhile.net
DNS ASK pl####ntwhile.net
DNS ASK ne####aryschool.net
DNS ASK or###school.net
DNS ASK le###rwhile.net
DNS ASK he###nwhile.net
DNS ASK le####question.net
DNS ASK fo####dhunger.net
DNS ASK de####hunger.net
DNS ASK re####therefore.net
DNS ASK va#####therefore.net
DNS ASK re####question.net
DNS ASK va####squestion.net
DNS ASK re###nwhile.net
DNS ASK va####swhile.net
DNS ASK re####school.net
DNS ASK va####sschool.net
DNS ASK ge####therefore.net
DNS ASK ge####question.net
DNS ASK ge###ewhile.net
DNS ASK ge####school.net
DNS ASK he####therefore.net
DNS ASK le####therefore.net
DNS ASK he####question.net
DNS ASK pl####ntschool.net
DNS ASK de####training.net
DNS ASK he####herefore.net
DNS ASK he####uestion.net
DNS ASK re####forest.net
DNS ASK va####sforest.net
DNS ASK re####always.net
DNS ASK va####salways.net
DNS ASK re###nanger.net
DNS ASK va####sanger.net
DNS ASK re###nwheat.net
DNS ASK de####school.net
DNS ASK va####swheat.net
DNS ASK he###forest.net
DNS ASK ge####always.net
DNS ASK he###always.net
DNS ASK ge###eanger.net
DNS ASK he###anger.net
DNS ASK ge###ewheat.net
DNS ASK he###wheat.net
DNS ASK ge####forest.net
DNS ASK fo####dschool.net
DNS ASK de###ewhile.net
DNS ASK fo####dwhile.net
DNS ASK di#####ltquestion.net
DNS ASK he###while.net
DNS ASK di####ultwhile.net
DNS ASK he###school.net
DNS ASK di####ultschool.net
DNS ASK gl####herefore.net
DNS ASK an####therefore.net
DNS ASK gl####uestion.net
DNS ASK an####question.net
DNS ASK gl###while.net
DNS ASK an###rwhile.net
DNS ASK gl###school.net
DNS ASK an####school.net
DNS ASK fo#####therefore.net
DNS ASK de####therefore.net
DNS ASK fo####dquestion.net
DNS ASK de####question.net
DNS ASK di#####lttherefore.net
DNS ASK fo####dtraining.net

Miscellaneous

Creates and executes the following

'%HOMEPATH%\local settings\application data\ukrlghb\qtxmjvxif.exe'
'%HOMEPATH%\local settings\application data\ukrlghb\jeletjjjamqr.exe' "%HOMEPATH%\Local Settings\Application Data\ukrlghb\qtxmjvxif.exe"