Trojan.Hosts.44178

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'expertlyexpertly' = '"%ProgramFiles%\Bowne\skyline.exe" 1r'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'surrounding' = '"%ProgramFiles%\Andor\skyline.exe" 1r'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'surroundingsurrounding' = '"%ProgramFiles%\Bowne\skyline.exe" 1r'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'conflate' = '"%ProgramFiles%\Andor\skyline.exe" 1r'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'saving' = '"%ProgramFiles%\separates\saving.exe" 1r'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'bouse' = '"%ProgramFiles%\Andor\skyline.exe" 1r'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'smote' = '"%ProgramFiles%\Andor\skyline.exe" 1r'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'smotesmote' = '"%ProgramFiles%\Bowne\skyline.exe" 1r'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'expertly' = '"%ProgramFiles%\Andor\skyline.exe" 1r'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'bousebouse' = '"%ProgramFiles%\Bowne\skyline.exe" 1r'

Creates or modifies the following files:

%HOMEPATH%\Start Menu\Programs\Startup\melancon.lnk

Malicious functions:

Executes the following:

'<SYSTEM32>\taskkill.exe' /im chrome.exe

Modifies file system:

Creates the following files:

%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\pj20zvlzsy18zvlzsy03kbtju03pjzvlzsy[9].asp
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\pj20zvlzsy18zvlzsy03kbtju03pjzvlzsy[8].asp
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\pj20zvlzsy18zvlzsy03kbtju03pjzvlzsy[10].asp
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\pj20zvlzsy18zvlzsy03kbtju03pjzvlzsy[12].asp
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\pj20zvlzsy18zvlzsy03kbtju03pjzvlzsy[11].asp
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\pj20zvlzsy18zvlzsy03kbtju03pjzvlzsy[7].asp
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\pj20zvlzsy18zvlzsy03kbtju03pjzvlzsy[3].asp
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\pj20zvlzsy18zvlzsy03kbtju03pjzvlzsy[2].asp
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\pj20zvlzsy18zvlzsy03kbtju03pjzvlzsy[4].asp
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\pj20zvlzsy18zvlzsy03kbtju03pjzvlzsy[6].asp
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\pj20zvlzsy18zvlzsy03kbtju03pjzvlzsy[5].asp
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\pj20zvlzsy18zvlzsy03kbtju03pjzvlzsy[13].asp
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\pj20zvlzsy18zvlzsy03kbtju03pjzvlzsy[4].asp
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\pj20zvlzsy18zvlzsy03kbtju03pjzvlzsy[3].asp
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\pj20zvlzsy18zvlzsy03kbtju03pjzvlzsy[5].asp
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\pj20zvlzsy18zvlzsy03kbtju03pjzvlzsy[7].asp
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\pj20zvlzsy18zvlzsy03kbtju03pjzvlzsy[6].asp
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\pj20zvlzsy18zvlzsy03kbtju03pjzvlzsy[2].asp
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\pj20zvlzsy18zvlzsy03kbtju03pjzvlzsy[15].asp
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\pj20zvlzsy18zvlzsy03kbtju03pjzvlzsy[14].asp
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\pj20zvlzsy18zvlzsy03kbtju03pjzvlzsy[16].asp
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\pj20zvlzsy18zvlzsy03kbtju03pjzvlzsy[1].asp
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\pj20zvlzsy18zvlzsy03kbtju03pjzvlzsy[1].asp
%TEMP%\nsp2.tmp\NMgenitive.exe
%TEMP%\nsp2.tmp\124536.exe
%TEMP%\nsp2.tmp\Microsoft.Win32.TaskScheduler.dll
%ProgramFiles%\Andor\skyline.exe
%TEMP%\nsp2.tmp\116791.exe
%TEMP%\nsp2.tmp\91140.exe
%TEMP%\nsp2.tmp\28677.exe
%TEMP%\nsp2.tmp\AccessControl.dll
%TEMP%\nsp2.tmp\31281.exe
%TEMP%\nsp2.tmp\72180.exe
%TEMP%\nsp2.tmp\67147.exe
<LS_APPDATA>\skyline.exe
%TEMP%\nsoB.tmp\nsExec.dll
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\pj20zvlzsy18zvlzsy03kbtju03pjzvlzsy[1].asp
%TEMP%\nsoB.tmp\nsC.tmp
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\pj20zvlzsy18zvlzsy03kbtju03pjzvlzsy[1].asp
%TEMP%\nshE.tmp\ShellLink.dll
%WINDIR%\skyline.exe
%ProgramFiles%\imputations\imputations.exe
%ProgramFiles%\Bowne\skyline.exe
%TEMP%\nst5.tmp\SimpleFC.dll
%ProgramFiles%\separates\saving.exe
%TEMP%\nsi7.tmp\AccessControl.dll

Deletes the following files:

%TEMP%\nshE.tmp\ShellLink.dll
%TEMP%\nsi7.tmp\AccessControl.dll
%TEMP%\nst5.tmp\SimpleFC.dll

Moves the following files:

from %WINDIR%\skyline.exe to %WINDIR%\ply.exe
from %ProgramFiles%\Andor\skyline.exe to %ProgramFiles%\Andor\skyline.dll
from %ProgramFiles%\Andor\skyline.exe to %ProgramFiles%\Andor\Andor.exe

Substitutes the following files:

%ProgramFiles%\Andor\skyline.exe

Modifies the HOSTS file.

Network activity:

Connects to:

'ro###ecce.pw':80
'localhost':1044
'localhost':1037
'localhost':1039

TCP:

HTTP GET requests:

http://www.ro###ecce.pw/pj20zvlzsy18zvlzsy03kbtju03pjzvlzsy.asp?FD################## via ro###ecce.pw

UDP:

DNS ASK www.ro###ecce.pw

Miscellaneous:

Searches for the following windows:

ClassName: 'Chrome_WidgetWin_0' WindowName: ''
ClassName: '' WindowName: ''
ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebcheckMonitor' WindowName: ''

Creates and executes the following:

'%TEMP%\nsp2.tmp\67147.exe'
'%ProgramFiles%\separates\saving.exe'
'%TEMP%\nsp2.tmp\116791.exe'
'%TEMP%\nsp2.tmp\91140.exe'
'%TEMP%\nsoB.tmp\nsC.tmp' taskkill /im chrome.exe
'%TEMP%\nsp2.tmp\72180.exe'
'%TEMP%\nsp2.tmp\NMgenitive.exe' "%ProgramFiles%\imputations\imputations.exe" "k35713769"
'%TEMP%\nsp2.tmp\31281.exe'
'%TEMP%\nsp2.tmp\124536.exe'
'%TEMP%\nsp2.tmp\NMgenitive.exe' "%ProgramFiles%\Andor\skyline.exe" "66068601"
'%TEMP%\nsp2.tmp\NMgenitive.exe' "%ProgramFiles%\Bowne\skyline.exe" "35713769"
'%ProgramFiles%\Bowne\skyline.exe' 1r
'%TEMP%\nsp2.tmp\NMgenitive.exe' "<LS_APPDATA>\skyline.exe" "76129232"