Trojan.DownLoader29.52297

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

%HOMEPATH%\start menu\programs\startup\svchost.exe

Infects the following executable files

<Drive name for removable media>:\utorrent_backup.exe
<Drive name for removable media>:\chromesetup_backup.exe
<Drive name for removable media>:\dotnetfx45_full_setup_backup.exe
<Drive name for removable media>:\wrar520_backup.exe
<Drive name for removable media>:\skypesetup_backup.exe
<Drive name for removable media>:\notepad_backup.exe

Creates the following files on removable media

<Drive name for removable media>:\bloc-notes.exe
<Drive name for removable media>:\utorrent_backup.exe
<Drive name for removable media>:\rcx5.tmp
<Drive name for removable media>:\chromesetup_backup.exe
<Drive name for removable media>:\rcx8.tmp
<Drive name for removable media>:\dotnetfx45_full_setup_backup.exe
<Drive name for removable media>:\rcxb.tmp
<Drive name for removable media>:\wrar520_backup.exe
<Drive name for removable media>:\rcxe.tmp
<Drive name for removable media>:\skypesetup_backup.exe
<Drive name for removable media>:\rcx11.tmp
<Drive name for removable media>:\notepad_backup.exe
<Drive name for removable media>:\rcx14.tmp

Modifies file system

Creates the following files

%TEMP%\kia.resources
%TEMP%\xbvgoxkg.0.vb
%TEMP%\xbvgoxkg.cmdline
%TEMP%\xbvgoxkg.out
%TEMP%\vbc9.tmp
%TEMP%\resa.tmp
%TEMP%\of.resources
%TEMP%\uqn.resources
%TEMP%\jyjjbqbi.0.vb
%TEMP%\jyjjbqbi.cmdline
%TEMP%\jyjjbqbi.out
%TEMP%\vbcc.tmp
%TEMP%\gfbkbbvh.resources
%TEMP%\vbc12.tmp
%TEMP%\c.resources
%TEMP%\znhxk-ae.0.vb
%TEMP%\znhxk-ae.cmdline
%TEMP%\znhxk-ae.out
%TEMP%\vbcf.tmp
%TEMP%\res10.tmp
%TEMP%\gvomr.resources
%TEMP%\fgc.resources
%TEMP%\m5zx3gyw.0.vb
%TEMP%\m5zx3gyw.cmdline
%TEMP%\m5zx3gyw.out
%TEMP%\elvpob.resources
%TEMP%\resd.tmp
%TEMP%\drb.resources
%TEMP%\waswlmfdp.resources
%TEMP%\setup.exe
%TEMP%\svchost.exe
%TEMP%\75xo58.resources
%TEMP%\msnpsharp.dll
%TEMP%\vbffstam.0.vb
%TEMP%\vbffstam.cmdline
%TEMP%\vbffstam.out
%TEMP%\vbc1.tmp
%TEMP%\res2.tmp
%TEMP%\vbffstam.exe
%TEMP%\torpx.resources
%TEMP%\whatdafock.txt
%TEMP%\vbc6.tmp
%TEMP%\j0wzkrxv.0.vb
%TEMP%\j0wzkrxv.cmdline
%TEMP%\j0wzkrxv.out
%TEMP%\vbc3.tmp
%TEMP%\res4.tmp
%TEMP%\windowsupdate.ico
%TEMP%\bmea.resources
%TEMP%\fbpcaj.resources
%TEMP%\usihektq.0.vb
%TEMP%\usihektq.cmdline
%TEMP%\usihektq.out
%TEMP%\res7.tmp
%TEMP%\res13.tmp

Deletes the following files

%TEMP%\res2.tmp
%TEMP%\elvpob.resources
<Drive name for removable media>:\dotnetfx45_full_setup_backup.exe
%TEMP%\resd.tmp
%TEMP%\vbcc.tmp
%TEMP%\jyjjbqbi.0.vb
%TEMP%\jyjjbqbi.out
%TEMP%\jyjjbqbi.cmdline
%TEMP%\of.resources
%TEMP%\uqn.resources
<Drive name for removable media>:\wrar520_backup.exe
%TEMP%\res10.tmp
%TEMP%\znhxk-ae.0.vb
%TEMP%\fgc.resources
%TEMP%\znhxk-ae.cmdline
%TEMP%\znhxk-ae.out
%TEMP%\gfbkbbvh.resources
%TEMP%\c.resources
<Drive name for removable media>:\skypesetup_backup.exe
%TEMP%\res13.tmp
%TEMP%\vbc12.tmp
%TEMP%\m5zx3gyw.out
%TEMP%\m5zx3gyw.0.vb
%TEMP%\m5zx3gyw.cmdline
%TEMP%\gvomr.resources
%TEMP%\drb.resources
%TEMP%\vbcf.tmp
%TEMP%\xbvgoxkg.cmdline
%TEMP%\waswlmfdp.resources
%TEMP%\vbc1.tmp
%TEMP%\vbffstam.exe
%TEMP%\vbffstam.0.vb
%TEMP%\vbffstam.out
%TEMP%\vbffstam.cmdline
%TEMP%\res4.tmp
%TEMP%\vbc3.tmp
%TEMP%\j0wzkrxv.0.vb
%TEMP%\j0wzkrxv.cmdline
%TEMP%\j0wzkrxv.out
%TEMP%\torpx.resources
<Drive name for removable media>:\utorrent_backup.exe
%TEMP%\xbvgoxkg.out
%TEMP%\windowsupdate.ico
%TEMP%\res7.tmp
%TEMP%\vbc6.tmp
%TEMP%\usihektq.0.vb
%TEMP%\usihektq.cmdline
%TEMP%\usihektq.out
%TEMP%\bmea.resources
%TEMP%\fbpcaj.resources
<Drive name for removable media>:\chromesetup_backup.exe
%TEMP%\resa.tmp
%TEMP%\vbc9.tmp
%TEMP%\xbvgoxkg.0.vb
<Drive name for removable media>:\notepad_backup.exe

Substitutes the following executable files

<Drive name for removable media>:\utorrent.exe
<Drive name for removable media>:\chromesetup.exe
<Drive name for removable media>:\dotnetfx45_full_setup.exe
<Drive name for removable media>:\wrar520.exe
<Drive name for removable media>:\skypesetup.exe
<Drive name for removable media>:\notepad.exe

Substitutes the following files

<Drive name for removable media>:\utorrent_backup.exe
%TEMP%\windowsupdate.ico
<Drive name for removable media>:\chromesetup_backup.exe
<Drive name for removable media>:\dotnetfx45_full_setup_backup.exe
<Drive name for removable media>:\wrar520_backup.exe
<Drive name for removable media>:\skypesetup_backup.exe
<Drive name for removable media>:\notepad_backup.exe

Network activity

Connects to

'17#.#3.169.14':80

Miscellaneous

Creates and executes the following

'%TEMP%\svchost.exe'
'%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\vbffstam.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2.tmp" "%TEMP%\vbc1.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\j0wzkrxv.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES4.tmp" "%TEMP%\vbc3.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\usihektq.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES7.tmp" "%TEMP%\vbc6.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\xbvgoxkg.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESA.tmp" "%TEMP%\vbc9.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\jyjjbqbi.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD.tmp" "%TEMP%\vbcC.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\znhxk-ae.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES10.tmp" "%TEMP%\vbcF.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\m5zx3gyw.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES13.tmp" "%TEMP%\vbc12.tmp"' (with hidden window)

Executes the following

'%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\vbffstam.cmdline"
'%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2.tmp" "%TEMP%\vbc1.tmp"
'%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\j0wzkrxv.cmdline"
'%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES4.tmp" "%TEMP%\vbc3.tmp"
'%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\usihektq.cmdline"
'%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES7.tmp" "%TEMP%\vbc6.tmp"
'%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\xbvgoxkg.cmdline"
'%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESA.tmp" "%TEMP%\vbc9.tmp"
'%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\jyjjbqbi.cmdline"
'%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD.tmp" "%TEMP%\vbcC.tmp"
'%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\znhxk-ae.cmdline"
'%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES10.tmp" "%TEMP%\vbcF.tmp"
'%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\m5zx3gyw.cmdline"
'%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES13.tmp" "%TEMP%\vbc12.tmp"

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial