Trojan.DownLoader35.752

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'LepideUpdateELMRACLUPPOP' = '%WINDIR%\M_ourfol3\smss.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'LepideUpdateKEY_STROKE' = '%WINDIR%\M_ourfol3\csrss.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'LepideUpdateELMRACLUP' = '%WINDIR%\M_ourfol3\services.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'LepideUpdateELMRACL' = '%WINDIR%\M_ourfol3\svchost.exe'

Modifies file system

Creates the following files

%TEMP%\lepidetempfol\aximage.ocx
%TEMP%\zx_temp\2020_10_14_20_22_41_26_pm_0.bin
%TEMP%\zy_temp\2020_10_14_20_22_41_26_pm_0.jpeg
%TEMP%\zy_temp\2020_10_14_20_22_41_26_pm_0.bmp
%TEMP%\zx_temp\2020_10_14_20_22_38_811_pm_0.bin
%TEMP%\zy_temp\2020_10_14_20_22_38_811_pm_0.jpeg
%TEMP%\zy_temp\2020_10_14_20_22_38_811_pm_0.bmp
%TEMP%\zx_temp\2020_10_14_20_22_36_409_pm_0.bin
%TEMP%\zy_temp\2020_10_14_20_22_36_409_pm_0.jpeg
%TEMP%\zy_temp\2020_10_14_20_22_36_409_pm_0.bmp
%TEMP%\zx_temp\2020_10_14_20_22_34_162_pm_0.bin
%TEMP%\zy_temp\2020_10_14_20_22_34_162_pm_0.jpeg
%TEMP%\zy_temp\2020_10_14_20_22_34_162_pm_0.bmp
%TEMP%\zy_temp\2020_10_14_20_22_43_179_pm_0.bmp
%TEMP%\zx_temp\2020_10_14_20_22_31_744_pm_0.bin
%TEMP%\zy_temp\2020_10_14_20_22_31_744_pm_0.bmp
%TEMP%\zx_temp\2020_10_14_20_22_29_420_pm_0.bin
%TEMP%\zy_temp\2020_10_14_20_22_29_420_pm_0.jpeg
%TEMP%\zy_temp\2020_10_14_20_22_29_420_pm_0.bmp
%TEMP%\zx_temp\2020_10_14_20_22_26_955_pm_0.bin
%TEMP%\zy_temp\2020_10_14_20_22_26_955_pm_0.jpeg
%TEMP%\zy_temp\2020_10_14_20_22_26_955_pm_0.bmp
%TEMP%\zx_temp\2020_10_14_20_22_24_709_pm_0.bin
%TEMP%\zy_temp\2020_10_14_20_22_24_709_pm_0.jpeg
%TEMP%\zy_temp\2020_10_14_20_22_24_709_pm_0.bmp
%TEMP%\zx_temp\2020_10_14_20_22_22_478_pm_0.bin
%TEMP%\zy_temp\2020_10_14_20_22_22_478_pm_0.jpeg
%TEMP%\zy_temp\2020_10_14_20_22_31_744_pm_0.jpeg
%TEMP%\zy_temp\2020_10_14_20_22_43_179_pm_0.jpeg
%TEMP%\zx_temp\2020_10_14_20_22_43_179_pm_0.bin
%TEMP%\zy_temp\2020_10_14_20_22_45_332_pm_0.bmp
%TEMP%\zy_temp\2020_10_14_20_23_04_489_pm_0.bmp
%TEMP%\zx_temp\2020_10_14_20_23_02_429_pm_0.bin
%TEMP%\zy_temp\2020_10_14_20_23_02_429_pm_0.jpeg
%TEMP%\zy_temp\2020_10_14_20_23_02_429_pm_0.bmp
%TEMP%\zx_temp\2020_10_14_20_23_00_433_pm_0.bin
%TEMP%\zy_temp\2020_10_14_20_23_00_433_pm_0.jpeg
%TEMP%\zy_temp\2020_10_14_20_23_00_433_pm_0.bmp
%TEMP%\zx_temp\2020_10_14_20_22_58_264_pm_0.bin
%TEMP%\zy_temp\2020_10_14_20_22_58_264_pm_0.jpeg
%TEMP%\zy_temp\2020_10_14_20_22_58_264_pm_0.bmp
%TEMP%\zx_temp\2020_10_14_20_22_56_205_pm_0.bin
%TEMP%\zy_temp\2020_10_14_20_22_56_205_pm_0.jpeg
%TEMP%\zy_temp\2020_10_14_20_22_56_205_pm_0.bmp
%TEMP%\zx_temp\2020_10_14_20_22_54_177_pm_0.bin
%TEMP%\zy_temp\2020_10_14_20_22_54_177_pm_0.jpeg
%TEMP%\zy_temp\2020_10_14_20_22_54_177_pm_0.bmp
%TEMP%\zx_temp\2020_10_14_20_22_51_837_pm_0.bin
%TEMP%\zy_temp\2020_10_14_20_22_51_837_pm_0.jpeg
%TEMP%\zy_temp\2020_10_14_20_22_51_837_pm_0.bmp
%TEMP%\zx_temp\2020_10_14_20_22_49_606_pm_0.bin
%TEMP%\zy_temp\2020_10_14_20_22_49_606_pm_0.jpeg
%TEMP%\zy_temp\2020_10_14_20_22_49_606_pm_0.bmp
%TEMP%\zx_temp\2020_10_14_20_22_47_469_pm_0.bin
%TEMP%\zy_temp\2020_10_14_20_22_47_469_pm_0.jpeg
%TEMP%\zy_temp\2020_10_14_20_22_47_469_pm_0.bmp
%TEMP%\zx_temp\2020_10_14_20_22_45_332_pm_0.bin
%TEMP%\zy_temp\2020_10_14_20_22_45_332_pm_0.jpeg
%TEMP%\zy_temp\2020_10_14_20_22_22_478_pm_0.bmp
%TEMP%\zy_temp\2020_10_14_20_23_04_489_pm_0.jpeg
%TEMP%\zx_temp\2020_10_14_20_22_20_325_pm_0.bin
%TEMP%\zy_temp\2020_10_14_20_22_20_325_pm_0.bmp
%TEMP%\zy_temp\2020_10_14_20_21_55_769_pm_0.jpeg
%TEMP%\zy_temp\2020_10_14_20_21_55_769_pm_0.bmp
%TEMP%\zx_temp\2020_10_14_20_21_53_444_pm_0.bin
%TEMP%\zy_temp\2020_10_14_20_21_53_444_pm_0.jpeg
%TEMP%\zy_temp\2020_10_14_20_21_53_444_pm_0.bmp
%TEMP%\zx_temp\2020_10_14_20_21_51_151_pm_0.bin
%TEMP%\zy_temp\2020_10_14_20_21_51_151_pm_0.jpeg
%TEMP%\zy_temp\2020_10_14_20_21_51_151_pm_0.bmp
%TEMP%\zx_temp\2020_10_14_20_21_48_842_pm_0.bin
%TEMP%\zy_temp\2020_10_14_20_21_48_842_pm_0.jpeg
%TEMP%\zy_temp\2020_10_14_20_21_48_842_pm_0.bmp
%TEMP%\zy_temp\112.bmp
%TEMP%\zx_temp\2020_10_14_20_21_55_769_pm_0.bin
%WINDIR%\m_ourfol3\aximage.ocx
%WINDIR%\m_ourfol3\edlvadminopenscripts.exe
%WINDIR%\m_ourfol3\svchost.exe
%WINDIR%\m_ourfol3\services.exe
%WINDIR%\m_ourfol3\csrss.exe
%WINDIR%\m_ourfol3\smss.exe
%TEMP%\lepidetempfol\svchost.exe
%TEMP%\lepidetempfol\standaloneinstallcopyallfromtemp.exe
%TEMP%\lepidetempfol\smss.exe
%TEMP%\lepidetempfol\services.exe
%TEMP%\lepidetempfol\lepideprocessexecuteservice.exe
%TEMP%\lepidetempfol\edlvadminopenscripts.exe
%TEMP%\lepidetempfol\csrss.exe
%WINDIR%\m_ourfol3\lepideprocessexecuteservice.exe
%TEMP%\zy_temp\2020_10_14_20_21_58_233_pm_0.bmp
%TEMP%\zy_temp\2020_10_14_20_21_58_233_pm_0.jpeg
%TEMP%\zx_temp\2020_10_14_20_21_58_233_pm_0.bin
%TEMP%\zx_temp\2020_10_14_20_22_18_141_pm_0.bin
%TEMP%\zy_temp\2020_10_14_20_22_18_141_pm_0.jpeg
%TEMP%\zy_temp\2020_10_14_20_22_18_141_pm_0.bmp
%TEMP%\zx_temp\2020_10_14_20_22_16_35_pm_0.bin
%TEMP%\zy_temp\2020_10_14_20_22_16_35_pm_0.jpeg
%TEMP%\zy_temp\2020_10_14_20_22_16_35_pm_0.bmp
%TEMP%\zx_temp\2020_10_14_20_22_13_820_pm_0.bin
%TEMP%\zy_temp\2020_10_14_20_22_13_820_pm_0.jpeg
%TEMP%\zy_temp\2020_10_14_20_22_13_820_pm_0.bmp
%TEMP%\zx_temp\2020_10_14_20_22_11_495_pm_0.bin
%TEMP%\zy_temp\2020_10_14_20_22_11_495_pm_0.jpeg
%TEMP%\zy_temp\2020_10_14_20_22_11_495_pm_0.bmp
%TEMP%\zx_temp\2020_10_14_20_22_09_233_pm_0.bin
%TEMP%\zy_temp\2020_10_14_20_22_09_233_pm_0.jpeg
%TEMP%\zy_temp\2020_10_14_20_22_09_233_pm_0.bmp
%TEMP%\zx_temp\2020_10_14_20_22_06_925_pm_0.bin
%TEMP%\zy_temp\2020_10_14_20_22_06_925_pm_0.jpeg
%TEMP%\zy_temp\2020_10_14_20_22_06_925_pm_0.bmp
%TEMP%\zx_temp\2020_10_14_20_22_04_741_pm_0.bin
%TEMP%\zy_temp\2020_10_14_20_22_04_741_pm_0.jpeg
%TEMP%\zy_temp\2020_10_14_20_22_04_741_pm_0.bmp
%TEMP%\zx_temp\2020_10_14_20_22_02_601_pm_0.bin
%TEMP%\zy_temp\2020_10_14_20_22_02_601_pm_0.jpeg
%TEMP%\zy_temp\2020_10_14_20_22_02_601_pm_0.bmp
%TEMP%\zx_temp\2020_10_14_20_22_00_480_pm_0.bin
%TEMP%\zy_temp\2020_10_14_20_22_00_480_pm_0.jpeg
%TEMP%\zy_temp\2020_10_14_20_22_00_480_pm_0.bmp
%TEMP%\zy_temp\2020_10_14_20_22_20_325_pm_0.jpeg
%TEMP%\zx_temp\2020_10_14_20_23_04_489_pm_0.bin

Deletes the following files

%TEMP%\zy_temp\2020_10_14_20_21_48_842_pm_0.bmp
%TEMP%\zy_temp\2020_10_14_20_22_43_179_pm_0.jpeg
%TEMP%\zy_temp\2020_10_14_20_22_43_179_pm_0.bmp
%TEMP%\zy_temp\2020_10_14_20_22_41_26_pm_0.jpeg
%TEMP%\zy_temp\2020_10_14_20_22_41_26_pm_0.bmp
%TEMP%\zy_temp\2020_10_14_20_22_38_811_pm_0.jpeg
%TEMP%\zy_temp\2020_10_14_20_22_38_811_pm_0.bmp
%TEMP%\zy_temp\2020_10_14_20_22_45_332_pm_0.bmp
%TEMP%\zy_temp\2020_10_14_20_22_36_409_pm_0.jpeg
%TEMP%\zy_temp\2020_10_14_20_22_34_162_pm_0.jpeg
%TEMP%\zy_temp\2020_10_14_20_22_34_162_pm_0.bmp
%TEMP%\zy_temp\2020_10_14_20_22_31_744_pm_0.jpeg
%TEMP%\zy_temp\2020_10_14_20_22_31_744_pm_0.bmp
%TEMP%\zy_temp\2020_10_14_20_22_29_420_pm_0.jpeg
%TEMP%\zy_temp\2020_10_14_20_22_29_420_pm_0.bmp
%TEMP%\zy_temp\2020_10_14_20_22_36_409_pm_0.bmp
%TEMP%\zy_temp\2020_10_14_20_22_56_205_pm_0.bmp
%TEMP%\zy_temp\2020_10_14_20_23_04_489_pm_0.bmp
%TEMP%\zy_temp\2020_10_14_20_22_47_469_pm_0.jpeg
%TEMP%\zy_temp\2020_10_14_20_23_02_429_pm_0.jpeg
%TEMP%\zy_temp\2020_10_14_20_23_02_429_pm_0.bmp
%TEMP%\zy_temp\2020_10_14_20_23_00_433_pm_0.jpeg
%TEMP%\zy_temp\2020_10_14_20_23_00_433_pm_0.bmp
%TEMP%\zy_temp\2020_10_14_20_22_58_264_pm_0.jpeg
%TEMP%\zy_temp\2020_10_14_20_22_58_264_pm_0.bmp
%TEMP%\zy_temp\2020_10_14_20_22_26_955_pm_0.jpeg
%TEMP%\zy_temp\2020_10_14_20_22_56_205_pm_0.jpeg
%TEMP%\zy_temp\2020_10_14_20_22_54_177_pm_0.jpeg
%TEMP%\zy_temp\2020_10_14_20_22_54_177_pm_0.bmp
%TEMP%\zy_temp\2020_10_14_20_22_51_837_pm_0.jpeg
%TEMP%\zy_temp\2020_10_14_20_22_51_837_pm_0.bmp
%TEMP%\zy_temp\2020_10_14_20_22_49_606_pm_0.jpeg
%TEMP%\zy_temp\2020_10_14_20_22_49_606_pm_0.bmp
%TEMP%\zy_temp\2020_10_14_20_22_45_332_pm_0.jpeg
%TEMP%\zy_temp\2020_10_14_20_22_47_469_pm_0.bmp
%TEMP%\zy_temp\2020_10_14_20_22_26_955_pm_0.bmp
%TEMP%\zy_temp\2020_10_14_20_22_06_925_pm_0.bmp
%TEMP%\zy_temp\2020_10_14_20_22_02_601_pm_0.jpeg
%TEMP%\zy_temp\2020_10_14_20_22_02_601_pm_0.bmp
%TEMP%\zy_temp\2020_10_14_20_22_00_480_pm_0.jpeg
%TEMP%\zy_temp\2020_10_14_20_22_00_480_pm_0.bmp
%TEMP%\zy_temp\2020_10_14_20_21_58_233_pm_0.jpeg
%TEMP%\zy_temp\2020_10_14_20_21_58_233_pm_0.bmp
%TEMP%\zy_temp\2020_10_14_20_22_04_741_pm_0.bmp
%TEMP%\zy_temp\2020_10_14_20_21_55_769_pm_0.jpeg
%TEMP%\zy_temp\2020_10_14_20_21_53_444_pm_0.jpeg
%TEMP%\zy_temp\2020_10_14_20_21_53_444_pm_0.bmp
%TEMP%\zy_temp\2020_10_14_20_21_51_151_pm_0.jpeg
%TEMP%\zy_temp\2020_10_14_20_21_51_151_pm_0.bmp
%TEMP%\zy_temp\112.bmp
%TEMP%\zy_temp\2020_10_14_20_21_48_842_pm_0.jpeg
%TEMP%\zy_temp\2020_10_14_20_21_55_769_pm_0.bmp
%TEMP%\zy_temp\2020_10_14_20_22_16_35_pm_0.bmp
%TEMP%\zy_temp\2020_10_14_20_22_24_709_pm_0.bmp
%TEMP%\zy_temp\2020_10_14_20_22_06_925_pm_0.jpeg
%TEMP%\zy_temp\2020_10_14_20_22_22_478_pm_0.jpeg
%TEMP%\zy_temp\2020_10_14_20_22_22_478_pm_0.bmp
%TEMP%\zy_temp\2020_10_14_20_22_20_325_pm_0.jpeg
%TEMP%\zy_temp\2020_10_14_20_22_20_325_pm_0.bmp
%TEMP%\zy_temp\2020_10_14_20_22_18_141_pm_0.jpeg
%TEMP%\zy_temp\2020_10_14_20_22_18_141_pm_0.bmp
%TEMP%\zy_temp\2020_10_14_20_22_24_709_pm_0.jpeg
%TEMP%\zy_temp\2020_10_14_20_22_16_35_pm_0.jpeg
%TEMP%\zy_temp\2020_10_14_20_22_13_820_pm_0.jpeg
%TEMP%\zy_temp\2020_10_14_20_22_13_820_pm_0.bmp
%TEMP%\zy_temp\2020_10_14_20_22_11_495_pm_0.jpeg
%TEMP%\zy_temp\2020_10_14_20_22_11_495_pm_0.bmp
%TEMP%\zy_temp\2020_10_14_20_22_09_233_pm_0.jpeg
%TEMP%\zy_temp\2020_10_14_20_22_09_233_pm_0.bmp
%TEMP%\zy_temp\2020_10_14_20_22_04_741_pm_0.jpeg
%TEMP%\zy_temp\2020_10_14_20_23_04_489_pm_0.jpeg

Substitutes the following files

%TEMP%\zy_temp\112.bmp

Network activity

Connects to

'52.##.54.181':1005

Miscellaneous

Creates and executes the following

'%TEMP%\lepidetempfol\standaloneinstallcopyallfromtemp.exe'
'%WINDIR%\m_ourfol3\edlvadminopenscripts.exe'
'%WINDIR%\m_ourfol3\services.exe'
'%WINDIR%\m_ourfol3\svchost.exe'
'%WINDIR%\m_ourfol3\csrss.exe'
'%WINDIR%\m_ourfol3\smss.exe'
'%WINDIR%\syswow64\regsvr32.exe' /s "%WINDIR%\M_ourfol3\AxImage.ocx"' (with hidden window)

Executes the following

'%WINDIR%\syswow64\regsvr32.exe' /s "%WINDIR%\M_ourfol3\AxImage.ocx"

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней