Trojan.DownLoader33.54132

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Stub' = '<Full path to file>'

Modifies file system

Creates the following files

%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\wochjppw\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\zp40x84y\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\autkew4c\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bfnu12gt\desktop.ini
%APPDATA%\microsoft\windows\cookies\desktop.ini
%LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012020061420200615\index.dat
%APPDATA%\microsoft\windows\iecompatcache\index.dat
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\antiphishing\2cedbfbc-dba8-43aa-b1fd-cc8e6316e3e2.dat

Sets the 'hidden' attribute to the following files

%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\wochjppw\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\zp40x84y\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\autkew4c\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bfnu12gt\desktop.ini
%APPDATA%\microsoft\windows\cookies\desktop.ini

Deletes the following files

%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\errorpagestrings[2]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\sslnavcancel[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\punycode.min[1].js
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\ovhcom[1].png
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\icn-roundcube[1].png
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\errorpagetemplate[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\vps[1].png
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\small-shadow[1].png
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\ovh-logo[1].png
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\dedie[1].png
%APPDATA%\microsoft\windows\cookies\user@4chan[2].txt
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\background_gradient[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\info_48[2]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\hr[1].png
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\bullet[2]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\background3[1].jpg
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\navcancl[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\mutu[1].png
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\jquery-1.11.3.min[1].js
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\icn-univers_web[1].png
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\httperrorpagesscripts[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\shadow[1].jpg
%LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012020061420200615\index.dat

Substitutes the following files

%LOCALAPPDATA%\Microsoft\Windows\<INETFILES>\Content.IE5\desktop.ini
%LOCALAPPDATA%\Microsoft\Windows\History\History.IE5\desktop.ini
%APPDATA%\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol

Network activity

TCP

HTTP GET requests