Trojan.DownLoader38.25903

Technical Information

Modifies file system

Creates the following files

%WINDIR%\syswow64\angrymailer\givgxxo\gei\pjkdntpjppthgvm\bvwwdqezdbbrjmnj\veqbp\owokcjxpgjwrugffvwoq.ini
%WINDIR%\syswow64\angrymailer\yidwudodqt\vnjeuorzqj2021-04-05_16_34_46_380.txt
%WINDIR%\syswow64\angrymailer\temp\hxyldvrpcecwu\wzitmjtoxxsnbwehu\onwewfqm.txt
%WINDIR%\syswow64\angrymailer\smwiuw\qcycpwfht\lodxuxyxwtebqq2021-04-05_16_34_44_071.txt
%WINDIR%\syswow64\angrymailer_1.0.3.0\angrymailer.51.la.html
%WINDIR%\syswow64\angrymailer_1.0.3.0\skinh.she
%WINDIR%\syswow64\angrymailer_1.0.3.0\skinh.dll
<PATH_SAMPLE>_db_account.db-wal
<PATH_SAMPLE>_db_account.db-shm
<PATH_SAMPLE>_db_account.db
<PATH_SAMPLE>_db_account.db-journal
%WINDIR%\syswow64\angrymailer\versionno\xnobtlhfsus\kempyjczjen\idrmux\bedmumvgczyarqw\lwnneywuycfzatdjf\ffjxwlcp2021-04-05_16_34_42_979.txt
<PATH_SAMPLE>_db_linkman.db-wal
<PATH_SAMPLE>_db_linkman.db
<PATH_SAMPLE>_db_linkman.db-journal
<PATH_SAMPLE>_db_receiver.db-wal
<PATH_SAMPLE>_db_receiver.db-shm
<PATH_SAMPLE>_db_receiver.db
<PATH_SAMPLE>_db_receiver.db-journal
<PATH_SAMPLE>_db_email.db-wal
<PATH_SAMPLE>_db_email.db-shm
<PATH_SAMPLE>_db_email.db
<PATH_SAMPLE>_db_email.db-journal
<PATH_SAMPLE>_db_linkman.db-shm
<Current directory>\2021-04-05_16_34_42_979.amtemp

Deletes the following files

<PATH_SAMPLE>_db_email.db-journal
<PATH_SAMPLE>_db_email.db-shm
<PATH_SAMPLE>_db_email.db-wal
<PATH_SAMPLE>_db_receiver.db-journal
<PATH_SAMPLE>_db_receiver.db-shm
<PATH_SAMPLE>_db_receiver.db-wal
<PATH_SAMPLE>_db_linkman.db-journal
<PATH_SAMPLE>_db_linkman.db-shm
<PATH_SAMPLE>_db_linkman.db-wal
<PATH_SAMPLE>_db_account.db-journal
<PATH_SAMPLE>_db_account.db-shm
<PATH_SAMPLE>_db_account.db-wal

Modifies the following files

Substitutes the following executable files

<Full path to file>

Substitutes the following files

<PATH_SAMPLE>_db_email.db-shm
<PATH_SAMPLE>_db_email.db-wal
<PATH_SAMPLE>_db_receiver.db-shm
<PATH_SAMPLE>_db_receiver.db-wal
<PATH_SAMPLE>_db_linkman.db-shm
<PATH_SAMPLE>_db_linkman.db-wal
<PATH_SAMPLE>_db_account.db-shm
<PATH_SAMPLE>_db_account.db-wal

Moves itself

from <Full path to file> to <Current directory>\1.0.3.0.2021-04-05_16_34_42_979.amtemp

Network activity

Connects to

'ci##.ip138.com':80
'an###mailer.com':80
'fr###eoip.net':80
'hm.##idu.com':80
'hm.##idu.com':443
's2#.#nzz.com':80
'microsoft.com':80
'ww##.#lustrmaps.com':80
'co##.jquery.com':443

TCP

HTTP GET requests

http://fr###eoip.net/shutdown
http://www.an###mailer.com/Download/URL_List_Analyze.AngryMailer.txt.zip?ik###################
http://www.an###mailer.com/Adv/MailHead_AngryMailer.html.zip?ia##########################################
http://www.an###mailer.com/Download/URL_List_SEO.txt.zip?ez####################
http://www.an###mailer.com/Adv/MailTail_AngryMailer.html.zip?cv##############################################
http://www.an###mailer.com/Adv/MailHead_AngryMailer.txt.zip?jr########################################
http://www.an###mailer.com/Adv/MailTail_AngryMailer.txt.zip?ph##################################################
http://www.an###mailer.com/Config/Config_AngryMailer.zip?oi#####################################
http://www.an###mailer.com/Download/AngryMailer_CN_Free.LastVersionNo.zip?lm##########################################
http://www.an###mailer.com/Download/AngryMailer_CN_Free.exe?bk#######################################
http://www.an###mailer.com/HTML/Analysis/AngryMailer.tongji.baidu.com.html?PE#########################################################################################################
http://www.an###mailer.com/HTML/Analysis/AngryMailer.tongji.cnzz.com.html?PE#########################################################################################################
http://www.an###mailer.com/HTML/Analysis/AngryMailer.ta.qq.com.html?PE#########################################################################################################
http://www.an###mailer.com/HTML/Analysis/AngryMailer.clustrmaps.com.html?PE#########################################################################################################
http://www.an###mailer.com/HTML/Analysis/AngryMailer.google.com.analytics.html?PE#########################################################################################################