TROJ_DROPPR.UT

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It deletes itself after execution.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Other System Modifications

This Trojan deletes the following files:

• %User Profile%\Local Settings\WmdmPmSN.exe

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.)

Dropping Routine

This Trojan drops the following files:

• %User Temp%\~D35463.tmp
• %User Temp%\~D35464.tmp
• %User Profile%\Local Settings\WmdmPmSN.exe

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.. %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.)

Other Details

This Trojan connects to the following possibly malicious URL:

• http://roudan.{BLOCKED}tp.com:443/default.jsp?nn=nojvdg1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/page.jsp?uz=plfjhc1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/index.jsp?bd=koxddd1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/default.jsp?ot=zlkgtt1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/login.jsp?at=rtctbi1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/default.jsp?mk=gkmiit1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/security.jsp?jl=bydxst1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/page.jsp?ex=pieblj1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/process.jsp?vw=cagbbi1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/security.jsp?ll=oclmur1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/page.jsp?zt=dbsekd1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/index.jsp?mg=jcsyvr1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/index.jsp?of=hluqej1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/parse.jsp?ou=qvuktg1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/query.jsp?kw=tgfvyg1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/default.jsp?ac=yddyxg1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/query.jsp?pu=wjitdn1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/index.jsp?ie=jkjdxe1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/parse.jsp?ko=xvxclu1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/parse.jsp?tx=yloxry1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/parse.jsp?yo=etapft1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/page.jsp?ll=jhgrsb1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/default.jsp?ck=nvnqrt1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/index.jsp?zx=jcfejc1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/login.jsp?fj=iovdca1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/default.jsp?ic=bglyab1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/user.jsp?nr=erojcl1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/default.jsp?ms=yzmdpm1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/query.jsp?xt=uyxvzs1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/default.jsp?ms=gyurbe1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/security.jsp?gg=insnnp1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/login.jsp?ze=wgouws1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/about.jsp?iz=ximwmr1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/security.jsp?qk=ktrbvx1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/login.jsp?bf=abwsbs1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/login.jsp?pi=jffoxw1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/default.jsp?rf=fkgths1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/parse.jsp?qr=guhdiu1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/process.jsp?om=qxyzkt1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/security.jsp?iv=eetltk1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/user.jsp?sa=djdqlb1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/security.jsp?bi=unlgqw1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/user.jsp?yg=dzemuk1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/page.jsp?lq=tjhyef1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/login.jsp?iu=ogszqg1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/parse.jsp?xj=mmgyqw1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/parse.jsp?ln=hnltus1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/page.jsp?pq=kvzejq1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/process.jsp?ir=hjlvaw1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/process.jsp?ik=udxclt1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/default.jsp?zh=ywthqp1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/login.jsp?gl=hdicus1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/default.jsp?oh=wlsjeg1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/index.jsp?sa=ihyjhn1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/about.jsp?eu=jzogbr1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/security.jsp?dr=ktwwgw1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/page.jsp?au=efstng1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/query.jsp?jv=uadauw1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/index.jsp?mu=lcxcsl1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/login.jsp?nl=vafcae1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/page.jsp?eb=nhydcs1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/process.jsp?as=igvoiw1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/index.jsp?ze=fxsuhv1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/page.jsp?rv=uwjivy1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/user.jsp?ts=votdwm1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/login.jsp?km=skocej1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/page.jsp?xq=xnxcxc1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/query.jsp?ml=auqjbd1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/page.jsp?rn=hkozkx1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/user.jsp?yu=ekfepx1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/login.jsp?eo=pnzezd1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/default.jsp?to=srnkkq1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/login.jsp?bm=xjdanz1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/page.jsp?bp=pbctnq1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/query.jsp?bk=hitivv1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/default.jsp?ny=ujvszk1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/security.jsp?jf=ucaerb1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/query.jsp?oq=xchfdj1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/login.jsp?ii=feyepy1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/security.jsp?of=dtpoke1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/page.jsp?zz=putbvb1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/index.jsp?ln=nqbxzn1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/index.jsp?jl=tkgmzg1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/login.jsp?ye=vlkbph1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/default.jsp?jn=fscwnx1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/parse.jsp?co=jxvnng1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/page.jsp?xg=axgbmh1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/about.jsp?mf=ftjfyb1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/process.jsp?ei=ujcsgx1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/user.jsp?yy=gvwebe1161670G5G9F
• http://roudan.{BLOCKED}tp.com:80/page.jsp?gx=ytwxgg1161670G5G9F

It deletes itself after execution.

This report is generated via an automated analysis system.