TROJ_WIGON.UWI

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following copies of itself into the affected system:

• %User Profile%\kulpogqobypy.exe

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.)

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
kulpogqobypy = "%User Profile%\kulpogqobypy.exe"

Other Details

This Trojan connects to the following possibly malicious URL:

• {BLOCKED}alty.com
• {BLOCKED}nki.com
• {BLOCKED}s.com
• {BLOCKED}eb.com
• {BLOCKED}int.co.jp
• {BLOCKED}123.com
• {BLOCKED}udios.com
• {BLOCKED}c.com.ar
• {BLOCKED}yaauto.com
• {BLOCKED}k.ru
• {BLOCKED}urity.net
• {BLOCKED}e.com.hk
• {BLOCKED}insurance.com
• {BLOCKED}readymix.com
• {BLOCKED}ks.pl
• {BLOCKED}taplar.com.tr
• {BLOCKED}deo.net
• {BLOCKED}pehr.com
• {BLOCKED}s.com
• {BLOCKED}k.net
• {BLOCKED}tem.com
• {BLOCKED}p.com.au
• {BLOCKED}ge.com
• {BLOCKED}rdim.com
• {BLOCKED}hanical.com
• {BLOCKED}2day.com
• {BLOCKED}a.edu.cn
• {BLOCKED}nvets.org
• {BLOCKED}m.com
• {BLOCKED}ess-illustrationen.de
• {BLOCKED}ni-eldercare.org
• {BLOCKED}ttomillennium.it
• {BLOCKED}nviewranch.com
• {BLOCKED}surancerates.com
• {BLOCKED}tcleaner.net
• {BLOCKED}riana.com.gt
• {BLOCKED}ro.org
• {BLOCKED}v.com
• {BLOCKED}ier.qc.ca
• {BLOCKED}esflexibles.com
• {BLOCKED}house.org
• {BLOCKED}nsmfgco.com
• {BLOCKED}ai.pt
• {BLOCKED}dence.ca
• {BLOCKED}rcommunications.com.au
• {BLOCKED}rfirearms.com
• {BLOCKED}rbracelets.com
• {BLOCKED}decacau.com.br
• {BLOCKED}s.net
• {BLOCKED}ark-travel.com
• {BLOCKED}ui.com
• {BLOCKED}owwarp.com
• {BLOCKED}st.ru
• {BLOCKED}2.com
• {BLOCKED}i.com
• {BLOCKED}ca.pl
• {BLOCKED}ra.com
• {BLOCKED}t.com
• {BLOCKED}ic-cinema.com
• {BLOCKED}ine.com
• {BLOCKED}exhibits.com
• {BLOCKED}biz.com
• {BLOCKED}enook.com
• {BLOCKED}m.com
• {BLOCKED}svale.com.br
• {BLOCKED}as.com
• {BLOCKED}nceplus.com
• {BLOCKED}hlands.org
• {BLOCKED}m.no
• {BLOCKED}s.org
• {BLOCKED}che.com
• {BLOCKED}f.com
• {BLOCKED}d.com
• {BLOCKED}efirst.com
• {BLOCKED}v.cc
• {BLOCKED}spride.com
• {BLOCKED}man-insurance.com
• {BLOCKED}estwest.com
• {BLOCKED}eit.com
• {BLOCKED}f.or.jp
• {BLOCKED}stonconstruction.com
• {BLOCKED}m.se
• {BLOCKED}ofurniture.com
• {BLOCKED}z.ru
• {BLOCKED}ompany.com
• {BLOCKED}arkco.com
• {BLOCKED}ousecordoba.com.ar
• {BLOCKED}-lampe.de
• {BLOCKED}usan.com
• {BLOCKED}o.at
• {BLOCKED}ender.com
• {BLOCKED}o.com
• {BLOCKED}nterprises.com
• {BLOCKED}2.com
• {BLOCKED}ia.biz
• {BLOCKED}technology.com
• {BLOCKED}-net.de
• {BLOCKED}a.{BLOCKED}ai.or.jp
• {BLOCKED}c.com
• {BLOCKED}chnik.com
• {BLOCKED}esa.net
• {BLOCKED}ernet.net
• {BLOCKED}vice.com
• {BLOCKED}o.org
• {BLOCKED}l.com.au
• {BLOCKED}on-merkey.com
• {BLOCKED}re.com
• {BLOCKED}glatzer.com
• {BLOCKED}c.com
• {BLOCKED}eker.com
• {BLOCKED}-sheridan.co.uk
• {BLOCKED}ookingproductions.com
• {BLOCKED}t.pe.kr
• {BLOCKED}extiles.com
• {BLOCKED}lub.com
• {BLOCKED}n.com
• {BLOCKED}ffpublishing.com
• {BLOCKED}sol.com
• {BLOCKED}mura.com
• {BLOCKED}ac.com
• {BLOCKED}ityplayhouse.org
• {BLOCKED}ga.com
• {BLOCKED}ersoft.com
• {BLOCKED}essiondz.com
• {BLOCKED}-musts.com
• {BLOCKED}tyhouse.org
• {BLOCKED}o.net
• {BLOCKED}eyallfreight.com
• {BLOCKED}la.com.mx
• {BLOCKED}-swingers.net
• {BLOCKED}ncosmeticdentistry.com
• {BLOCKED}ot.com
• {BLOCKED}l.com.br
• {BLOCKED}ar.com.br
• {BLOCKED}-condominiums.com
• {BLOCKED}rjobs.com
• {BLOCKED}365.net
• {BLOCKED}kramer.com
• {BLOCKED}ingdigital.ning.com
• {BLOCKED}piecejewels.com
• {BLOCKED}ball.org
• {BLOCKED}iniatures.com
• {BLOCKED}ne.com
• {BLOCKED}paints.com
• {BLOCKED}.com
• {BLOCKED}ki-metal.com
• {BLOCKED}clothes.com
• {BLOCKED}nwesleyan.com
• {BLOCKED}markt.com
• {BLOCKED}terprises.com
• {BLOCKED}-ww.com
• {BLOCKED}service.com
• {BLOCKED}nt.cz
• {BLOCKED}m.co.jp
• {BLOCKED}ffice.com
• {BLOCKED}a.com
• {BLOCKED}ea.co.uk
• {BLOCKED}mortgage.com
• {BLOCKED}brianpipers.org.uk
• {BLOCKED}amille.com
• {BLOCKED}n.com
• {BLOCKED}ries.com
• {BLOCKED}x.com
• {BLOCKED}media.com
• {BLOCKED}ralpercussion.com
• {BLOCKED}furniture.com
• {BLOCKED}gisayar.com
• {BLOCKED}odevillacarriedo.com
• {BLOCKED}aphics.com
• {BLOCKED}l.com
• {BLOCKED}x-group.us
• {BLOCKED}ru
• {BLOCKED}qmaquinas.com.br
• {BLOCKED}ewels.com
• {BLOCKED}z.co.uk
• {BLOCKED}focus.com.au
• {BLOCKED}se.net
• {BLOCKED}tualresearchinstitute.com
• {BLOCKED}g.com
• {BLOCKED}celain.com
• {BLOCKED}seroutelopers.be
• {BLOCKED}j.com.my
• {BLOCKED}rketing.at
• {BLOCKED}g.com
• {BLOCKED}cyinks.com
• {BLOCKED}rcinggroup.co.uk
• {BLOCKED}ldsinsure.com
• {BLOCKED}stecnica.com
• {BLOCKED}ngpin.de
• {BLOCKED}journey.com
• {BLOCKED}llsandsoriginalturtle.com
• {BLOCKED}o.no
• {BLOCKED}avikas.com
• {BLOCKED}tessori.com
• {BLOCKED}daryservices.com
• {BLOCKED}orado.com
• {BLOCKED}ta-design.com
• {BLOCKED}its.com
• {BLOCKED}sfs.com
• {BLOCKED}ble.com
• {BLOCKED}vizija.si
• {BLOCKED}vault.com
• {BLOCKED}ta.com
• {BLOCKED}vakantie.com
• {BLOCKED}ioli.com
• {BLOCKED}olska.com
• {BLOCKED}t-auto.com
• {BLOCKED}ashemales.com
• {BLOCKED}com.be
• {BLOCKED}hermannsons.org
• {BLOCKED}assage-juku.com
• {BLOCKED}ptistheritage.com
• {BLOCKED}iers.org
• {BLOCKED}ldsmith.com
• {BLOCKED}el.com
• {BLOCKED}ninvest.com
• {BLOCKED}freedom.com
• {BLOCKED}ogroup.com
• {BLOCKED}edogs.com
• {BLOCKED}ania.com
• {BLOCKED}r-coulston.co.uk
• {BLOCKED}rgroup.com
• {BLOCKED}omation.co.uk
• {BLOCKED}pnet.com
• {BLOCKED}e.ru
• {BLOCKED}m.com
• {BLOCKED}ockage.com
• {BLOCKED}ris.net
• {BLOCKED}xengineering.com
• {BLOCKED}svotreemail.com
• {BLOCKED}illie.com
• {BLOCKED}rn-consultants.co.uk
• {BLOCKED}ncourthotel.com
• {BLOCKED}yv.com
• {BLOCKED}pp.edu
• {BLOCKED}orty.com
• {BLOCKED}odo.com
• {BLOCKED}s.co.za
• {BLOCKED}amabeer.com