Trojan.DownLoader22.53344

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

%APPDATA%\microsoft\windows\start menu\programs\startup\gicxgdhqiqgn.lnk

Malicious functions

Injects code into

the following system processes:

%WINDIR%\syswow64\wscript.exe

Searches for registry branches where third party applications store passwords

[HKCU\Software\Far\Plugins\FTP\Hosts]
[HKCU\Software\SimonTatham\PuTTY\Sessions]
[HKCU\Software\LinasFTP\Site Manager]
[HKLM\SOFTWARE\Robo-FTP 3.7\Scripts]
[HKLM\SOFTWARE\Wow6432Node\Robo-FTP 3.7\Scripts]
[HKCU\SOFTWARE\Robo-FTP 3.7\Scripts]
[HKLM\SOFTWARE\Wow6432Node\Robo-FTP 3.7\FTPServers]
[HKCU\SOFTWARE\Robo-FTP 3.7\FTPServers]
[HKCU\Software\FlashPeak\BlazeFtp\Settings]
[HKLM\Software\Wow6432Node\South River Technologies\WebDrive\Connections]
[HKLM\Software\Wow6432Node\Martin Prikryl]
[HKCU\Software\CoffeeCup Software]
[HKCU\Software\Martin Prikryl]
[HKLM\Software\Wow6432Node\SoftX.org\FTPClient\Sites]
[HKCU\Software\SoftX.org\FTPClient\Sites]
[HKLM\Software\Wow6432Node\FTPClient\Sites]
[HKCU\Software\FTPClient\Sites]
[HKLM\SOFTWARE\Wow6432Node\NCH Software\Fling\Accounts]
[HKCU\SOFTWARE\NCH Software\Fling\Accounts]
[HKCU\Software\NCH Software\ClassicFTP\FTPAccounts]
[HKCU\Software\South River Technologies\WebDrive\Connections]
[HKCU\Software\BulletProof Software\BulletProof FTP Client\Options]
[HKLM\Software\Wow6432Node\CoffeeCup Software]
[HKCU\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts]
[HKLM\Software\Microsoft\Internet Account Manager]
[HKLM\Software\Wow6432Node\Microsoft\Internet Account Manager]
[HKCU\Identities\{1BBA5DCD-58F3-46AE-861D-68CF42722C36}\Software\Microsoft\Internet Account Manager\Accounts]
[HKCU\Software\Microsoft\Internet Account Manager\Accounts]
[HKLM\Software\RIT\The Bat!\Users depot]
[HKLM\Software\Wow6432Node\RIT\The Bat!\Users depot]
[HKLM\Software\RIT\The Bat!]
[HKLM\Software\Wow6432Node\RIT\The Bat!]
[HKLM\Software\Wow6432Node\NCH Software\ClassicFTP\FTPAccounts]
[HKLM\Software\Wow6432Node\SimonTatham\PuTTY\Sessions]
[HKLM\Software\RimArts\B2\Settings]
[HKLM\Software\Wow6432Node\RimArts\B2\Settings]
[HKCU\Software\RimArts\B2\Settings]
[HKCU\Software\Microsoft\Windows Mail]
[HKCU\Software\Microsoft\Windows Live Mail]
[HKLM\Software\Wow6432Node\Nico Mak Computing\WinZip\mru\jobs]
[HKCU\Software\Nico Mak Computing\WinZip\mru\jobs]
[HKLM\Software\Wow6432Node\Nico Mak Computing\WinZip\FTP]
[HKCU\Software\Nico Mak Computing\WinZip\FTP]
[HKCU\Software\RIT\The Bat!]
[HKCU\Software\MAS-Soft\FTPInfo\Setup]
[HKCU\Software\ExpanDrive\Sessions]
[HKCU\Software\Cryer\WebSitePublisher]
[HKCU\Software\VanDyke\SecureFX]
[HKLM\Software\Wow6432Node\Ghisler\Total Commander]
[HKCU\Software\FlashFXP\3]
[HKCU\Software\GlobalSCAPE\CuteFTP 9\QCToolbar]
[HKCU\Software\GlobalSCAPE\CuteFTP 8 Professional\QCToolbar]
[HKCU\Software\GlobalSCAPE\CuteFTP 8 Home\QCToolbar]
[HKCU\Software\GlobalSCAPE\CuteFTP 7 Professional\QCToolbar]
[HKCU\Software\GlobalSCAPE\CuteFTP 7 Home\QCToolbar]
[HKCU\Software\GlobalSCAPE\CuteFTP 6 Professional\QCToolbar]
[HKCU\Software\GlobalSCAPE\CuteFTP 6 Home\QCToolbar]
[HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings]
[HKLM\Software\Wow6432Node\FlashFXP\3]
[HKCU\Software\Ghisler\Total Commander]
[HKLM\Software\Ghisler\Windows Commander]
[HKLM\Software\Wow6432Node\Ghisler\Windows Commander]
[HKCU\Software\Ghisler\Windows Commander]
[HKCU\Software\Far Manager\SavedDialogHistory\FTPHost]
[HKCU\Software\Far2\SavedDialogHistory\FTPHost]
[HKCU\Software\Far\SavedDialogHistory\FTPHost]
[HKCU\Software\Far Manager\Plugins\FTP\Hosts]
[HKCU\Software\Far2\Plugins\FTP\Hosts]
[HKLM\Software\Ghisler\Total Commander]
[HKCU\Software\RIT\The Bat!\Users depot]
[HKLM\Software\FlashFXP\3]
[HKCU\Software\FileZilla]
[HKLM\Software\Wow6432Node\FlashFXP]
[HKCU\Software\FTP Explorer\Profiles]
[HKCU\Software\FTP Explorer\FTP Explorer\Workspace\MFCToolBar-224]
[HKCU\Software\FTPWare\COREFTP\Sites]
[HKCU\Software\CoffeeCup Software\Internet\Profiles]
[HKCU\Software\Sota\FFFTP\Options]
[HKCU\Software\Sota\FFFTP]
[HKLM\Software\TurboFTP]
[HKLM\Software\Wow6432Node\TurboFTP]
[HKLM\Software\FlashFXP]
[HKCU\Software\TurboFTP]
[HKCU\Software\FlashFXP]
[HKCU\Software\BPFTP\Bullet Proof FTP\Options]
[HKCU\Software\BulletProof Software\BulletProof FTP Client\Main]
[HKCU\Software\BPFTP\Bullet Proof FTP\Main]
[HKLM\Software\FileZilla Client]
[HKLM\Software\Wow6432Node\FileZilla Client]
[HKLM\Software\FileZilla]
[HKLM\Software\Wow6432Node\FileZilla]
[HKCU\Software\FileZilla Client]
[HKCU\Software\BPFTP]
[HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook]

Reads files which store third party applications passwords

%LOCALAPPDATA%\google\chrome\user data\default\web data
%LOCALAPPDATA%\google\chrome\user data\default\login data

Brute-forces OS accounts.

Modifies file system

Creates the following files

%TEMP%\ixp000.tmp\pzlggw~1.exe
%TEMP%\autba97.tmp
%TEMP%\qoeeseo
%APPDATA%\edqk.exe
%APPDATA%\aokfy.au3
%TEMP%\1287554.bat

Sets the 'hidden' attribute to the following files

%HOMEPATH%\noe7m5aogmtbsmrz\aokfy.au3
%HOMEPATH%\noe7m5aogmtbsmrz\edqk.exe

Deletes the following files

%TEMP%\autba97.tmp
%TEMP%\qoeeseo
%TEMP%\ixp000.tmp\pzlggw~1.exe
%WINDIR%\syswow64\wscript.exe

Moves the following files

from %APPDATA%\aokfy.au3 to %HOMEPATH%\noe7m5aogmtbsmrz\aokfy.au3
from %APPDATA%\edqk.exe to %HOMEPATH%\noe7m5aogmtbsmrz\edqk.exe

Network activity

UDP

DNS ASK po###oggs.info

Miscellaneous

Creates and executes the following

'%TEMP%\ixp000.tmp\pzlggw~1.exe'
'%APPDATA%\edqk.exe' "%APPDATA%\aOKfY.au3"

Executes the following

'%WINDIR%\syswow64\wscript.exe'
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\1287554.bat" "%WINDIR%\SysWOW64\wscript.exe" "
'%TEMP%\ixp000.tmp\pzlggw~1.exe' ' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\1287554.bat" "%WINDIR%\SysWOW64\wscript.exe" "' (with hidden window)

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial