Trojan.DownLoader36.21574

Technical Information

Modifies file system

Creates the following files

%TEMP%\ldpiqqffg.exe
%TEMP%\_mei27122\pyexpat.pyd
%TEMP%\_mei27122\pycares\_cares.cp38-win32.pyd
%TEMP%\_mei27122\psutil\_psutil_windows.cp38-win32.pyd
%TEMP%\_mei27122\numpy\random\mtrand.cp38-win32.pyd
%TEMP%\_mei27122\numpy\random\bit_generator.cp38-win32.pyd
%TEMP%\_mei27122\numpy\random\_sfc64.cp38-win32.pyd
%TEMP%\_mei27122\numpy\random\_philox.cp38-win32.pyd
%TEMP%\_mei27122\numpy\random\_pcg64.cp38-win32.pyd
%TEMP%\_mei27122\numpy\random\_mt19937.cp38-win32.pyd
%TEMP%\_mei27122\numpy\random\_generator.cp38-win32.pyd
%TEMP%\_mei27122\numpy\random\_common.cp38-win32.pyd
%TEMP%\_mei27122\numpy\random\_bounded_integers.cp38-win32.pyd
%TEMP%\_mei27122\numpy\linalg\lapack_lite.cp38-win32.pyd
%TEMP%\_mei27122\numpy\linalg\_umath_linalg.cp38-win32.pyd
%TEMP%\_mei27122\numpy\fft\_pocketfft_internal.cp38-win32.pyd
%TEMP%\_mei27122\numpy\core\_multiarray_umath.cp38-win32.pyd
%TEMP%\_mei27122\numpy\core\_multiarray_tests.cp38-win32.pyd
%TEMP%\_mei27122\nacl\_sodium.cp38-win32.pyd
%TEMP%\_mei27122\multidict\_multidict.cp38-win32.pyd
%TEMP%\_mei27122\mfc140u.dll
%TEMP%\_mei27122\libssl-1_1.dll
%TEMP%\_mei27122\libopenblas.u35rt5x5bpdsh5ztf276yadqr2kdu6pr.gfortran-win32.dll
%TEMP%\_mei27122\libffi-7.dll
%TEMP%\_mei27122\_win32sysloader.pyd
%TEMP%\_mei27122\libcrypto-1_1.dll
%TEMP%\_mei27122\python38.dll
%TEMP%\_mei27122\pythoncom38.dll
%TEMP%\_mei27122\selenium\webdriver\firefox\x86\x_ignore_nofocus.so
%TEMP%\_mei27122\selenium\webdriver\firefox\webdriver_prefs.json
%TEMP%\_mei27122\selenium\webdriver\firefox\webdriver.xpi
%TEMP%\_mei27122\selenium\webdriver\firefox\amd64\x_ignore_nofocus.so
%TEMP%\_mei27122\lib2to3\tests\data\readme
%TEMP%\_mei27122\lib2to3\patterngrammar3.8.0.final.0.pickle
%TEMP%\_mei27122\lib2to3\patterngrammar.txt
%TEMP%\_mei27122\lib2to3\grammar3.8.0.final.0.pickle
%TEMP%\_mei27122\lib2to3\grammar.txt
%TEMP%\_mei27122\certifi\cacert.pem
%TEMP%\_mei27122\base_library.zip
%TEMP%\_mei27122\yarl\_quoting.cp38-win32.pyd
%TEMP%\_mei27122\ruiner.exe.manifest
%TEMP%\_mei27122\win32wnet.pyd
%TEMP%\_mei27122\win32ui.pyd
%TEMP%\_mei27122\win32trace.pyd
%TEMP%\_mei27122\win32pdh.pyd
%TEMP%\_mei27122\win32crypt.pyd
%TEMP%\_mei27122\win32com\shell\shell.pyd
%TEMP%\_mei27122\win32api.pyd
%TEMP%\_mei27122\unicodedata.pyd
%TEMP%\_mei27122\sqlite3.dll
%TEMP%\_mei27122\select.pyd
%TEMP%\_mei27122\pywintypes38.dll
%TEMP%\_mei27122\_ssl.pyd
%TEMP%\_mei27122\_sqlite3.pyd
%TEMP%\_mei27122\_socket.pyd
%TEMP%\_mei27122\crypto\hash\_md4.cp38-win32.pyd
%TEMP%\_mei27122\crypto\hash\_md2.cp38-win32.pyd
%TEMP%\_mei27122\crypto\hash\_blake2s.cp38-win32.pyd
%TEMP%\_mei27122\crypto\hash\_blake2b.cp38-win32.pyd
%TEMP%\_mei27122\crypto\cipher\_raw_ofb.cp38-win32.pyd
%TEMP%\_mei27122\crypto\cipher\_raw_ocb.cp38-win32.pyd
%TEMP%\_mei27122\crypto\cipher\_raw_eksblowfish.cp38-win32.pyd
%TEMP%\_mei27122\crypto\cipher\_raw_ecb.cp38-win32.pyd
%TEMP%\_mei27122\crypto\cipher\_raw_des3.cp38-win32.pyd
%TEMP%\_mei27122\crypto\cipher\_raw_des.cp38-win32.pyd
%TEMP%\_mei27122\crypto\cipher\_raw_ctr.cp38-win32.pyd
%TEMP%\_mei27122\crypto\cipher\_raw_cfb.cp38-win32.pyd
%TEMP%\_mei27122\crypto\cipher\_raw_cbc.cp38-win32.pyd
%TEMP%\_mei27122\crypto\cipher\_raw_cast.cp38-win32.pyd
%TEMP%\_mei27122\crypto\cipher\_raw_blowfish.cp38-win32.pyd
%TEMP%\_mei27122\crypto\cipher\_raw_arc2.cp38-win32.pyd
%TEMP%\_mei27122\crypto\cipher\_raw_aesni.cp38-win32.pyd
%TEMP%\_mei27122\crypto\cipher\_raw_aes.cp38-win32.pyd
%TEMP%\_mei27122\crypto\cipher\_chacha20.cp38-win32.pyd
%TEMP%\_mei27122\crypto\cipher\_salsa20.cp38-win32.pyd
%TEMP%\_mei27122\crypto\cipher\_arc4.cp38-win32.pyd
%TEMP%\jcdvw.exe
%TEMP%\_mei27122\crypto\hash\_ripemd160.cp38-win32.pyd
%TEMP%\_mei27122\crypto\hash\_sha1.cp38-win32.pyd
%TEMP%\_mei27122\crypto\hash\_md5.cp38-win32.pyd
%TEMP%\_mei27122\crypto\hash\_sha224.cp38-win32.pyd
%TEMP%\_mei27122\_queue.pyd
%TEMP%\_mei27122\crypto\hash\_sha256.cp38-win32.pyd
%TEMP%\_mei27122\_overlapped.pyd
%TEMP%\_mei27122\_multiprocessing.pyd
%TEMP%\_mei27122\_lzma.pyd
%TEMP%\_mei27122\_hashlib.pyd
%TEMP%\_mei27122\_elementtree.pyd
%TEMP%\_mei27122\_decimal.pyd
%TEMP%\_mei27122\_ctypes.pyd
%TEMP%\_mei27122\_cffi_backend.cp38-win32.pyd
%TEMP%\_mei27122\_bz2.pyd
%TEMP%\_mei27122\_asyncio.pyd
%TEMP%\_mei27122\include\pyconfig.h
%TEMP%\_mei27122\selenium\webdriver\remote\getattribute.js
%TEMP%\_mei27122\crypto\util\_strxor.cp38-win32.pyd
%TEMP%\_mei27122\crypto\util\_cpuid_c.cp38-win32.pyd
%TEMP%\_mei27122\crypto\publickey\_ec_ws.cp38-win32.pyd
%TEMP%\_mei27122\crypto\protocol\_scrypt.cp38-win32.pyd
%TEMP%\_mei27122\crypto\math\_modexp.cp38-win32.pyd
%TEMP%\_mei27122\crypto\hash\_poly1305.cp38-win32.pyd
%TEMP%\_mei27122\crypto\hash\_keccak.cp38-win32.pyd
%TEMP%\_mei27122\crypto\hash\_ghash_portable.cp38-win32.pyd
%TEMP%\_mei27122\crypto\hash\_ghash_clmul.cp38-win32.pyd
%TEMP%\_mei27122\crypto\hash\_sha512.cp38-win32.pyd
%TEMP%\_mei27122\crypto\hash\_sha384.cp38-win32.pyd
%TEMP%\_mei27122\vcruntime140.dll
%TEMP%\_mei27122\selenium\webdriver\remote\isdisplayed.js

Deletes the following files

%TEMP%\_mei27122\base_library.zip
%TEMP%\_mei27122\selenium\webdriver\firefox\webdriver_prefs.json
%TEMP%\_mei27122\selenium\webdriver\firefox\webdriver.xpi
%TEMP%\_mei27122\selenium\webdriver\firefox\amd64\x_ignore_nofocus.so
%TEMP%\_mei27122\select.pyd
%TEMP%\_mei27122\ruiner.exe.manifest
%TEMP%\_mei27122\pywintypes38.dll
%TEMP%\_mei27122\pythoncom38.dll
%TEMP%\_mei27122\python38.dll
%TEMP%\_mei27122\pyexpat.pyd
%TEMP%\_mei27122\pycares\_cares.cp38-win32.pyd
%TEMP%\_mei27122\selenium\webdriver\remote\getattribute.js
%TEMP%\_mei27122\selenium\webdriver\firefox\x86\x_ignore_nofocus.so
%TEMP%\_mei27122\numpy\random\_philox.cp38-win32.pyd
%TEMP%\_mei27122\numpy\random\_pcg64.cp38-win32.pyd
%TEMP%\_mei27122\numpy\random\_mt19937.cp38-win32.pyd
%TEMP%\_mei27122\numpy\random\_generator.cp38-win32.pyd
%TEMP%\_mei27122\numpy\random\_common.cp38-win32.pyd
%TEMP%\_mei27122\numpy\random\_bounded_integers.cp38-win32.pyd
%TEMP%\_mei27122\numpy\random\mtrand.cp38-win32.pyd
%TEMP%\_mei27122\numpy\random\bit_generator.cp38-win32.pyd
%TEMP%\_mei27122\numpy\linalg\_umath_linalg.cp38-win32.pyd
%TEMP%\_mei27122\numpy\linalg\lapack_lite.cp38-win32.pyd
%TEMP%\_mei27122\psutil\_psutil_windows.cp38-win32.pyd
%TEMP%\_mei27122\crypto\hash\_md5.cp38-win32.pyd
%TEMP%\_mei27122\selenium\webdriver\remote\isdisplayed.js
%TEMP%\_mei27122\_sqlite3.pyd
%TEMP%\_mei27122\_socket.pyd
%TEMP%\_mei27122\_queue.pyd
%TEMP%\_mei27122\_overlapped.pyd
%TEMP%\_mei27122\_multiprocessing.pyd
%TEMP%\_mei27122\_lzma.pyd
%TEMP%\_mei27122\_hashlib.pyd
%TEMP%\_mei27122\_elementtree.pyd
%TEMP%\_mei27122\_decimal.pyd
%TEMP%\_mei27122\_ctypes.pyd
%TEMP%\_mei27122\_cffi_backend.cp38-win32.pyd
%TEMP%\_mei27122\_bz2.pyd
%TEMP%\_mei27122\_asyncio.pyd
%TEMP%\_mei27122\yarl\_quoting.cp38-win32.pyd
%TEMP%\_mei27122\win32wnet.pyd
%TEMP%\_mei27122\win32ui.pyd
%TEMP%\_mei27122\win32trace.pyd
%TEMP%\_mei27122\win32pdh.pyd
%TEMP%\_mei27122\win32crypt.pyd
%TEMP%\_mei27122\win32com\shell\shell.pyd
%TEMP%\_mei27122\win32api.pyd
%TEMP%\_mei27122\vcruntime140.dll
%TEMP%\_mei27122\unicodedata.pyd
%TEMP%\_mei27122\numpy\fft\_pocketfft_internal.cp38-win32.pyd
%TEMP%\_mei27122\numpy\random\_sfc64.cp38-win32.pyd
%TEMP%\_mei27122\numpy\core\_multiarray_umath.cp38-win32.pyd
%TEMP%\_mei27122\numpy\core\_multiarray_tests.cp38-win32.pyd
%TEMP%\_mei27122\nacl\_sodium.cp38-win32.pyd
%TEMP%\_mei27122\crypto\cipher\_raw_des.cp38-win32.pyd
%TEMP%\_mei27122\crypto\hash\_ghash_portable.cp38-win32.pyd
%TEMP%\_mei27122\crypto\hash\_ghash_clmul.cp38-win32.pyd
%TEMP%\_mei27122\crypto\hash\_blake2s.cp38-win32.pyd
%TEMP%\_mei27122\crypto\hash\_blake2b.cp38-win32.pyd
%TEMP%\_mei27122\crypto\cipher\_salsa20.cp38-win32.pyd
%TEMP%\_mei27122\crypto\cipher\_raw_ofb.cp38-win32.pyd
%TEMP%\_mei27122\crypto\cipher\_raw_ocb.cp38-win32.pyd
%TEMP%\_mei27122\crypto\cipher\_raw_eksblowfish.cp38-win32.pyd
%TEMP%\_mei27122\crypto\cipher\_raw_ecb.cp38-win32.pyd
%TEMP%\_mei27122\crypto\cipher\_raw_des3.cp38-win32.pyd
%TEMP%\_mei27122\crypto\cipher\_raw_ctr.cp38-win32.pyd
%TEMP%\_mei27122\crypto\hash\_md2.cp38-win32.pyd
%TEMP%\_mei27122\crypto\cipher\_raw_cfb.cp38-win32.pyd
%TEMP%\_mei27122\crypto\cipher\_raw_cbc.cp38-win32.pyd
%TEMP%\_mei27122\crypto\cipher\_raw_cast.cp38-win32.pyd
%TEMP%\_mei27122\crypto\cipher\_raw_blowfish.cp38-win32.pyd
%TEMP%\_mei27122\crypto\cipher\_raw_arc2.cp38-win32.pyd
%TEMP%\_mei27122\crypto\cipher\_raw_aesni.cp38-win32.pyd
%TEMP%\_mei27122\crypto\cipher\_raw_aes.cp38-win32.pyd
%TEMP%\_mei27122\crypto\cipher\_chacha20.cp38-win32.pyd
%TEMP%\_mei27122\crypto\cipher\_arc4.cp38-win32.pyd
%TEMP%\_mei27122\certifi\cacert.pem
%TEMP%\_mei27122\_ssl.pyd
%TEMP%\_mei27122\sqlite3.dll
%TEMP%\_mei27122\crypto\hash\_md4.cp38-win32.pyd
%TEMP%\_mei27122\crypto\hash\_ripemd160.cp38-win32.pyd
%TEMP%\_mei27122\crypto\hash\_keccak.cp38-win32.pyd
%TEMP%\_mei27122\multidict\_multidict.cp38-win32.pyd
%TEMP%\_mei27122\mfc140u.dll
%TEMP%\_mei27122\libssl-1_1.dll
%TEMP%\_mei27122\libopenblas.u35rt5x5bpdsh5ztf276yadqr2kdu6pr.gfortran-win32.dll
%TEMP%\_mei27122\libffi-7.dll
%TEMP%\_mei27122\libcrypto-1_1.dll
%TEMP%\_mei27122\lib2to3\tests\data\readme
%TEMP%\_mei27122\lib2to3\patterngrammar3.8.0.final.0.pickle
%TEMP%\_mei27122\lib2to3\patterngrammar.txt
%TEMP%\_mei27122\lib2to3\grammar3.8.0.final.0.pickle
%TEMP%\_mei27122\lib2to3\grammar.txt
%TEMP%\_mei27122\include\pyconfig.h
%TEMP%\_mei27122\crypto\util\_strxor.cp38-win32.pyd
%TEMP%\_mei27122\crypto\util\_cpuid_c.cp38-win32.pyd
%TEMP%\_mei27122\crypto\publickey\_ec_ws.cp38-win32.pyd
%TEMP%\_mei27122\crypto\protocol\_scrypt.cp38-win32.pyd
%TEMP%\_mei27122\crypto\math\_modexp.cp38-win32.pyd
%TEMP%\_mei27122\crypto\hash\_sha512.cp38-win32.pyd
%TEMP%\_mei27122\crypto\hash\_sha384.cp38-win32.pyd
%TEMP%\_mei27122\crypto\hash\_sha256.cp38-win32.pyd
%TEMP%\_mei27122\crypto\hash\_sha224.cp38-win32.pyd
%TEMP%\_mei27122\crypto\hash\_sha1.cp38-win32.pyd
%TEMP%\_mei27122\crypto\hash\_poly1305.cp38-win32.pyd
%TEMP%\_mei27122\_win32sysloader.pyd

Network activity

TCP

HTTP GET requests

http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt

'Ho######069.portmap.host':43069

UDP

DNS ASK Ho######069.portmap.host
DNS ASK microsoft.com

Miscellaneous

Creates and executes the following

'%TEMP%\ldpiqqffg.exe'
'%TEMP%\jcdvw.exe'

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней