Trojan.DownLoader45.59298

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKCU\Software\VOS\RaidCall\PendingChangesHKLM\SOFTWARE\Classes\raidcall\shell\open\command] '' = '[#CAMEYO-VAR#]"%Program Files%\RaidCall\StartRC.exe" "%1"'

Malicious functions

Injects code into

the following user processes:

raidcall.exe

Modifies file system

Creates the following files

%APPDATA%\vos\raidcall\appvirtdll_raidcall.dll
%APPDATA%\vos\raidcall\manif.2684.new.xml
%APPDATA%\vos\raidcall\manif.2684.org.xml
%APPDATA%\vos\raidcall\changes\virtfiles.db.1324.tmp
%APPDATA%\vos\raidcall\changes\virtfiles.db.2288.tmp
%APPDATA%\vos\raidcall\changes\%profile%\appdata\locallow\raidcall\miscid.tmp
%APPDATA%\vos\raidcall\changes\virtreg.dat.log1
%APPDATA%\vos\raidcall\changes\virtfiles.db.1952.tmp
%APPDATA%\vos\raidcall\changes\%profile%\appdata\locallow\raidcall\config.cfg
%APPDATA%\vos\raidcall\changes\%profile%\appdata\locallow\raidcall\log\raidcall_7.3.0.log
%APPDATA%\vos\raidcall\changes\%profile%\appdata\locallow\raidcall\decoration.xml
%APPDATA%\vos\raidcall\prog\%program files%\raidcall\theme\palette\preview.png
%APPDATA%\vos\raidcall\changes\%program files%\raidcall\theme\palette\preview.png
%APPDATA%\vos\raidcall\prog\%program files%\raidcall\theme\user_defined\preview.png
%APPDATA%\vos\raidcall\changes\%program files%\raidcall\theme\user_defined\preview.png
%APPDATA%\vos\raidcall\prog\%program files%\raidcall\theme\palette\config.xml
%APPDATA%\vos\raidcall\changes\%program files%\raidcall\theme\palette\config.xml
%APPDATA%\vos\raidcall\prog\%program files%\raidcall\theme\user_defined\config.xml
%APPDATA%\vos\raidcall\enginestamps\zipcache.20131215-193323.875.stamp
%APPDATA%\vos\raidcall\changes\%program files%\raidcall\theme\user_defined\config.xml
%APPDATA%\vos\raidcall\zipcache
%APPDATA%\vos\raidcall\prog\icons\raidcall.exe.ico
%APPDATA%\vos\raidcall\enginestamps\appvirtdll_raidcall.dll.20131215-193323.859.stamp
%APPDATA%\vos\raidcall\appvirtdll64_raidcall.dll
%APPDATA%\vos\raidcall\enginestamps\appvirtdll64_raidcall.dll.20131215-193323.859.stamp
%APPDATA%\vos\raidcall\raidcall.exe
%APPDATA%\vos\raidcall\enginestamps\raidcall.exe.20131215-193323.875.stamp
%APPDATA%\vos\raidcall\raidcall64.exe
%APPDATA%\vos\raidcall\enginestamps\raidcall64.exe.20131215-193323.875.stamp
%APPDATA%\vos\raidcall\virtfiles.prog.db
%APPDATA%\vos\raidcall\enginestamps\virtfiles.prog.db.20131215-193605.109.stamp
%APPDATA%\vos\raidcall\sandboxcfg.db
%APPDATA%\vos\raidcall\enginestamps\sandboxcfg.db.20131215-193604.953.stamp
%APPDATA%\vos\raidcall\virtreg.prog.dat
%APPDATA%\vos\raidcall\enginestamps\virtreg.prog.dat.20131215-193604.953.stamp
%APPDATA%\vos\raidcall\changes\virtfiles.db
%APPDATA%\vos\raidcall\changes\virtreg.dat
%APPDATA%\vos\raidcall\changes\virtfiles.db.552.tmp
%APPDATA%\vos\raidcall\prog\%program files%\raidcall\microsoft.vc90.crt\microsoft.vc90.crt.manifest
%APPDATA%\vos\raidcall\prog\icons\uninst.exe.ico
%APPDATA%\vos\raidcall\prog\%program files%\raidcall\interface.dat

Deletes the following files

%APPDATA%\vos\raidcall\changes\virtfiles.db
%APPDATA%\vos\raidcall\manif.2684.org.xml
%APPDATA%\vos\raidcall\manif.2684.new.xml

Substitutes the following files

%APPDATA%\vos\raidcall\changes\virtfiles.db
%APPDATA%\vos\raidcall\changes\virtfiles.db.552.tmp

Network activity

Connects to

'ad#.##idtalk.com':80
'up####.raidcall.com':80
'up####.raidtalk.com':80

TCP

HTTP GET requests

http://up####.raidcall.com/check_new.php?ve####################################

UDP

DNS ASK ap#.##idtalk.com
DNS ASK ad#.##idtalk.com
DNS ASK up####.raidcall.com
DNS ASK ra###alk.com
DNS ASK up####.raidtalk.com

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: 'GFXSVR'
ClassName: 'RcGameBox_gamebox_' WindowName: ''

Creates and executes the following

'%APPDATA%\vos\raidcall\raidcall.exe'
'%APPDATA%\vos\raidcall\raidcall.exe' --check --version=7.3.0-1.0.10926.49
'%APPDATA%\vos\raidcall\raidcall.exe' "checkDx"
'%APPDATA%\vos\raidcall\raidcall.exe' --check --version=7.3.0-1.0.10926.49' (with hidden window)
'%APPDATA%\vos\raidcall\raidcall.exe' "checkDx"' (with hidden window)