Trojan.DownLoader33.28594

Technical Information

Malicious functions

Searches for windows to

detect analytical utilities:

ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
ClassName: 'PROCEXPL', WindowName: ''
ClassName: 'OllyDbg', WindowName: ''

Modifies file system

Creates the following files

<Current directory>\ccfaqm.exe
<SYSTEM32>\api_ms_win_core_localization_l1_2_0.dll
<SYSTEM32>\api_ms_win_core_file_l2_1_0.dll
<SYSTEM32>\api_ms_win_core_processenvironment_l1_1_0.dll
<SYSTEM32>\api_ms_win_core_memory_l1_1_0.dll
<SYSTEM32>\api_ms_win_core_interlocked_l1_1_0.dll
<SYSTEM32>\api_ms_win_core_datetime_l1_1_0.dll
<SYSTEM32>\api_ms_win_core_debug_l1_1_0.dll
<SYSTEM32>\api_ms_win_core_synch_l1_2_0.dll
<SYSTEM32>\api_ms_win_core_synch_l1_1_0.dll
<SYSTEM32>\api_ms_win_crt_math_l1_1_0.dll
<SYSTEM32>\api_ms_win_crt_locale_l1_1_0.dll
<SYSTEM32>\api_ms_win_crt_multibyte_l1_1_0.dll
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
%LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
%LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\asnkjewy\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\tp0oh6wy\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\566lhfmx\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\l7jx4alw\desktop.ini
%APPDATA%\microsoft\windows\cookies\low\index.dat
<SYSTEM32>\api_ms_win_core_file_l1_2_0.dll
<SYSTEM32>\api_ms_win_core_file_l1_1_0.dll
<SYSTEM32>\api_ms_win_crt_heap_l1_1_0.dll
<SYSTEM32>\api_ms_win_crt_process_l1_1_0.dll
<SYSTEM32>\api_ms_win_crt_conio_l1_1_0.dll
<SYSTEM32>\api_ms_win_core_util_l1_1_0.dll
<SYSTEM32>\api_ms_win_crt_time_l1_1_0.dll
<SYSTEM32>\api_ms_win_core_timezone_l1_1_0.dll
<SYSTEM32>\api_ms_win_crt_filesystem_l1_1_0.dll
<SYSTEM32>\api_ms_win_core_namedpipe_l1_1_0.dll
<SYSTEM32>\api_ms_win_core_handle_l1_1_0.dll
<SYSTEM32>\api_ms_win_core_console_l1_1_0.dll
<SYSTEM32>\api_ms_win_crt_runtime_l1_1_0.dll
<SYSTEM32>\api_ms_win_crt_string_l1_1_0.dll
<SYSTEM32>\api_ms_win_crt_environment_l1_1_0.dll
%LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\index.dat
<SYSTEM32>\api_ms_win_core_sysinfo_l1_1_0.dll
<SYSTEM32>\api_ms_win_core_libraryloader_l1_1_0.dll
<SYSTEM32>\vcruntime140_1.dll
<SYSTEM32>\api_ms_win_crt_private_l1_1_0.dll
<SYSTEM32>\api_ms_win_core_errorhandling_l1_1_0.dll
<SYSTEM32>\api_ms_win_crt_utility_l1_1_0.dll
<SYSTEM32>\api_ms_win_core_rtlsupport_l1_1_0.dll
<SYSTEM32>\api_ms_win_crt_stdio_l1_1_0.dll
<SYSTEM32>\api_ms_win_core_profile_l1_1_0.dll
<SYSTEM32>\api_ms_win_core_heap_l1_1_0.dll
<SYSTEM32>\api_ms_win_core_processthreads_l1_1_1.dll
<SYSTEM32>\api_ms_win_core_processthreads_l1_1_0.dll
<SYSTEM32>\api_ms_win_core_string_l1_1_0.dll
<SYSTEM32>\api_ms_win_crt_convert_l1_1_0.dll
<Current directory>\error_log.log

Sets the 'hidden' attribute to the following files

%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\asnkjewy\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\tp0oh6wy\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\566lhfmx\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\l7jx4alw\desktop.ini
%LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini

Deletes the following files