Trojan.DownLoader46.53102

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\] 'CSRSS' = '"%ALLUSERSPROFILE%\Drivers\csrss.exe"'

Creates or modifies the following files

<SYSTEM32>\tasks\firefox default browser agent e1500ed7238d0c2e

Modifies master boot record (MBR).

Malicious functions

Injects code into

the following user processes:

5531.exe

Modifies file system

Creates the following files

%APPDATA%\bfbhddv
%LOCALAPPDATA%\dvd slow\is-rpuri.tmp
%LOCALAPPDATA%\dvd slow\is-gdgma.tmp
%LOCALAPPDATA%\dvd slow\is-oqnm8.tmp
%LOCALAPPDATA%\dvd slow\is-lo7p5.tmp
%LOCALAPPDATA%\dvd slow\is-901nv.tmp
%LOCALAPPDATA%\dvd slow\is-k4r3b.tmp
%LOCALAPPDATA%\dvd slow\is-vanic.tmp
%LOCALAPPDATA%\dvd slow\is-gc2cq.tmp
%LOCALAPPDATA%\dvd slow\is-2tet9.tmp
%LOCALAPPDATA%\dvd slow\is-ou5cq.tmp
%LOCALAPPDATA%\dvd slow\is-enlcp.tmp
%LOCALAPPDATA%\dvd slow\is-nvb7q.tmp
%LOCALAPPDATA%\dvd slow\is-8htn7.tmp
%LOCALAPPDATA%\dvd slow\languages\is-orsdg.tmp
%LOCALAPPDATA%\dvd slow\is-t09b6.tmp
%LOCALAPPDATA%\dvd slow\is-0tl42.tmp
%LOCALAPPDATA%\dvd slow\unins000.dat
%TEMP%\4kpv6a~1\cached-microdescs.new
%TEMP%\4kpv6a~1\cached-certs.tmp
%TEMP%\5531.exe
%ALLUSERSPROFILE%\drivers\csrss.exe
%TEMP%\5d7b.dll
%TEMP%\670e.exe
%TEMP%\9224.exe
%TEMP%\4kpv6a~1\state.tmp
%TEMP%\b732.exe
%TEMP%\e728.exe
%TEMP%\f2dc.exe
%TEMP%\is-nr39o.tmp\e728.tmp
%TEMP%\is-ahvmk.tmp\_isetup\_setup64.tmp
%TEMP%\is-ahvmk.tmp\_isetup\_shfoldr.dll
%TEMP%\is-ahvmk.tmp\_isetup\_isdecmp.dll
%TEMP%\is-ahvmk.tmp\_isetup\_iscrypt.dll
%TEMP%\4kpv6a~1\unverified-microdesc-consensus.tmp
%TEMP%\4kpv6a~1\cached-microdesc-consensus.tmp
%LOCALAPPDATA%\dvd slow\dvdslow.exe

Sets the 'hidden' attribute to the following files

%APPDATA%\bfbhddv
%ALLUSERSPROFILE%\drivers\csrss.exe

Deletes the following files

%TEMP%\4kpv6a~1\unverified-microdesc-consensus
%LOCALAPPDATA%\dvd slow\libgcc_s_dw2-1.dll
%TEMP%\4kpv6a~1\state

Moves the following files

from %TEMP%\4kpv6a~1\state.tmp to %TEMP%\4kpv6a~1\state
from %LOCALAPPDATA%\dvd slow\is-8htn7.tmp to %LOCALAPPDATA%\dvd slow\setting.ini
from %LOCALAPPDATA%\dvd slow\is-nvb7q.tmp to %LOCALAPPDATA%\dvd slow\sdl2.dll
from %LOCALAPPDATA%\dvd slow\is-enlcp.tmp to %LOCALAPPDATA%\dvd slow\swresample-3.dll
from %LOCALAPPDATA%\dvd slow\is-ou5cq.tmp to %LOCALAPPDATA%\dvd slow\zlib1.dll
from %LOCALAPPDATA%\dvd slow\is-2tet9.tmp to %LOCALAPPDATA%\dvd slow\libbz2-1.dll
from %LOCALAPPDATA%\dvd slow\is-gc2cq.tmp to %LOCALAPPDATA%\dvd slow\libwinpthread-1.dll
from %LOCALAPPDATA%\dvd slow\is-vanic.tmp to %LOCALAPPDATA%\dvd slow\libvorbisenc-2.dll
from %LOCALAPPDATA%\dvd slow\languages\is-orsdg.tmp to %LOCALAPPDATA%\dvd slow\languages\turkish.ini
from %LOCALAPPDATA%\dvd slow\is-k4r3b.tmp to %LOCALAPPDATA%\dvd slow\libvorbis-0.dll
from %LOCALAPPDATA%\dvd slow\is-lo7p5.tmp to %LOCALAPPDATA%\dvd slow\libiconv-2.dll
from %LOCALAPPDATA%\dvd slow\is-gdgma.tmp to %LOCALAPPDATA%\dvd slow\avutil-56.dll
from %LOCALAPPDATA%\dvd slow\is-rpuri.tmp to %LOCALAPPDATA%\dvd slow\libgcc_s_dw2-1.dll
from %LOCALAPPDATA%\dvd slow\is-0tl42.tmp to %LOCALAPPDATA%\dvd slow\unins000.exe
from %TEMP%\4kpv6a~1\cached-microdesc-consensus.tmp to %TEMP%\4kpv6a~1\cached-microdesc-consensus
from %TEMP%\4kpv6a~1\cached-certs.tmp to %TEMP%\4kpv6a~1\cached-certs
from %TEMP%\4kpv6a~1\unverified-microdesc-consensus.tmp to %TEMP%\4kpv6a~1\unverified-microdesc-consensus
from %LOCALAPPDATA%\dvd slow\is-901nv.tmp to %LOCALAPPDATA%\dvd slow\libogg-0.dll
from %LOCALAPPDATA%\dvd slow\is-t09b6.tmp to %LOCALAPPDATA%\dvd slow\dvdslow.exe

Substitutes the following files

%LOCALAPPDATA%\dvd slow\libgcc_s_dw2-1.dll
%TEMP%\4kpv6a~1\state.tmp
%TEMP%\4kpv6a~1\state

Deletes itself.

Network activity

Connects to

'se####ation17io.io':80
'18#.#72.128.19':80
'localhost':49188
'17#.#3.183.251':443
'18#.#59.70.47':46031
'10#.#9.229.147':443
'tr##c.com':80
'en.##stsup.su':80
'31.#27.34.9':9001
'19#.#8.81.140':443
'18#.#13.94.245':9001
'17#.#2.47.60':9001
'5.#.121.207':443
'localhost':55174

TCP

HTTP GET requests

http://18#.#72.128.19/288c47bbc1871b439df19ff4df68f0776.exe
http://tr##c.com/check/index.php
http://en.##stsup.su/data/pdf/may.exe
http://x5###############dj2m6eq4amkkpndbqyvmvaz6yl4mmfco6oqxsqd.onion/upd.php?n=#################################################################################################################...
http://x5###############dj2m6eq4amkkpndbqyvmvaz6yl4mmfco6oqxsqd.onion/task.php?n=################################################################################################################...
http://x5###############dj2m6eq4amkkpndbqyvmvaz6yl4mmfco6oqxsqd.onion/reg.php?n=#####################################################

HTTP POST requests