TROJ_CUTWAIL.USVZ

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following copies of itself into the affected system:

• %User Profile%\tulgenaqixtu.exe

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.)

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
"tulgenaqixtu" = "%User Profile%\tulgenaqixtu.exe"

Other System Modifications

This Trojan adds the following registry keys:

HKEY_CURRENT_USER\Software\{random characters}

It adds the following registry entries:

HKEY_CURRENT_USER\Software\{random characters}
{random characters} = {hex values}

HKEY_CURRENT_USER\Software\{random characters}
tulgenaqixtu{random characters} = {hex values}

HKEY_CURRENT_USER\Software\Microsoft
"OSversion" = {random numbers}

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Regedit32 = %System%\regedit.exe

Other Details

This Trojan connects to the following possibly malicious URL:

• {BLOCKED}t.com
• {BLOCKED}i.net
• {BLOCKED}t.com
• {BLOCKED}s.net
• {BLOCKED}8.com
• {BLOCKED}n.com
• {BLOCKED}el.com
• {BLOCKED}a.org.eg
• {BLOCKED}t.pl
• {BLOCKED}g.com
• {BLOCKED}st.com
• {BLOCKED}c.com
• {BLOCKED}n.com
• {BLOCKED}a.net
• {BLOCKED}ni.com
• {BLOCKED}ist.ro
• {BLOCKED}a.com
• {BLOCKED}z.com.br
• {BLOCKED}ex.com
• {BLOCKED}-sa.gr
• {BLOCKED}z.nl
• {BLOCKED}r.co.id
• {BLOCKED}pe.biz
• {BLOCKED}r.cl
• {BLOCKED}ox.es
• {BLOCKED}c.si
• {BLOCKED}e.com
• {BLOCKED}or.com
• {BLOCKED}c.at
• {BLOCKED}n.com
• {BLOCKED}rk.com
• {BLOCKED}h.org
• {BLOCKED}s.net
• {BLOCKED}o.net
• {BLOCKED}x.com
• {BLOCKED}x.com
• {BLOCKED}es.com
• {BLOCKED}c.org.au
• {BLOCKED}um.com
• {BLOCKED}k.org
• {BLOCKED}t.com
• {BLOCKED}k.ca
• {BLOCKED}n.com
• {BLOCKED}c.com.sa
• {BLOCKED}n.com
• {BLOCKED}e.hu
• {BLOCKED}l.ws
• {BLOCKED}er.com
• {BLOCKED}u.com
• {BLOCKED}i.com
• {BLOCKED}le.com
• {BLOCKED}n.com
• {BLOCKED}s.com
• {BLOCKED}e.org
• {BLOCKED}l.com
• {BLOCKED}z.by
• {BLOCKED}ve.com
• {BLOCKED}era.pl
• {BLOCKED}o.com
• {BLOCKED}st.com
• {BLOCKED}t.com.tw
• {BLOCKED}i.com.ph
• {BLOCKED}er.ru
• {BLOCKED}d.com
• {BLOCKED}ly.com
• {BLOCKED}t.com
• {BLOCKED}l.com
• {BLOCKED}e.com
• {BLOCKED}ix.com
• {BLOCKED}n.com
• {BLOCKED}s.com
• {BLOCKED}i.org
• {BLOCKED}c.com
• {BLOCKED}p.net
• {BLOCKED}a.com
• {BLOCKED}o.ru
• {BLOCKED}c.com
• {BLOCKED}en.com
• {BLOCKED}nt.com
• {BLOCKED}a.com
• cnti.{BLOCKED}n.ru
• {BLOCKED}ko.com
• {BLOCKED}it.fr
• {BLOCKED}t.com
• {BLOCKED}m.com
• {BLOCKED}b.com
• {BLOCKED}up.com
• {BLOCKED}i.org
• {BLOCKED}o.edu.pl
• {BLOCKED}wn.com
• {BLOCKED}e.com
• {BLOCKED}l.org
• {BLOCKED}d.pl
• {BLOCKED}ir.com
• {BLOCKED}o.com
• {BLOCKED}iny.cz
• {BLOCKED}o.com
• {BLOCKED}ag.org
• {BLOCKED}g.net
• {BLOCKED}n.com
• {BLOCKED}s.com
• {BLOCKED}s.net
• {BLOCKED}d.de
• {BLOCKED}ng.com
• {BLOCKED}m.cz
• {BLOCKED}t.net
• {BLOCKED}t.hu
• {BLOCKED}i.net
• {BLOCKED}o.si
• {BLOCKED}a.net
• {BLOCKED}n.com
• {BLOCKED}i.com
• {BLOCKED}c.com.au
• {BLOCKED}e.net
• {BLOCKED}a.com
• {BLOCKED}ve.com
• {BLOCKED}t.org
• {BLOCKED}a.org
• {BLOCKED}er.de
• {BLOCKED}ws.com
• {BLOCKED}c.com
• {BLOCKED}k.com
• {BLOCKED}s.com
• {BLOCKED}s.org
• {BLOCKED}w.us
• {BLOCKED}a.com.pl
• {BLOCKED}n.net
• {BLOCKED}ox.bm
• {BLOCKED}t.com
• {BLOCKED}ty.com
• {BLOCKED}t.com
• {BLOCKED}le.com
• {BLOCKED}o.com
• {BLOCKED}g.com
• {BLOCKED}p.com
• {BLOCKED}s.com
• {BLOCKED}l.com
• {BLOCKED}it.org
• {BLOCKED}k.com
• {BLOCKED}c.com
• {BLOCKED}t.com
• {BLOCKED}o.ru
• {BLOCKED}me.com
• {BLOCKED}r.net
• {BLOCKED}t.com
• {BLOCKED}s.com
• {BLOCKED}c.org
• {BLOCKED}s.pt
• {BLOCKED}l.com
• {BLOCKED}f.net
• {BLOCKED}an.us
• {BLOCKED}i.com
• {BLOCKED}t.do
• {BLOCKED}x.net
• {BLOCKED}es.com
• {BLOCKED}r.hu
• {BLOCKED}t.com
• {BLOCKED}st.com
• {BLOCKED}i.com
• {BLOCKED}t.com
• {BLOCKED}i.com
• {BLOCKED}ch.pl
• {BLOCKED}us.pl
• {BLOCKED}u.net
• {BLOCKED}m.org
• {BLOCKED}r.com
• {BLOCKED}n.com
• {BLOCKED}g.com
• {BLOCKED}k.com
• {BLOCKED}o.co.uk
• {BLOCKED}f.at
• {BLOCKED}on.org
• {BLOCKED}y.net
• {BLOCKED}s.com
• {BLOCKED}r.ch
• {BLOCKED}l.com
• {BLOCKED}n.net
• {BLOCKED}me.com
• {BLOCKED}l.at
• {BLOCKED}a.fr
• {BLOCKED}y.com.pl
• {BLOCKED}m.com
• {BLOCKED}ba.com
• {BLOCKED}eb.com
• {BLOCKED}fe.com
• {BLOCKED}t.net
• {BLOCKED}il.com
• {BLOCKED}o.com
• {BLOCKED}e.com
• {BLOCKED}1.net
• {BLOCKED}go.ru
• {BLOCKED}n.com
• {BLOCKED}to.ru
• {BLOCKED}ra.com
• {BLOCKED}c.com
• {BLOCKED}ds.com
• {BLOCKED}c.co.uk
• {BLOCKED}l.co.jp
• {BLOCKED}r.com
• {BLOCKED}k.com
• {BLOCKED}a.cz
• {BLOCKED}mo.com
• {BLOCKED}o.net
• {BLOCKED}k.com
• {BLOCKED}xx.com
• {BLOCKED}ope.nl
• {BLOCKED}a.info
• {BLOCKED}s.si
• {BLOCKED}na.org
• {BLOCKED}p.com
• {BLOCKED}3.com
• {BLOCKED}n.com
• {BLOCKED}e.com
• {BLOCKED}s.com
• {BLOCKED}r.com
• {BLOCKED}ic.net
• {BLOCKED}p.net
• {BLOCKED}m.br
• {BLOCKED}ck.com
• {BLOCKED}p.hu
• {BLOCKED}b.com
• {BLOCKED}na.com
• {BLOCKED}a.com
• {BLOCKED}s.com
• {BLOCKED}n.de
• {BLOCKED}o.net
• {BLOCKED}k.nl
• {BLOCKED}s.co.uk
• {BLOCKED}r.com
• {BLOCKED}e.pl
• {BLOCKED}nx.org
• {BLOCKED}v.{BLOCKED}s.bg
• {BLOCKED}e.co.jp
• {BLOCKED}se.be
• {BLOCKED}g.org
• {BLOCKED}s.ru
• {BLOCKED}s.com
• {BLOCKED}i.com
• {BLOCKED}c.edu.au
• {BLOCKED}t.com
• {BLOCKED}ra.com
• {BLOCKED}h.ca
• {BLOCKED}a.com
• {BLOCKED}mo.com
• {BLOCKED}s.com
• {BLOCKED}a.com
• {BLOCKED}nj.com
• ora.{BLOCKED}et.jp
• {BLOCKED}o.com
• {BLOCKED}as.com
• {BLOCKED}r.org
• {BLOCKED}a.com
• {BLOCKED}m.com
• {BLOCKED}ts.ca
• {BLOCKED}i.org
• {BLOCKED}es.com
• {BLOCKED}j.net
• {BLOCKED}e.com
• {BLOCKED}cu.com
• {BLOCKED}es.com
• {BLOCKED}s.co.uk
• {BLOCKED}t.net
• {BLOCKED}s.com
• {BLOCKED}x.com
• {BLOCKED}n.com
• {BLOCKED}b.com
• {BLOCKED}n.com
• {BLOCKED}e.ua
• {BLOCKED}od.com
• {BLOCKED}me.com
• {BLOCKED}k.com
• {BLOCKED}cd.org
• {BLOCKED}a.com
• {BLOCKED}k.com
• {BLOCKED}i.cz
• {BLOCKED}d.org
• {BLOCKED}ck.com
• {BLOCKED}ok.net
• {BLOCKED}h.de
• {BLOCKED}t.se
• {BLOCKED}a.com
• {BLOCKED}l.org
• {BLOCKED}a.com
• {BLOCKED}r.com
• {BLOCKED}ia.net
• {BLOCKED}n.org
• {BLOCKED}g.com
• {BLOCKED}r.de
• {BLOCKED}n.com
• {BLOCKED}g.com
• {BLOCKED}y.com
• {BLOCKED}e.com
• {BLOCKED}w.com
• {BLOCKED}v.ro
• {BLOCKED}ek.net
• {BLOCKED}l.com
• {BLOCKED}p.org.uk
• {BLOCKED}r3.com
• {BLOCKED}k.com
• sgk.{BLOCKED}e.pl
• {BLOCKED}s.co.uk
• {BLOCKED}ts.net
• {BLOCKED}t.com
• {BLOCKED}r.com
• {BLOCKED}s.com
• {BLOCKED}le.com
• {BLOCKED}m.ru
• {BLOCKED}th.com
• {BLOCKED}r.com
• {BLOCKED}nn.com
• {BLOCKED}w.com
• {BLOCKED}s.org
• {BLOCKED}m.ru
• {BLOCKED}rl.com
• {BLOCKED}ort.ru
• {BLOCKED}r.it
• {BLOCKED}o.net
• {BLOCKED}f.it
• {BLOCKED}k.com
• {BLOCKED}er.com
• {BLOCKED}n.net
• {BLOCKED}an.com
• {BLOCKED}i.com
• {BLOCKED}al.net
• {BLOCKED}m.ch
• {BLOCKED}m.com
• {BLOCKED}c.co.uk
• {BLOCKED}c.com
• {BLOCKED}k.net
• {BLOCKED}s.net
• {BLOCKED}us.nl
• {BLOCKED}7.com
• {BLOCKED}a.com
• {BLOCKED}k.org
• {BLOCKED}en.net
• {BLOCKED}d.com
• {BLOCKED}l.com
• {BLOCKED}am.ca
• {BLOCKED}o.net
• {BLOCKED}n.com
• {BLOCKED}ib.com
• {BLOCKED}e.com
• {BLOCKED}t.jp
• {BLOCKED}s.fi
• {BLOCKED}s.com
• {BLOCKED}n.biz
• {BLOCKED}a.edu.ag
• {BLOCKED}x.org
• {BLOCKED}r.am
• {BLOCKED}s.jp
• {BLOCKED}i.it
• {BLOCKED}g.com
• {BLOCKED}r.com
• {BLOCKED}l.com
• {BLOCKED}it.com
• {BLOCKED}r.se
• {BLOCKED}ty.com
• {BLOCKED}m.com
• {BLOCKED}ia.com
• {BLOCKED}du.com
• {BLOCKED}ay.com
• {BLOCKED}is.com
• {BLOCKED}nik.dk
• {BLOCKED}i.pl
• {BLOCKED}a.com
• {BLOCKED}c.net
• {BLOCKED}nt.com
• {BLOCKED}d.com
• {BLOCKED}y.com
• {BLOCKED}s.com
• {BLOCKED}rk.com
• {BLOCKED}ll.nl
• {BLOCKED}b.com
• {BLOCKED}k.net
• {BLOCKED}t.org
• {BLOCKED}y.com
• {BLOCKED}ran.de
• {BLOCKED}us.hu
• {BLOCKED}t.de
• {BLOCKED}c.com
• {BLOCKED}6.com
• {BLOCKED}m.es
• {BLOCKED}i.net
• {BLOCKED}i.com
• {BLOCKED}t.org
• {BLOCKED}a.com
• {BLOCKED}l.com
• {BLOCKED}5.net
• {BLOCKED}c.org
• {BLOCKED}ut.com
• {BLOCKED}kor.kz
• {BLOCKED}ot.net
• {BLOCKED}l.com
• {BLOCKED}a.cz