Trojan.DownLoader32.57289

Technical Information

Modifies file system

Creates the following files

<Current directory>\d.cab
<Current directory>\$dpx$.tmp\c2828c95ea70294abbfa8c85aa39ddef.tmp
<Current directory>\$dpx$.tmp\a5bcde7fff437c43af94b172ea653308.tmp
<Current directory>\$dpx$.tmp\b76485d9083c534da8c1979af21ddc80.tmp
<Current directory>\$dpx$.tmp\689132cc5b86ab49a43bcd1f3484cda2.tmp
<Current directory>\$dpx$.tmp\9478b8af9fd7e54fa859cfa86808367b.tmp
<Current directory>\$dpx$.tmp\f2bbee883a83bf4c9ccc70a81d122a43.tmp
<Current directory>\$dpx$.tmp\edf416019c3525459cd6c96a2f834d8d.tmp
<Current directory>\$dpx$.tmp\b1e910cf1e68ed4ab01f65f6c6225608.tmp
<Current directory>\$dpx$.tmp\d6f6e6f903856b4a824091e640530fcd.tmp
<Current directory>\$dpx$.tmp\9d244914575c7b40bda89ea8107ee46d.tmp
<Current directory>\$dpx$.tmp\0e85a237d6e29241bdadf32ab29c18c8.tmp
<Current directory>\$dpx$.tmp\070b9fd98e5e914abb8599e3a640e0e2.tmp
<Current directory>\$dpx$.tmp\235111ba22de824ab489cde42f87305f.tmp
<Current directory>\$dpx$.tmp\d01147bc4cc30c4495178860959c257f.tmp
<Current directory>\$dpx$.tmp\75c2d1fc897f5b418f03852621aad5b7.tmp
<Current directory>\$dpx$.tmp\2dd26fa019e4e543adf39f57cff07e19.tmp
<Current directory>\$dpx$.tmp\fa542c3f6cb4cd40b6cb9be6d6fadc84.tmp
<Current directory>\$dpx$.tmp\32455ffb5f40ba46b4cc2b56751ca318.tmp
<Current directory>\$dpx$.tmp\5b00465a54d61145b84698c456073781.tmp
<Current directory>\$dpx$.tmp\55fafcd60cb8bd4da18385ff9dfb55c3.tmp
<Current directory>\$dpx$.tmp\5b818c0faa40cb40ada64819db6b0151.tmp
<Current directory>\$dpx$.tmp\7efd66905e1c0342919381cc0fcbe773.tmp
<Current directory>\$dpx$.tmp\ab505dee619bca4eb5f0f9f05149aac5.tmp
<Current directory>\$dpx$.tmp\d4a5a64875ac3d419c5b7461137231d0.tmp
<Current directory>\$dpx$.tmp\2ffa0994c83f6d49a28ab5b7a9c73236.tmp
<Current directory>\$dpx$.tmp\d9478b12a8d9fe40bd091e0af3447729.tmp
<Current directory>\$dpx$.tmp\a8832c1fa5d6a449812d51588ad73961.tmp
<Current directory>\$dpx$.tmp\197e74afcf69c946a23fc46bd60132ed.tmp
<Current directory>\$dpx$.tmp\ee0dc80b1415e14db62887bdec0addb1.tmp
<Current directory>\$dpx$.tmp\ee4b51f8ecd8be41ae47ef857179c0dc.tmp
<Current directory>\$dpx$.tmp\0970f9ed8fa2544e87ca1a2938383a14.tmp
<Current directory>\$dpx$.tmp\087e05cda072574fa7ffa86f30b11172.tmp
<Current directory>\$dpx$.tmp\b28d945e781a4a4686f2a91c359fe281.tmp
<Current directory>\$dpx$.tmp\9015340dacc4dc498cbe9b37e64acc3d.tmp
<Current directory>\$dpx$.tmp\faf820d4bd01854d96208c493deb466d.tmp
<Current directory>\$dpx$.tmp\7d59ccf2045b0d45a4dc4ce9bbd02e71.tmp
<Current directory>\$dpx$.tmp\e3dcc16d9cd1cd40b1be4ff7e979932b.tmp
<Current directory>\$dpx$.tmp\cdf1ac11394a15438f6e8888310101bc.tmp
<Current directory>\$dpx$.tmp\a5b1bdcb1bca284cb5b3bc83779e5793.tmp
<Current directory>\$dpx$.tmp\97e1df505e3f6f48a293b86bb02ea39c.tmp
<Current directory>\$dpx$.tmp\b8180046be8a8e438c32fa10efc6e8f6.tmp
<Current directory>\$dpx$.tmp\4a7d390b6690624e8fbac8b6a331068e.tmp
<Current directory>\$dpx$.tmp\24488037a96bc94fad4a599dd9860786.tmp
<Current directory>\$dpx$.tmp\169d4ce669eb4c4684177f8c661031eb.tmp

Sets the 'hidden' attribute to the following files

<Current directory>\api-ms-win-core-console-l1-1-0.dll
<Current directory>\api-ms-win-crt-conio-l1-1-0.dll
<Current directory>\api-ms-win-crt-convert-l1-1-0.dll
<Current directory>\api-ms-win-crt-environment-l1-1-0.dll
<Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
<Current directory>\api-ms-win-crt-heap-l1-1-0.dll
<Current directory>\api-ms-win-crt-locale-l1-1-0.dll
<Current directory>\api-ms-win-crt-math-l1-1-0.dll
<Current directory>\api-ms-win-core-timezone-l1-1-0.dll
<Current directory>\api-ms-win-core-util-l1-1-0.dll
<Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
<Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
<Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
<Current directory>\api-ms-win-crt-string-l1-1-0.dll
<Current directory>\api-ms-win-crt-time-l1-1-0.dll
<Current directory>\api-ms-win-crt-utility-l1-1-0.dll
<Current directory>\msvcp140.dll
<Current directory>\opencl.dll
<Current directory>\api-ms-win-crt-private-l1-1-0.dll
<Current directory>\api-ms-win-crt-process-l1-1-0.dll
<Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
<Current directory>\api-ms-win-core-synch-l1-2-0.dll
<Current directory>\api-ms-win-core-synch-l1-1-0.dll
<Current directory>\api-ms-win-core-debug-l1-1-0.dll
<Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-2-0.dll
<Current directory>\api-ms-win-core-file-l2-1-0.dll
<Current directory>\api-ms-win-core-handle-l1-1-0.dll
<Current directory>\api-ms-win-core-heap-l1-1-0.dll
<Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
<Current directory>\api-ms-win-core-datetime-l1-1-0.dll
<Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
<Current directory>\api-ms-win-core-memory-l1-1-0.dll
<Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
<Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
<Current directory>\api-ms-win-core-profile-l1-1-0.dll
<Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
<Current directory>\api-ms-win-core-string-l1-1-0.dll
<Current directory>\api-ms-win-core-localization-l1-2-0.dll
<Current directory>\ucrtbase.dll
<Current directory>\vcruntime140.dll

Deletes the following files

<Current directory>\d.cab

Moves the following files

from <Current directory>\$dpx$.tmp\d4a5a64875ac3d419c5b7461137231d0.tmp to <Current directory>\api-ms-win-core-console-l1-1-0.dll
from <Current directory>\$dpx$.tmp\b76485d9083c534da8c1979af21ddc80.tmp to <Current directory>\api-ms-win-crt-conio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\689132cc5b86ab49a43bcd1f3484cda2.tmp to <Current directory>\api-ms-win-crt-convert-l1-1-0.dll
from <Current directory>\$dpx$.tmp\9478b8af9fd7e54fa859cfa86808367b.tmp to <Current directory>\api-ms-win-crt-environment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f2bbee883a83bf4c9ccc70a81d122a43.tmp to <Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
from <Current directory>\$dpx$.tmp\edf416019c3525459cd6c96a2f834d8d.tmp to <Current directory>\api-ms-win-crt-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\b1e910cf1e68ed4ab01f65f6c6225608.tmp to <Current directory>\api-ms-win-crt-locale-l1-1-0.dll
from <Current directory>\$dpx$.tmp\d6f6e6f903856b4a824091e640530fcd.tmp to <Current directory>\api-ms-win-crt-math-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c2828c95ea70294abbfa8c85aa39ddef.tmp to <Current directory>\api-ms-win-core-timezone-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a5bcde7fff437c43af94b172ea653308.tmp to <Current directory>\api-ms-win-core-util-l1-1-0.dll
from <Current directory>\$dpx$.tmp\9d244914575c7b40bda89ea8107ee46d.tmp to <Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
from <Current directory>\$dpx$.tmp\235111ba22de824ab489cde42f87305f.tmp to <Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\d01147bc4cc30c4495178860959c257f.tmp to <Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\75c2d1fc897f5b418f03852621aad5b7.tmp to <Current directory>\api-ms-win-crt-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\2dd26fa019e4e543adf39f57cff07e19.tmp to <Current directory>\api-ms-win-crt-time-l1-1-0.dll
from <Current directory>\$dpx$.tmp\fa542c3f6cb4cd40b6cb9be6d6fadc84.tmp to <Current directory>\api-ms-win-crt-utility-l1-1-0.dll
from <Current directory>\$dpx$.tmp\32455ffb5f40ba46b4cc2b56751ca318.tmp to <Current directory>\msvcp140.dll
from <Current directory>\$dpx$.tmp\5b00465a54d61145b84698c456073781.tmp to <Current directory>\opencl.dll
from <Current directory>\$dpx$.tmp\0e85a237d6e29241bdadf32ab29c18c8.tmp to <Current directory>\api-ms-win-crt-private-l1-1-0.dll
from <Current directory>\$dpx$.tmp\070b9fd98e5e914abb8599e3a640e0e2.tmp to <Current directory>\api-ms-win-crt-process-l1-1-0.dll
from <Current directory>\$dpx$.tmp\55fafcd60cb8bd4da18385ff9dfb55c3.tmp to <Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
from <Current directory>\$dpx$.tmp\7efd66905e1c0342919381cc0fcbe773.tmp to <Current directory>\api-ms-win-core-synch-l1-2-0.dll
from <Current directory>\$dpx$.tmp\24488037a96bc94fad4a599dd9860786.tmp to <Current directory>\api-ms-win-core-synch-l1-1-0.dll
from <Current directory>\$dpx$.tmp\d9478b12a8d9fe40bd091e0af3447729.tmp to <Current directory>\api-ms-win-core-debug-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a8832c1fa5d6a449812d51588ad73961.tmp to <Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
from <Current directory>\$dpx$.tmp\197e74afcf69c946a23fc46bd60132ed.tmp to <Current directory>\api-ms-win-core-file-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ee0dc80b1415e14db62887bdec0addb1.tmp to <Current directory>\api-ms-win-core-file-l1-2-0.dll
from <Current directory>\$dpx$.tmp\ee4b51f8ecd8be41ae47ef857179c0dc.tmp to <Current directory>\api-ms-win-core-file-l2-1-0.dll
from <Current directory>\$dpx$.tmp\0970f9ed8fa2544e87ca1a2938383a14.tmp to <Current directory>\api-ms-win-core-handle-l1-1-0.dll
from <Current directory>\$dpx$.tmp\087e05cda072574fa7ffa86f30b11172.tmp to <Current directory>\api-ms-win-core-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\b28d945e781a4a4686f2a91c359fe281.tmp to <Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
from <Current directory>\$dpx$.tmp\2ffa0994c83f6d49a28ab5b7a9c73236.tmp to <Current directory>\api-ms-win-core-datetime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\9015340dacc4dc498cbe9b37e64acc3d.tmp to <Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
from <Current directory>\$dpx$.tmp\7d59ccf2045b0d45a4dc4ce9bbd02e71.tmp to <Current directory>\api-ms-win-core-memory-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e3dcc16d9cd1cd40b1be4ff7e979932b.tmp to <Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
from <Current directory>\$dpx$.tmp\cdf1ac11394a15438f6e8888310101bc.tmp to <Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a5b1bdcb1bca284cb5b3bc83779e5793.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
from <Current directory>\$dpx$.tmp\97e1df505e3f6f48a293b86bb02ea39c.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
from <Current directory>\$dpx$.tmp\b8180046be8a8e438c32fa10efc6e8f6.tmp to <Current directory>\api-ms-win-core-profile-l1-1-0.dll
from <Current directory>\$dpx$.tmp\4a7d390b6690624e8fbac8b6a331068e.tmp to <Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ab505dee619bca4eb5f0f9f05149aac5.tmp to <Current directory>\api-ms-win-core-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\faf820d4bd01854d96208c493deb466d.tmp to <Current directory>\api-ms-win-core-localization-l1-2-0.dll
from <Current directory>\$dpx$.tmp\5b818c0faa40cb40ada64819db6b0151.tmp to <Current directory>\ucrtbase.dll
from <Current directory>\$dpx$.tmp\169d4ce669eb4c4684177f8c661031eb.tmp to <Current directory>\vcruntime140.dll

Network activity

TCP

'lp##.abbny.com':443
'lp##.haqo.net':443

UDP

DNS ASK lp##.beahh.com
DNS ASK lp##.abbny.com
DNS ASK lp##.haqo.net

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a
'<SYSTEM32>\expand.exe' d.cab -f:* .

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней