Trojan.DownLoader32.55339

Technical Information

Modifies file system

Creates the following files

<Current directory>\d.cab
<Current directory>\$dpx$.tmp\f20b56a635914d4492eb792b77b13bc7.tmp
<Current directory>\$dpx$.tmp\089198797a5b504282082d99cb7f9b8e.tmp
<Current directory>\$dpx$.tmp\0951a932c9cbf7498f008c20b49ad20a.tmp
<Current directory>\$dpx$.tmp\ebf6190352f0c04fa2b9446ff02ce033.tmp
<Current directory>\$dpx$.tmp\28d369e35079af41a4887016edd68955.tmp
<Current directory>\$dpx$.tmp\28481000635881429d9165028f88ca4c.tmp
<Current directory>\$dpx$.tmp\1b210537ba461449b16246f89125f222.tmp
<Current directory>\$dpx$.tmp\b3c787db2142cc4f97f08f0cea97e00c.tmp
<Current directory>\$dpx$.tmp\cf8e8f51beb05446b76e3f3e5fcdfde4.tmp
<Current directory>\$dpx$.tmp\4d7daddef1a09e41af86dc3bf89b4c22.tmp
<Current directory>\$dpx$.tmp\5755a07a9f81694699b3eda8a25fe8a8.tmp
<Current directory>\$dpx$.tmp\7c570bed8f556a40b2dda922adba4b6b.tmp
<Current directory>\$dpx$.tmp\d66321010c8f6b40a53cbeb0107d82be.tmp
<Current directory>\$dpx$.tmp\a2db48a776ca4e4083a4cfada417cf33.tmp
<Current directory>\$dpx$.tmp\8aef3c4fd9d7994faf1b513dc7c48f58.tmp
<Current directory>\$dpx$.tmp\e974c2f1a42ebf4c91aa73021529b0d4.tmp
<Current directory>\$dpx$.tmp\6eda633bcc0481419bc6f1505a0d46cd.tmp
<Current directory>\$dpx$.tmp\9e026c3ee6bb0746a31e2db2d8163596.tmp
<Current directory>\$dpx$.tmp\2501ba4e85fcdd4a8e4d795b3acde8bd.tmp
<Current directory>\$dpx$.tmp\4268d0026e88d3479849adf2d07990e2.tmp
<Current directory>\$dpx$.tmp\85fb8f7b9a86db4584eb5fba61e65f33.tmp
<Current directory>\$dpx$.tmp\4f0ed5263e511549a52ec69904916d08.tmp
<Current directory>\$dpx$.tmp\8c9bfc4cbbf90b4b90b0075f2f8a3377.tmp
<Current directory>\$dpx$.tmp\aafa80fa13da7e43b1c9924bca32bd7e.tmp
<Current directory>\$dpx$.tmp\33a74889a488fe42b628ecea6f8efcd5.tmp
<Current directory>\$dpx$.tmp\1f2b52a44b7dcb46ac7c7880d4b5b10b.tmp
<Current directory>\$dpx$.tmp\bcce17c867956844b3c2dab1c5860995.tmp
<Current directory>\$dpx$.tmp\a7301eae2785b749981fd609df0ae966.tmp
<Current directory>\$dpx$.tmp\56ca8bf199368f488bdc2a0359f99a48.tmp
<Current directory>\$dpx$.tmp\2540bbf5012d4242b5531adc370da73d.tmp
<Current directory>\$dpx$.tmp\8909875de3012848b8f70b59fff9efcf.tmp
<Current directory>\$dpx$.tmp\58e6c4a257299d4cbb10206c1909f3f6.tmp
<Current directory>\$dpx$.tmp\25c5375ebe8b86499f3d910191554dfc.tmp
<Current directory>\$dpx$.tmp\00869c547881b140ad3cdf02930a9ff3.tmp
<Current directory>\$dpx$.tmp\65314205f0c7bf448670d6be0e52ef8e.tmp
<Current directory>\$dpx$.tmp\a0e5bb64cf62cf48be0abc3d76ec1287.tmp
<Current directory>\$dpx$.tmp\dc07571c41de264a8bdff78dedc03bb2.tmp
<Current directory>\$dpx$.tmp\0f4af55bcbe2894b97214b48a9612552.tmp
<Current directory>\$dpx$.tmp\9e20bee7177f074abb9fa2ed395a0c26.tmp
<Current directory>\$dpx$.tmp\1fdb9265ec71554fb3ae2eb0530a5e53.tmp
<Current directory>\$dpx$.tmp\220807cd483c73488ec20b68af465c67.tmp
<Current directory>\$dpx$.tmp\741bf0e1868b1f40b1f3419ef10715d9.tmp
<Current directory>\$dpx$.tmp\ec3a3bd656733e4fba8bc60fa1489cff.tmp
<Current directory>\$dpx$.tmp\43add3e60fa9f8429e39ee6c3685944e.tmp

Sets the 'hidden' attribute to the following files

<Current directory>\api-ms-win-core-console-l1-1-0.dll
<Current directory>\api-ms-win-crt-conio-l1-1-0.dll
<Current directory>\api-ms-win-crt-convert-l1-1-0.dll
<Current directory>\api-ms-win-crt-environment-l1-1-0.dll
<Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
<Current directory>\api-ms-win-crt-heap-l1-1-0.dll
<Current directory>\api-ms-win-crt-locale-l1-1-0.dll
<Current directory>\api-ms-win-crt-math-l1-1-0.dll
<Current directory>\api-ms-win-core-timezone-l1-1-0.dll
<Current directory>\api-ms-win-core-util-l1-1-0.dll
<Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
<Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
<Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
<Current directory>\api-ms-win-crt-string-l1-1-0.dll
<Current directory>\api-ms-win-crt-time-l1-1-0.dll
<Current directory>\api-ms-win-crt-utility-l1-1-0.dll
<Current directory>\msvcp140.dll
<Current directory>\opencl.dll
<Current directory>\api-ms-win-crt-private-l1-1-0.dll
<Current directory>\api-ms-win-crt-process-l1-1-0.dll
<Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
<Current directory>\api-ms-win-core-synch-l1-2-0.dll
<Current directory>\api-ms-win-core-synch-l1-1-0.dll
<Current directory>\api-ms-win-core-debug-l1-1-0.dll
<Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-2-0.dll
<Current directory>\api-ms-win-core-file-l2-1-0.dll
<Current directory>\api-ms-win-core-handle-l1-1-0.dll
<Current directory>\api-ms-win-core-heap-l1-1-0.dll
<Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
<Current directory>\api-ms-win-core-datetime-l1-1-0.dll
<Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
<Current directory>\api-ms-win-core-memory-l1-1-0.dll
<Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
<Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
<Current directory>\api-ms-win-core-profile-l1-1-0.dll
<Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
<Current directory>\api-ms-win-core-string-l1-1-0.dll
<Current directory>\api-ms-win-core-localization-l1-2-0.dll
<Current directory>\ucrtbase.dll
<Current directory>\vcruntime140.dll

Deletes the following files

<Current directory>\d.cab

Moves the following files

from <Current directory>\$dpx$.tmp\aafa80fa13da7e43b1c9924bca32bd7e.tmp to <Current directory>\api-ms-win-core-console-l1-1-0.dll
from <Current directory>\$dpx$.tmp\0951a932c9cbf7498f008c20b49ad20a.tmp to <Current directory>\api-ms-win-crt-conio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ebf6190352f0c04fa2b9446ff02ce033.tmp to <Current directory>\api-ms-win-crt-convert-l1-1-0.dll
from <Current directory>\$dpx$.tmp\28d369e35079af41a4887016edd68955.tmp to <Current directory>\api-ms-win-crt-environment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\28481000635881429d9165028f88ca4c.tmp to <Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
from <Current directory>\$dpx$.tmp\1b210537ba461449b16246f89125f222.tmp to <Current directory>\api-ms-win-crt-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\b3c787db2142cc4f97f08f0cea97e00c.tmp to <Current directory>\api-ms-win-crt-locale-l1-1-0.dll
from <Current directory>\$dpx$.tmp\cf8e8f51beb05446b76e3f3e5fcdfde4.tmp to <Current directory>\api-ms-win-crt-math-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f20b56a635914d4492eb792b77b13bc7.tmp to <Current directory>\api-ms-win-core-timezone-l1-1-0.dll
from <Current directory>\$dpx$.tmp\089198797a5b504282082d99cb7f9b8e.tmp to <Current directory>\api-ms-win-core-util-l1-1-0.dll
from <Current directory>\$dpx$.tmp\4d7daddef1a09e41af86dc3bf89b4c22.tmp to <Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
from <Current directory>\$dpx$.tmp\d66321010c8f6b40a53cbeb0107d82be.tmp to <Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a2db48a776ca4e4083a4cfada417cf33.tmp to <Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\8aef3c4fd9d7994faf1b513dc7c48f58.tmp to <Current directory>\api-ms-win-crt-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e974c2f1a42ebf4c91aa73021529b0d4.tmp to <Current directory>\api-ms-win-crt-time-l1-1-0.dll
from <Current directory>\$dpx$.tmp\6eda633bcc0481419bc6f1505a0d46cd.tmp to <Current directory>\api-ms-win-crt-utility-l1-1-0.dll
from <Current directory>\$dpx$.tmp\9e026c3ee6bb0746a31e2db2d8163596.tmp to <Current directory>\msvcp140.dll
from <Current directory>\$dpx$.tmp\2501ba4e85fcdd4a8e4d795b3acde8bd.tmp to <Current directory>\opencl.dll
from <Current directory>\$dpx$.tmp\5755a07a9f81694699b3eda8a25fe8a8.tmp to <Current directory>\api-ms-win-crt-private-l1-1-0.dll
from <Current directory>\$dpx$.tmp\7c570bed8f556a40b2dda922adba4b6b.tmp to <Current directory>\api-ms-win-crt-process-l1-1-0.dll
from <Current directory>\$dpx$.tmp\4268d0026e88d3479849adf2d07990e2.tmp to <Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
from <Current directory>\$dpx$.tmp\4f0ed5263e511549a52ec69904916d08.tmp to <Current directory>\api-ms-win-core-synch-l1-2-0.dll
from <Current directory>\$dpx$.tmp\ec3a3bd656733e4fba8bc60fa1489cff.tmp to <Current directory>\api-ms-win-core-synch-l1-1-0.dll
from <Current directory>\$dpx$.tmp\1f2b52a44b7dcb46ac7c7880d4b5b10b.tmp to <Current directory>\api-ms-win-core-debug-l1-1-0.dll
from <Current directory>\$dpx$.tmp\bcce17c867956844b3c2dab1c5860995.tmp to <Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a7301eae2785b749981fd609df0ae966.tmp to <Current directory>\api-ms-win-core-file-l1-1-0.dll
from <Current directory>\$dpx$.tmp\56ca8bf199368f488bdc2a0359f99a48.tmp to <Current directory>\api-ms-win-core-file-l1-2-0.dll
from <Current directory>\$dpx$.tmp\2540bbf5012d4242b5531adc370da73d.tmp to <Current directory>\api-ms-win-core-file-l2-1-0.dll
from <Current directory>\$dpx$.tmp\8909875de3012848b8f70b59fff9efcf.tmp to <Current directory>\api-ms-win-core-handle-l1-1-0.dll
from <Current directory>\$dpx$.tmp\58e6c4a257299d4cbb10206c1909f3f6.tmp to <Current directory>\api-ms-win-core-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\25c5375ebe8b86499f3d910191554dfc.tmp to <Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
from <Current directory>\$dpx$.tmp\33a74889a488fe42b628ecea6f8efcd5.tmp to <Current directory>\api-ms-win-core-datetime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\00869c547881b140ad3cdf02930a9ff3.tmp to <Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a0e5bb64cf62cf48be0abc3d76ec1287.tmp to <Current directory>\api-ms-win-core-memory-l1-1-0.dll
from <Current directory>\$dpx$.tmp\dc07571c41de264a8bdff78dedc03bb2.tmp to <Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
from <Current directory>\$dpx$.tmp\0f4af55bcbe2894b97214b48a9612552.tmp to <Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\9e20bee7177f074abb9fa2ed395a0c26.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
from <Current directory>\$dpx$.tmp\1fdb9265ec71554fb3ae2eb0530a5e53.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
from <Current directory>\$dpx$.tmp\220807cd483c73488ec20b68af465c67.tmp to <Current directory>\api-ms-win-core-profile-l1-1-0.dll
from <Current directory>\$dpx$.tmp\741bf0e1868b1f40b1f3419ef10715d9.tmp to <Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
from <Current directory>\$dpx$.tmp\8c9bfc4cbbf90b4b90b0075f2f8a3377.tmp to <Current directory>\api-ms-win-core-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\65314205f0c7bf448670d6be0e52ef8e.tmp to <Current directory>\api-ms-win-core-localization-l1-2-0.dll
from <Current directory>\$dpx$.tmp\85fb8f7b9a86db4584eb5fba61e65f33.tmp to <Current directory>\ucrtbase.dll
from <Current directory>\$dpx$.tmp\43add3e60fa9f8429e39ee6c3685944e.tmp to <Current directory>\vcruntime140.dll

Network activity

TCP

'lp##.abbny.com':443
'lp##.haqo.net':443

UDP

DNS ASK lp##.beahh.com
DNS ASK lp##.abbny.com
DNS ASK lp##.haqo.net

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a
'<SYSTEM32>\expand.exe' d.cab -f:* .

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней