TROJ_CONECT.USR

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It deletes itself after execution.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following copies of itself into the affected system:

• %User Profile%\Local Settings\Wmi.exe

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.)

Other System Modifications

This Trojan deletes the following files:

• %User Profile%\Local Settings\Wmi.exe
• %System Root%\tmp.bat

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.. %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

Dropping Routine

This Trojan drops the following files:

• %System Root%\tmp.bat

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

Other Details

This Trojan connects to the following possibly malicious URL:

• http://{BLOCKED}.180.58:443/index.jsp?cz=xxhrkv1161670D1368
• http://{BLOCKED}6.221.174:443/page.jsp?px=hisaqe1161670D1368
• http://{BLOCKED}.180.58:443/user.jsp?xk=yfpgcz1161670D1368
• http://{BLOCKED}6.221.174:443/page.jsp?sp=aybyre1161670D1368
• http://{BLOCKED}.180.58:443/parse.jsp?an=srodft1161670D1368
• http://{BLOCKED}6.221.174:443/process.jsp?fk=xcljlk1161670D1368
• http://{BLOCKED}.180.58:443/page.jsp?dd=buapsc1161670D1368
• http://{BLOCKED}6.221.174:443/about.jsp?ne=ixjmkq1161670D1368
• http://{BLOCKED}.180.58:443/query.jsp?uy=qzqarj1161670D1368
• http://{BLOCKED}6.221.174:443/login.jsp?qm=grcujy1161670D1368
• http://{BLOCKED}.180.58:443/query.jsp?pp=berhpz1161670D1368
• http://{BLOCKED}6.221.174:443/login.jsp?di=zugexm1161670D1368
• http://{BLOCKED}.180.58:443/parse.jsp?fb=aujrzp1161670D1368
• http://{BLOCKED}6.221.174:443/query.jsp?ng=hktfba1161670D1368
• http://{BLOCKED}.180.58:443/about.jsp?zx=oiinsg1161670D1368
• http://{BLOCKED}6.221.174:443/query.jsp?sj=hpfwid1161670D1368
• http://{BLOCKED}.180.58:443/user.jsp?dn=momgom1161670D1368
• http://{BLOCKED}6.221.174:443/login.jsp?zs=ushjmo1161670D1368
• http://{BLOCKED}.180.58:443/default.jsp?yn=vzvsrx1161670D1368
• http://{BLOCKED}6.221.174:443/index.jsp?np=cbmofq1161670D1368
• http://{BLOCKED}.180.58:443/login.jsp?tp=bgqngm1161670D1368
• http://{BLOCKED}6.221.174:443/process.jsp?en=edptiw1161670D1368
• http://{BLOCKED}.180.58:443/page.jsp?pj=scutxe1161670D1368
• http://{BLOCKED}6.221.174:443/default.jsp?ht=ggbvoz1161670D1368
• http://{BLOCKED}.180.58:443/page.jsp?uj=dkktsh1161670D1368
• http://{BLOCKED}6.221.174:443/user.jsp?dv=ljkadt1161670D1368
• http://{BLOCKED}.180.58:443/default.jsp?vc=tptvzu1161670D1368
• http://{BLOCKED}6.221.174:443/page.jsp?wf=hwhvir1161670D1368
• http://{BLOCKED}.180.58:443/user.jsp?sj=lmvuew1161670D1368
• http://{BLOCKED}6.221.174:443/login.jsp?hr=gqipof1161670D1368
• http://{BLOCKED}.180.58:443/user.jsp?qv=gbaexf1161670D1368
• http://{BLOCKED}6.221.174:443/security.jsp?xp=ddjsvh1161670D1368
• http://{BLOCKED}.180.58:443/default.jsp?ml=ugrdwb1161670D1368
• http://{BLOCKED}6.221.174:443/about.jsp?wl=jidmpk1161670D1368
• http://{BLOCKED}.180.58:443/index.jsp?te=kufvjq1161670D1368
• http://{BLOCKED}6.221.174:443/about.jsp?gf=azjwwb1161670D1368
• http://{BLOCKED}.180.58:443/user.jsp?pf=xiisan1161670D1368
• http://{BLOCKED}6.221.174:443/index.jsp?mh=aoifbc1161670D1368
• http://{BLOCKED}.180.58:443/security.jsp?ti=rqwnie1161670D1368
• http://{BLOCKED}6.221.174:443/login.jsp?qh=cmgcyb1161670D1368
• http://{BLOCKED}.180.58:443/page.jsp?kq=tmdxdp1161670D1368
• http://{BLOCKED}6.221.174:443/index.jsp?lh=jrltim1161670D1368
• http://{BLOCKED}.180.58:443/security.jsp?sf=qwewsh1161670D1368
• http://{BLOCKED}6.221.174:443/index.jsp?mr=klcjpn1161670D1368
• http://{BLOCKED}.180.58:443/index.jsp?ss=zvayeg1161670D1368
• http://{BLOCKED}6.221.174:443/parse.jsp?qv=ewyuzo1161670D1368
• http://{BLOCKED}.180.58:443/default.jsp?xm=ypjvhu1161670D1368
• http://{BLOCKED}6.221.174:443/parse.jsp?du=ezwpyg1161670D1368
• http://{BLOCKED}.180.58:443/process.jsp?do=yrcesg1161670D1368
• http://{BLOCKED}6.221.174:443/login.jsp?xe=gyxjdb1161670D1368
• http://{BLOCKED}.180.58:443/page.jsp?ul=arpodh1161670D1368
• http://{BLOCKED}6.221.174:443/process.jsp?yc=qszzwv1161670D1368
• http://{BLOCKED}.180.58:443/login.jsp?sh=tmgnnd1161670D1368

It deletes itself after execution.

This report is generated via an automated analysis system.