Trojan.DownLoader25.50979

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%ALLUSERSPROFILE%\Start Menu\Programs\Startup\Olg7xBaM.lnk
%HOMEPATH%\Start Menu\Programs\Startup\Olg7xBaM.lnk

Malicious functions:

Creates and executes the following:

'%TEMP%\BUIrA0aA.exe' "%APPDATA%\Xc5uHH2YUFHu\" "MnSic8T9utOLgY30" "195_LESS_1GB" "60000"
'%TEMP%\oTu9eBTt.exe' "%APPDATA%\Xc5uHH2YUFHu\" "MnSic8T9utOLgY30" "CIP_STARTED" "60000"
'%TEMP%\f85UYn6j.exe' "%APPDATA%\Xc5uHH2YUFHu\" "MnSic8T9utOLgY30" "LOCAL_42CF59498965DC8E" "60000"
'%APPDATA%\Xc5uHH2YUFHu\Olg7xBaM.exe' MnSic8T9utOLgY30
'%APPDATA%\Microsoft\rZR7oSd3.exe' "%APPDATA%\Xc5uHH2YUFHu\Olg7xBaM.exe" "<LS_APPDATA>\Microsoft\ALyKALS5.exe" 1

Executes the following:

'<SYSTEM32>\cmd.exe' /C type "%APPDATA%\WHATHA~1.RTF" > "C:\Far2\Plugins\7-Zip\WhatHappenedWithFiles.rtf"
'<SYSTEM32>\cmd.exe' /C type "%APPDATA%\WHATHA~1.RTF" > "C:\Far2\Plugins\Colorer\hrc\WhatHappenedWithFiles.rtf"
'<SYSTEM32>\cmd.exe' /C type "%APPDATA%\WHATHA~1.RTF" > "C:\Far2\Documentation\rus\WhatHappenedWithFiles.rtf"
'<SYSTEM32>\cmd.exe' /C type "%APPDATA%\WHATHA~1.RTF" > "C:\Far2\Addons\WhatHappenedWithFiles.rtf"
'<SYSTEM32>\cmd.exe' /C type "%APPDATA%\WHATHA~1.RTF" > "C:\Far2\Documentation\eng\WhatHappenedWithFiles.rtf"
'<SYSTEM32>\cmd.exe' /C type "%APPDATA%\WHATHA~1.RTF" > "C:\Far2\Plugins\ExtSearch\doc\WhatHappenedWithFiles.rtf"
'<SYSTEM32>\cacls.exe' "Z:\.live" /E /G %USERNAME%:F /C
'<SYSTEM32>\cmd.exe' /C type "%APPDATA%\Microsoft\rZR7oSd3.exe" > "<LS_APPDATA>\Microsoft\ALyKALS5.exe" && "<LS_APPDATA>\Microsoft\ALyKALS5.exe" "%APPDATA%\Xc5uHH2YUFHu\Olg7xBaM.exe" "%APPDATA%\Microsoft\rZR7oSd3.e...
'<SYSTEM32>\cmd.exe' /C CACLS "Z:\.live" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "Z:\.live"
'<SYSTEM32>\cmd.exe' /C type "%APPDATA%\WHATHA~1.RTF" > "C:\Far2\Plugins\FTP\WhatHappenedWithFiles.rtf"
'<SYSTEM32>\cmd.exe' /C type "%APPDATA%\WHATHA~1.RTF" > "<STUBS_DIR>\WhatHappenedWithFiles.rtf"
'<SYSTEM32>\cmd.exe' /C type "%APPDATA%\WHATHA~1.RTF" > "%HOMEPATH%\Templates\WhatHappenedWithFiles.rtf"
'<SYSTEM32>\cmd.exe' /C type "%APPDATA%\Xc5uHH2YUFHu\Olg7xBaM.exe" > "%APPDATA%\Microsoft\rZR7oSd3.exe" && "%APPDATA%\Microsoft\rZR7oSd3.exe" "%APPDATA%\Xc5uHH2YUFHu\Olg7xBaM.exe" "<LS_APPDATA>\Microsoft\ALyKALS5.e...
'<SYSTEM32>\cmd.exe' /C type "%APPDATA%\Xc5uHH2YUFHu\Olg7xBaM.exe" > "<LS_APPDATA>\Microsoft\ALyKALS5.exe" && "<LS_APPDATA>\Microsoft\ALyKALS5.exe" "%APPDATA%\Xc5uHH2YUFHu\Olg7xBaM.exe" "%APPDATA%\Microsoft\rZR7oSd...
'<SYSTEM32>\cmd.exe' /C "%APPDATA%\Xc5uHH2YUFHu\YDL17jIT.cmd"
'<SYSTEM32>\cmd.exe' /C type "<Full path to file>" > "%APPDATA%\XC5UHH~1\Olg7xBaM.exe"
'<SYSTEM32>\cmd.exe' /C type "%APPDATA%\Xc5uHH2YUFHu\Olg7xBaM.exe" > "%TEMP%\hhWcNs6Y.exe" && "%TEMP%\hhWcNs6Y.exe" "%APPDATA%\Xc5uHH2YUFHu\" "MnSic8T9utOLgY30" "START" "60000"
'<SYSTEM32>\ping.exe' -n 3 localhost
'<SYSTEM32>\cmd.exe' /C type "%APPDATA%\Xc5uHH2YUFHu\Olg7xBaM.exe" > "%TEMP%\HdZVKPYK.exe" && "%TEMP%\HdZVKPYK.exe" "%APPDATA%\Xc5uHH2YUFHu\" "MnSic8T9utOLgY30" "FILESEXTLIST" "60000" "%APPDATA%\Xc5uHH2YUFHu\MnSic8...
'<SYSTEM32>\cmd.exe' /C type "%APPDATA%\Xc5uHH2YUFHu\Olg7xBaM.exe" > "%TEMP%\oTu9eBTt.exe" && "%TEMP%\oTu9eBTt.exe" "%APPDATA%\Xc5uHH2YUFHu\" "MnSic8T9utOLgY30" "CIP_STARTED" "60000"
'<SYSTEM32>\cmd.exe' /C type "%APPDATA%\Xc5uHH2YUFHu\Olg7xBaM.exe" > "%TEMP%\BUIrA0aA.exe" && "%TEMP%\BUIrA0aA.exe" "%APPDATA%\Xc5uHH2YUFHu\" "MnSic8T9utOLgY30" "195_LESS_1GB" "60000"
'<SYSTEM32>\cmd.exe' /C type "%APPDATA%\Xc5uHH2YUFHu\Olg7xBaM.exe" > "%TEMP%\f85UYn6j.exe" && "%TEMP%\f85UYn6j.exe" "%APPDATA%\Xc5uHH2YUFHu\" "MnSic8T9utOLgY30" "LOCAL_42CF59498965DC8E" "60000"
'<SYSTEM32>\cmd.exe' /C type "%APPDATA%\Xc5uHH2YUFHu\Olg7xBaM.exe" > "%TEMP%\ggVaU5DT.exe" && "%TEMP%\ggVaU5DT.exe" "%APPDATA%\Xc5uHH2YUFHu\" "MnSic8T9utOLgY30" "WIN_5.1_32|ADMIN_YES|INT_0" "60000"