Trojan.DownLoader8.54386

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'YLive.exe' = '%PROGRAM_FILES%\Yahoo!\Assistant\YLive.exe'
[<HKLM>\SOFTWARE\Classes\pcast\shell\open\command] '' = '%PROGRAM_FILES%\pcast\PodcastbarMini\PODCAS~1.EXE "%1"'
[<HKLM>\SOFTWARE\Microsoft\Internet Explorer\Extensions\{6671A433-5C3D-463d-A7CF-5587F9B7E191}] 'ClsidExtension' = '{6671A432-5C3D-463d-A7CF-5587F9B7E191}'

Creates or modifies the following files:

%HOMEPATH%\Start Menu\Programs\Startup\ГЁСЫНшВзµзКУ.lnk

Malicious functions:

To bypass firewall, removes or modifies the following registry keys:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\pcast\PodcastbarMini\PODCAS~1.EXE' = '%PROGRAM_FILES%\pcast\PodcastbarMini\PODCAS~1.EXE:*:Enabled:Share Streaming'

Creates and executes the following:

'%PROGRAM_FILES%\pcast\PodcastbarMini\Start.exe'
'%PROGRAM_FILES%\pcast\PodcastbarMini\PodcastBarMini.exe'
'%PROGRAM_FILES%\Yahoo!\Assistant\ylive.exe'
'%TEMP%\RarSFX0\pcastbarminis-1.0.0.7_wl_065.exe'
'%TEMP%\RarSFX0\SetupExe.exe'
'%TEMP%\RarSFX0\rjzc079_yassist.exe'
'%TEMP%\RarSFX0\Setup_s31.exe'

Executes the following:

'<SYSTEM32>\rundll32.exe'

Modifies file system :

Creates the following files:

%PROGRAM_FILES%\Yahoo!\Assistant\Assist\Images\music.bmp
%PROGRAM_FILES%\Yahoo!\Assistant\Assist\Images\musiclink.bmp
%PROGRAM_FILES%\Yahoo!\Assistant\Assist\Images\logo.bmp
%PROGRAM_FILES%\Yahoo!\Assistant\Assist\Images\iefix.bmp
%HOMEPATH%\Start Menu\Programs\ГЁСЫНшВзµзКУ\Website.lnk
%HOMEPATH%\Start Menu\Programs\ГЁСЫНшВзµзКУ\Uninstall.lnk
%HOMEPATH%\Desktop\ГЁСЫНшВзµзКУ.lnk
%PROGRAM_FILES%\Yahoo!\Assistant\Assist\Images\searchtop.bmp
%PROGRAM_FILES%\Yahoo!\Assistant\Assist\Images\search.bmp
%PROGRAM_FILES%\Yahoo!\Assistant\Assist\Images\musictop.bmp
%PROGRAM_FILES%\Yahoo!\Assistant\Assist\Images\picture.bmp
%PROGRAM_FILES%\Yahoo!\Assistant\Assist\Images\hilight.bmp
%PROGRAM_FILES%\Yahoo!\Assistant\Assist\CoolBar\profile.ini
%PROGRAM_FILES%\Yahoo!\Assistant\Assist\Images\adkiller.bmp
%PROGRAM_FILES%\Yahoo!\Assistant\Assist\CoolBar\prodef.ini
%PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\SecurityBar\prodef.ini
%PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\SecurityBar\profile.ini
%PROGRAM_FILES%\Yahoo!\Assistant\Assist\Images\alert.bmp
%PROGRAM_FILES%\Yahoo!\Assistant\Assist\Images\clear.bmp
%PROGRAM_FILES%\Yahoo!\Assistant\Assist\Images\custheme.bmp
%PROGRAM_FILES%\Yahoo!\Assistant\Assist\Images\assist.bmp
%PROGRAM_FILES%\Yahoo!\Assistant\Assist\Images\alertnew.bmp
%PROGRAM_FILES%\Yahoo!\Assistant\Assist\Images\anitvirus.bmp
%PROGRAM_FILES%\pcast\PodcastbarMini\uninst.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\radio[1].xml
%TEMP%\tem8.tmp
%PROGRAM_FILES%\pcast\PodcastbarMini\itv.xml
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\itv[1].xml
%TEMP%\tem7.tmp
%PROGRAM_FILES%\pcast\PodcastbarMini\radio.xml
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\pcast_install[1].html
%TEMP%\temB.tmp
%PROGRAM_FILES%\pcast\PodcastbarMini\test.xml
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\test[1].xml
%TEMP%\tem9.tmp
%TEMP%\RDF6.tmp
%PROGRAM_FILES%\Yahoo!\Assistant\Assist\SearchBar\profile.ini
%PROGRAM_FILES%\Yahoo!\Assistant\Assist\SecurityBar\prodef.ini
%PROGRAM_FILES%\Yahoo!\Assistant\Assist\SearchBar\prodef.ini
%PROGRAM_FILES%\Yahoo!\Assistant\Assist\Images\settings.bmp
%PROGRAM_FILES%\Yahoo!\Assistant\Assist\Images\yphtb.bmp
%PROGRAM_FILES%\Yahoo!\Assistant\Assist\SecurityBar\profile.ini
%TEMP%\RDF5.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\caiXinStat[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\clientStat[1].php
%PROGRAM_FILES%\Yahoo!\Assistant\YAlive.dll
%PROGRAM_FILES%\pcast\PodcastbarMini\pbmini.config.xml
%PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\SearchBar\profile.ini
%PROGRAM_FILES%\pcast\PodcastbarMini\Start.exe
%PROGRAM_FILES%\pcast\PodcastbarMini\PodcastBarMini.exe
%PROGRAM_FILES%\pcast\PodcastbarMini\version.ini
%PROGRAM_FILES%\Yahoo!\Assistant\Update\Assist\yasbar.dll
%PROGRAM_FILES%\Yahoo!\Assistant\Assist\yasbar.dll
%PROGRAM_FILES%\Yahoo!\Assistant\yal01.dat
%PROGRAM_FILES%\MMSAssist\mms.ini
%PROGRAM_FILES%\MMSAssist\MMSAssist.dll
%PROGRAM_FILES%\Yahoo!\Assistant\ylive.exe
%PROGRAM_FILES%\pcast\PodcastbarMini\pCastCtl.dll
%PROGRAM_FILES%\Yahoo!\Assistant\yhelper.dll
<SYSTEM32>\stdup.dll
%TEMP%\RarSFX0\SetupExe.exe
%TEMP%\nst2.tmp
%TEMP%\RarSFX0\Setup_s31.exe
%TEMP%\RarSFX0\pcastbarminis-1.0.0.7_wl_065.exe
%TEMP%\RarSFX0\rjzc079_yassist.exe
%PROGRAM_FILES%\Yahoo!\Assistant\Assist\yalive.dll
<SYSTEM32>\std.ini
%PROGRAM_FILES%\Yahoo!\Assistant\Update\yal01.dat
%PROGRAM_FILES%\Yahoo!\Assistant\Update\yhelper.dll
%PROGRAM_FILES%\Yahoo!\Assistant\ires.dat
%PROGRAM_FILES%\Yahoo!\Assistant\Update\ylive.exe
%PROGRAM_FILES%\Yahoo!\Assistant\Assist\coolbar.cab
%PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\Images\musiclink.bmp
%PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\Images\musictop.bmp
%PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\Images\music.bmp
%PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\Images\iefix.bmp
%PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\Images\logo.bmp
%PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\Images\picture.bmp
%PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\Images\yphtb.bmp
%PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\SearchBar\prodef.ini
%PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\Images\settings.bmp
%PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\Images\search.bmp
%PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\Images\searchtop.bmp
%PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\Images\hilight.bmp
%PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\Images\adkiller.bmp
%PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\Images\alert.bmp
%PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\CoolBar\profile.ini
%PROGRAM_FILES%\pcast\PodcastbarMini\PodcastbarMini.url
%PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\CoolBar\prodef.ini
%PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\Images\clear.bmp
%PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\Images\custheme.bmp
%PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\Images\assist.bmp
%PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\Images\alertnew.bmp
%PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\Images\anitvirus.bmp

Deletes the following files:

%PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\Images\settings.bmp
%PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\Images\searchtop.bmp
%PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\SearchBar\prodef.ini
%PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\Images\yphtb.bmp
%PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\Images\musictop.bmp
%PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\Images\musiclink.bmp
%PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\Images\search.bmp
%PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\Images\picture.bmp
%PROGRAM_FILES%\Yahoo!\Assistant\Assist\yalive.dll
%PROGRAM_FILES%\Yahoo!\Assistant\ires.dat
%TEMP%\RDF6.tmp
%TEMP%\RDF5.tmp
%PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\SecurityBar\prodef.ini
%PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\SearchBar\profile.ini
%PROGRAM_FILES%\Yahoo!\Assistant\Assist\coolbar.cab
%PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\SecurityBar\profile.ini
%PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\Images\music.bmp
%PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\CoolBar\profile.ini
%PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\CoolBar\prodef.ini
%PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\Images\alert.bmp
%PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\Images\adkiller.bmp
%PROGRAM_FILES%\Yahoo!\Assistant\Update\yal01.dat
%PROGRAM_FILES%\Yahoo!\Assistant\Update\Assist\yasbar.dll
%PROGRAM_FILES%\Yahoo!\Assistant\Update\ylive.exe
%PROGRAM_FILES%\Yahoo!\Assistant\Update\yhelper.dll
%PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\Images\hilight.bmp
%PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\Images\custheme.bmp
%PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\Images\logo.bmp
%PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\Images\iefix.bmp
%PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\Images\anitvirus.bmp
%PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\Images\alertnew.bmp
%PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\Images\clear.bmp
%PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\Images\assist.bmp

Network activity:

Connects to:

'it#.mop.com':80
'localhost':1043
're#.##ast.dudu.com':80
'p-##.io8.org':8080
'localhost':1038
'localhost':1036
'pc####l.dudu.com':80
'www.li###eng100.com':80

TCP:

HTTP GET requests:

it#.mop.com/radio.xml?ti###########
it#.mop.com/test.xml?ti###########
re#.##ast.dudu.com/rep/pcast_install.html?v8###############################################################################################################################################
it#.mop.com/itv.xml?ti###########
www.li###eng100.com/clientStat.php?pa############################################################################
www.li###eng100.com/caiXinStat.php?pa############################################################################
pc####l.dudu.com/pcastbarup/rls/updateprogmini.php?ve#########################

UDP:

DNS ASK p-##.io8.org
DNS ASK re#.##ast.dudu.com
DNS ASK it#.mop.com
DNS ASK www.li###eng100.com
DNS ASK pc####l.dudu.com

Miscellaneous:

Searches for the following windows:

ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: 'EDIT' WindowName: ''

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial