Trojan.DownLoader32.55386

Technical Information

Modifies file system

Creates the following files

<Current directory>\d.cab
<Current directory>\$dpx$.tmp\a364f4170cb6ee4ea98f796a4f21a8dc.tmp
<Current directory>\$dpx$.tmp\73f17eaee260f644b9f99466dd5266d3.tmp
<Current directory>\$dpx$.tmp\685331bd8e56cf40acbcb453bc11f6b7.tmp
<Current directory>\$dpx$.tmp\c39274a04293fd4e9c3458fa7b1104f8.tmp
<Current directory>\$dpx$.tmp\7c0ab24310be454c90a9c37743538754.tmp
<Current directory>\$dpx$.tmp\f41109eb61244145ad3f3cba2d7e2d37.tmp
<Current directory>\$dpx$.tmp\a509499c40c5c94ab8d581401b560fb4.tmp
<Current directory>\$dpx$.tmp\b4890956bb53544babaee82c473cc4d4.tmp
<Current directory>\$dpx$.tmp\9fb51544305b5f4eac7fbbef8f42bfee.tmp
<Current directory>\$dpx$.tmp\4d5f67d66ac71a4bb8aecd3a7d36140d.tmp
<Current directory>\$dpx$.tmp\a94778d8aa77dc4bb5181a796c74bdde.tmp
<Current directory>\$dpx$.tmp\a20d5b89073d28439ad57a330d7ca71a.tmp
<Current directory>\$dpx$.tmp\69b1873f85d41240a2609d198c76579b.tmp
<Current directory>\$dpx$.tmp\31813959202fb74780eb6f4c9bf96721.tmp
<Current directory>\$dpx$.tmp\8a41cb4b5a6c9249bc8028be49c59569.tmp
<Current directory>\$dpx$.tmp\e44c16fced4408429b518ce04d6ae803.tmp
<Current directory>\$dpx$.tmp\d9e97f0e7245744786a31a16c463cc15.tmp
<Current directory>\$dpx$.tmp\15acfd417cff574e9bb3be8d148fb073.tmp
<Current directory>\$dpx$.tmp\c7047a7be10911479c8cf772b584db08.tmp
<Current directory>\$dpx$.tmp\c5fe799ba01c5d43bf0cef5a8df07f9d.tmp
<Current directory>\$dpx$.tmp\a7999246a95f8245b5d0505bbf4878d2.tmp
<Current directory>\$dpx$.tmp\9b0bf06d5f1a674abd3b0f8717b7700a.tmp
<Current directory>\$dpx$.tmp\962ba60dad51774ebb3bfed0de1e6aa8.tmp
<Current directory>\$dpx$.tmp\086863872aeb73418d8ca493f0223327.tmp
<Current directory>\$dpx$.tmp\a3f4b90381583f4782a23f9767c5f8cd.tmp
<Current directory>\$dpx$.tmp\d108102cff54ba4b87ccb757057175b0.tmp
<Current directory>\$dpx$.tmp\9dadc95fef7d2749a96bdc974301fd3c.tmp
<Current directory>\$dpx$.tmp\babe5ad9a367f449b92de229ac1c2abb.tmp
<Current directory>\$dpx$.tmp\07cab57281653f4eac32c0f75a5c16b1.tmp
<Current directory>\$dpx$.tmp\1b1aaa95a745ac499071c7892b47b545.tmp
<Current directory>\$dpx$.tmp\927355cb4ea11b44b8a46c2688b3923b.tmp
<Current directory>\$dpx$.tmp\0d20e15ee9816d43b9ffc7510af0bc5e.tmp
<Current directory>\$dpx$.tmp\315088cbbb92d3429694a5180ba3be93.tmp
<Current directory>\$dpx$.tmp\15afd90f42a30d45a0f207dabc6968e2.tmp
<Current directory>\$dpx$.tmp\8440beddaff118478bf507f2098954b3.tmp
<Current directory>\$dpx$.tmp\13625cd61fa300498363885c41e13887.tmp
<Current directory>\$dpx$.tmp\d27e2ef7cf268c44b7fc3ca21e860fc1.tmp
<Current directory>\$dpx$.tmp\5e0b45ff72672344860c617b9072f6a8.tmp
<Current directory>\$dpx$.tmp\876b4eb3a5413b4da1f8a0071fd367bb.tmp
<Current directory>\$dpx$.tmp\802306d9b3fc13428a0a6d5bbf446ad9.tmp
<Current directory>\$dpx$.tmp\dd399eb496dd1048a87996e8cad43450.tmp
<Current directory>\$dpx$.tmp\cf573a710c05e74986f00a608e93d15f.tmp
<Current directory>\$dpx$.tmp\af4351e4d20a234b802528650b328308.tmp
<Current directory>\$dpx$.tmp\bc95253ea875884da58c94489b267d2e.tmp

Sets the 'hidden' attribute to the following files

<Current directory>\api-ms-win-core-console-l1-1-0.dll
<Current directory>\api-ms-win-crt-conio-l1-1-0.dll
<Current directory>\api-ms-win-crt-convert-l1-1-0.dll
<Current directory>\api-ms-win-crt-environment-l1-1-0.dll
<Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
<Current directory>\api-ms-win-crt-heap-l1-1-0.dll
<Current directory>\api-ms-win-crt-locale-l1-1-0.dll
<Current directory>\api-ms-win-crt-math-l1-1-0.dll
<Current directory>\api-ms-win-core-timezone-l1-1-0.dll
<Current directory>\api-ms-win-core-util-l1-1-0.dll
<Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
<Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
<Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
<Current directory>\api-ms-win-crt-string-l1-1-0.dll
<Current directory>\api-ms-win-crt-time-l1-1-0.dll
<Current directory>\api-ms-win-crt-utility-l1-1-0.dll
<Current directory>\msvcp140.dll
<Current directory>\opencl.dll
<Current directory>\api-ms-win-crt-private-l1-1-0.dll
<Current directory>\api-ms-win-crt-process-l1-1-0.dll
<Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
<Current directory>\api-ms-win-core-synch-l1-2-0.dll
<Current directory>\api-ms-win-core-synch-l1-1-0.dll
<Current directory>\api-ms-win-core-debug-l1-1-0.dll
<Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-2-0.dll
<Current directory>\api-ms-win-core-file-l2-1-0.dll
<Current directory>\api-ms-win-core-handle-l1-1-0.dll
<Current directory>\api-ms-win-core-heap-l1-1-0.dll
<Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
<Current directory>\api-ms-win-core-datetime-l1-1-0.dll
<Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
<Current directory>\api-ms-win-core-memory-l1-1-0.dll
<Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
<Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
<Current directory>\api-ms-win-core-profile-l1-1-0.dll
<Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
<Current directory>\api-ms-win-core-string-l1-1-0.dll
<Current directory>\api-ms-win-core-localization-l1-2-0.dll
<Current directory>\ucrtbase.dll
<Current directory>\vcruntime140.dll

Deletes the following files

<Current directory>\d.cab

Moves the following files

from <Current directory>\$dpx$.tmp\086863872aeb73418d8ca493f0223327.tmp to <Current directory>\api-ms-win-core-console-l1-1-0.dll
from <Current directory>\$dpx$.tmp\685331bd8e56cf40acbcb453bc11f6b7.tmp to <Current directory>\api-ms-win-crt-conio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c39274a04293fd4e9c3458fa7b1104f8.tmp to <Current directory>\api-ms-win-crt-convert-l1-1-0.dll
from <Current directory>\$dpx$.tmp\7c0ab24310be454c90a9c37743538754.tmp to <Current directory>\api-ms-win-crt-environment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f41109eb61244145ad3f3cba2d7e2d37.tmp to <Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a509499c40c5c94ab8d581401b560fb4.tmp to <Current directory>\api-ms-win-crt-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\b4890956bb53544babaee82c473cc4d4.tmp to <Current directory>\api-ms-win-crt-locale-l1-1-0.dll
from <Current directory>\$dpx$.tmp\9fb51544305b5f4eac7fbbef8f42bfee.tmp to <Current directory>\api-ms-win-crt-math-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a364f4170cb6ee4ea98f796a4f21a8dc.tmp to <Current directory>\api-ms-win-core-timezone-l1-1-0.dll
from <Current directory>\$dpx$.tmp\73f17eaee260f644b9f99466dd5266d3.tmp to <Current directory>\api-ms-win-core-util-l1-1-0.dll
from <Current directory>\$dpx$.tmp\4d5f67d66ac71a4bb8aecd3a7d36140d.tmp to <Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
from <Current directory>\$dpx$.tmp\69b1873f85d41240a2609d198c76579b.tmp to <Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\31813959202fb74780eb6f4c9bf96721.tmp to <Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\8a41cb4b5a6c9249bc8028be49c59569.tmp to <Current directory>\api-ms-win-crt-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e44c16fced4408429b518ce04d6ae803.tmp to <Current directory>\api-ms-win-crt-time-l1-1-0.dll
from <Current directory>\$dpx$.tmp\d9e97f0e7245744786a31a16c463cc15.tmp to <Current directory>\api-ms-win-crt-utility-l1-1-0.dll
from <Current directory>\$dpx$.tmp\15acfd417cff574e9bb3be8d148fb073.tmp to <Current directory>\msvcp140.dll
from <Current directory>\$dpx$.tmp\c7047a7be10911479c8cf772b584db08.tmp to <Current directory>\opencl.dll
from <Current directory>\$dpx$.tmp\a94778d8aa77dc4bb5181a796c74bdde.tmp to <Current directory>\api-ms-win-crt-private-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a20d5b89073d28439ad57a330d7ca71a.tmp to <Current directory>\api-ms-win-crt-process-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c5fe799ba01c5d43bf0cef5a8df07f9d.tmp to <Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
from <Current directory>\$dpx$.tmp\9b0bf06d5f1a674abd3b0f8717b7700a.tmp to <Current directory>\api-ms-win-core-synch-l1-2-0.dll
from <Current directory>\$dpx$.tmp\af4351e4d20a234b802528650b328308.tmp to <Current directory>\api-ms-win-core-synch-l1-1-0.dll
from <Current directory>\$dpx$.tmp\d108102cff54ba4b87ccb757057175b0.tmp to <Current directory>\api-ms-win-core-debug-l1-1-0.dll
from <Current directory>\$dpx$.tmp\9dadc95fef7d2749a96bdc974301fd3c.tmp to <Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
from <Current directory>\$dpx$.tmp\babe5ad9a367f449b92de229ac1c2abb.tmp to <Current directory>\api-ms-win-core-file-l1-1-0.dll
from <Current directory>\$dpx$.tmp\07cab57281653f4eac32c0f75a5c16b1.tmp to <Current directory>\api-ms-win-core-file-l1-2-0.dll
from <Current directory>\$dpx$.tmp\1b1aaa95a745ac499071c7892b47b545.tmp to <Current directory>\api-ms-win-core-file-l2-1-0.dll
from <Current directory>\$dpx$.tmp\927355cb4ea11b44b8a46c2688b3923b.tmp to <Current directory>\api-ms-win-core-handle-l1-1-0.dll
from <Current directory>\$dpx$.tmp\0d20e15ee9816d43b9ffc7510af0bc5e.tmp to <Current directory>\api-ms-win-core-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\315088cbbb92d3429694a5180ba3be93.tmp to <Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a3f4b90381583f4782a23f9767c5f8cd.tmp to <Current directory>\api-ms-win-core-datetime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\15afd90f42a30d45a0f207dabc6968e2.tmp to <Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
from <Current directory>\$dpx$.tmp\13625cd61fa300498363885c41e13887.tmp to <Current directory>\api-ms-win-core-memory-l1-1-0.dll
from <Current directory>\$dpx$.tmp\d27e2ef7cf268c44b7fc3ca21e860fc1.tmp to <Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
from <Current directory>\$dpx$.tmp\5e0b45ff72672344860c617b9072f6a8.tmp to <Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\876b4eb3a5413b4da1f8a0071fd367bb.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
from <Current directory>\$dpx$.tmp\802306d9b3fc13428a0a6d5bbf446ad9.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
from <Current directory>\$dpx$.tmp\dd399eb496dd1048a87996e8cad43450.tmp to <Current directory>\api-ms-win-core-profile-l1-1-0.dll
from <Current directory>\$dpx$.tmp\cf573a710c05e74986f00a608e93d15f.tmp to <Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
from <Current directory>\$dpx$.tmp\962ba60dad51774ebb3bfed0de1e6aa8.tmp to <Current directory>\api-ms-win-core-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\8440beddaff118478bf507f2098954b3.tmp to <Current directory>\api-ms-win-core-localization-l1-2-0.dll
from <Current directory>\$dpx$.tmp\a7999246a95f8245b5d0505bbf4878d2.tmp to <Current directory>\ucrtbase.dll
from <Current directory>\$dpx$.tmp\bc95253ea875884da58c94489b267d2e.tmp to <Current directory>\vcruntime140.dll

Network activity

TCP

'lp##.abbny.com':443
'lp##.haqo.net':443

UDP

DNS ASK lp##.beahh.com
DNS ASK lp##.abbny.com
DNS ASK lp##.haqo.net

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a
'<SYSTEM32>\expand.exe' d.cab -f:* .

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней