Trojan.DownLoader46.53158

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\] 'CSRSS' = '"%ALLUSERSPROFILE%\Drivers\csrss.exe"'

Creates or modifies the following files

<SYSTEM32>\tasks\firefox default browser agent 332344e6516ece46

Sets the following service settings

[HKLM\System\CurrentControlSet\Services\WBICreatorService 6.5] 'Start' = '00000002'
[HKLM\System\CurrentControlSet\Services\WBICreatorService 6.5] 'ImagePath' = '%ALLUSERSPROFILE%\WBICreatorService 6.5\WBICreatorService 6.5.exe'

Creates the following services

'WBICreatorService 6.5' %ALLUSERSPROFILE%\WBICreatorService 6.5\WBICreatorService 6.5.exe

Modifies master boot record (MBR).

Malicious functions

Injects code into

the following user processes:

676d.exe

Modifies file system

Creates the following files

%APPDATA%\vrbtect
%TEMP%\4kpv6a~1\cached-certs.tmp
%TEMP%\4kpv6a~1\unverified-microdesc-consensus.tmp
%ALLUSERSPROFILE%\wbicreatorservice 6.5\wbicreatorservice 6.5.exe
%TEMP%\4kpv6a~1\state.tmp
%ALLUSERSPROFILE%\drivers\csrss.exe
%LOCALAPPDATA%\menu\menu.exe
%LOCALAPPDATA%\menu\unins000.dat
%LOCALAPPDATA%\menu\is-kc86d.tmp
%LOCALAPPDATA%\menu\languages\is-c12mm.tmp
%LOCALAPPDATA%\menu\is-ev706.tmp
%LOCALAPPDATA%\menu\is-i79su.tmp
%LOCALAPPDATA%\menu\is-3e2si.tmp
%LOCALAPPDATA%\menu\is-iimm4.tmp
%LOCALAPPDATA%\menu\is-3lo5g.tmp
%LOCALAPPDATA%\menu\is-97vak.tmp
%LOCALAPPDATA%\menu\is-0vsm9.tmp
%LOCALAPPDATA%\menu\is-dftj2.tmp
%LOCALAPPDATA%\menu\is-0r5df.tmp
%LOCALAPPDATA%\menu\is-m732d.tmp
%TEMP%\7f80.exe
%TEMP%\676d.exe
%TEMP%\4e32.exe
%TEMP%\is-m4aer.tmp\_isetup\_iscrypt.dll
%TEMP%\is-m4aer.tmp\_isetup\_shfoldr.dll
%TEMP%\is-m4aer.tmp\_isetup\_setup64.tmp
%TEMP%\is-3cbp8.tmp\31db.tmp
%TEMP%\31db.exe
%TEMP%\29bf.dll
%TEMP%\425.exe
%TEMP%\4kpv6a~1\cached-microdesc-consensus.tmp
%TEMP%\4kpv6a~1\cached-microdescs.new

Sets the 'hidden' attribute to the following files

%APPDATA%\vrbtect
%ALLUSERSPROFILE%\drivers\csrss.exe

Deletes the following files

%LOCALAPPDATA%\menu\libgcc_s_dw2-1.dll
%TEMP%\29bf.dll
%TEMP%\4kpv6a~1\unverified-microdesc-consensus
%TEMP%\4kpv6a~1\cached-certs
%TEMP%\4kpv6a~1\state

Moves the following files

from %LOCALAPPDATA%\menu\is-m732d.tmp to %LOCALAPPDATA%\menu\unins000.exe
from %LOCALAPPDATA%\menu\is-0r5df.tmp to %LOCALAPPDATA%\menu\libgcc_s_dw2-1.dll
from %LOCALAPPDATA%\menu\is-0vsm9.tmp to %LOCALAPPDATA%\menu\libogg-0.dll
from %LOCALAPPDATA%\menu\is-97vak.tmp to %LOCALAPPDATA%\menu\libvorbis-0.dll
from %LOCALAPPDATA%\menu\is-3lo5g.tmp to %LOCALAPPDATA%\menu\libwinpthread-1.dll
from %LOCALAPPDATA%\menu\is-iimm4.tmp to %LOCALAPPDATA%\menu\libbz2-1.dll
from %LOCALAPPDATA%\menu\is-3e2si.tmp to %LOCALAPPDATA%\menu\zlib1.dll
from %LOCALAPPDATA%\menu\is-i79su.tmp to %LOCALAPPDATA%\menu\swresample-3.dll
from %LOCALAPPDATA%\menu\is-ev706.tmp to %LOCALAPPDATA%\menu\setting.ini
from %LOCALAPPDATA%\menu\languages\is-c12mm.tmp to %LOCALAPPDATA%\menu\languages\turkish.ini
from %LOCALAPPDATA%\menu\is-kc86d.tmp to %LOCALAPPDATA%\menu\menu.exe
from %TEMP%\4kpv6a~1\state.tmp to %TEMP%\4kpv6a~1\state
from %TEMP%\4kpv6a~1\unverified-microdesc-consensus.tmp to %TEMP%\4kpv6a~1\unverified-microdesc-consensus
from %TEMP%\4kpv6a~1\cached-certs.tmp to %TEMP%\4kpv6a~1\cached-certs
from %TEMP%\4kpv6a~1\cached-microdesc-consensus.tmp to %TEMP%\4kpv6a~1\cached-microdesc-consensus

Substitutes the following files

%LOCALAPPDATA%\menu\libgcc_s_dw2-1.dll
%TEMP%\4kpv6a~1\cached-certs.tmp
%TEMP%\4kpv6a~1\cached-certs
%TEMP%\4kpv6a~1\state

Deletes itself.

Network activity

Connects to

'se####ation17io.io':80
'as####-buyer.com':443
'as####fotech.com':443
'localhost':49322
'so###mviver.com':443
'be###niet.com':443
'bm###ybar.com':443
'as####olcano.com':443
'bb###neco.com':443
'sr###roduct.com':443
'ax####velops.com':443
'as####munity.com':443
'ar####ptions.com':443
'ar####-amade.com':443
'br#####servicesllc.com':443
'ap####vip-br.com':443
'ap####ru-seo.com':443
'at###noir.com':443
'ba####g-stay.com':443
'be###ours.com':443
'br###luxe.com':443
'va######nsportnature.com':443
'bo###upnj.com':443
'an####erdomo.com':443
'bu###dudu.com':443
'b2####lition.com':443
'bd###acus.com':443
'aw####alazel.com':443
'an####eorban.com':443
'as###humi.com':443
'be####amille.com':443
'ay####coffee.com':443
'be####bet-br.com':443
'ba####zuriel.com':443
'localhost':49377
'localhost':49375
'localhost':49373
'localhost':49371
'localhost':49369
'localhost':49367
'localhost':49365
'localhost':49363
'localhost':49361
'localhost':49359
'ba####magico.com':443
'localhost':49355
're###tcha.cloud':443
'ba###s184.com':443
'ba###s435.com':443
'au####ysk-pl.com':443
'localhost':49349
'as###ajit.com':443
'localhost':49346
'aq####ave-tr.com':443
'ba###aius.com':443
'ss###raders.com':443
'ar####eideas.com':443
'an####uplink.com':443
'ba####zerian.com':443
'ap####top-br.com':443
'al####dallas.com':443
'an####oradio.com':443
'localhost':49237
'localhost':49233
'localhost':49231
'localhost':49229
'localhost':49227
'localhost':49225
'localhost':49223
'localhost':49221
'localhost':49219
'localhost':49217
'localhost':49215
'localhost':49213
'localhost':49211
'localhost':49209
'localhost':49207
'localhost':49205
'localhost':49203
'localhost':49201
'localhost':49199
'localhost':20544
'66.#06.0.82':9001
'85.##0.227.103':443
'19#.#45.61.196':443
'13#.#62.210.252':443
'localhost':49189
'tr##c.com':80
'18#.#72.128.19':80
'jo##.bestsup.su':80
'localhost':49235
'localhost':49239
'localhost':49297
'localhost':49241
'localhost':49295
'localhost':49293
'localhost':49291
'localhost':49289
'localhost':49287
'localhost':49283
'localhost':49284
'localhost':49281
'localhost':49279
'localhost':49277
'localhost':49275
'localhost':49273
'localhost':49271
'localhost':49269
'localhost':49267
'localhost':49265
'localhost':49263
'localhost':49261
'localhost':49259
'localhost':49257
'localhost':49255
'localhost':49253
'localhost':49251
'localhost':49249
'localhost':49247
'localhost':49245
'localhost':49243
'an####esifre.com':443
'localhost':49382

TCP

HTTP GET requests

http://jo##.bestsup.su/data/pdf/may.exe
http://18#.#72.128.19/288c47bbc1871b439df19ff4df68f0776.exe
http://tr##c.com/check/index.php
http://x5###############dj2m6eq4amkkpndbqyvmvaz6yl4mmfco6oqxsqd.onion/upd.php?n=#################################################################################################################...
http://x5###############dj2m6eq4amkkpndbqyvmvaz6yl4mmfco6oqxsqd.onion/task.php?n=################################################################################################################...

HTTP POST requests

http://se####ation17io.io/index.php

Other

'13#.#62.210.252':443
'localhost':49272
'localhost':49252
'at###noir.com':443
'be###ours.com':443
'br###luxe.com':443
'so###mviver.com':443
'localhost':49276
'localhost':49329
'localhost':49206
'bm###ybar.com':443
'localhost':49236
'b2####lition.com':443
'be###niet.com':443
'bb###neco.com':443
'localhost':49294
'bd###acus.com':443
'localhost':49240
'sr###roduct.com':443
'ar####-amade.com':443
'as####fotech.com':443
'br#####servicesllc.com':443
'as####munity.com':443
'an####eorban.com':443
'as###humi.com':443
'localhost':49368
'localhost':49254
'localhost':49362
'localhost':49356
'ba###s184.com':443
'localhost':49350
'ss###raders.com':443
'as###ajit.com':443
'au####ysk-pl.com':443
'ba###s435.com':443
're###tcha.cloud':443
'ba###aius.com':443
'localhost':49246
'ay####coffee.com':443
'localhost':49347
'ar####eideas.com':443
'localhost':49204
'aq####ave-tr.com':443
'localhost':49285
'localhost':49210
'localhost':49200
'an####uplink.com':443
'ba####zerian.com':443
'localhost':49264
'localhost':49208
'localhost':49260
'ap####ru-seo.com':443
'localhost':49278
'localhost':49274
'localhost':49286
'localhost':49218
'localhost':49288
'localhost':49296
'localhost':49202
'localhost':49262
'localhost':49228
'localhost':49258
'localhost':49298
'localhost':49244
'localhost':49224
'localhost':49290
'localhost':49256
'localhost':49242
'localhost':49222
'localhost':49248
'localhost':49198
'localhost':49196
'localhost':20544
'66.#06.0.82':9001
'85.##0.227.103':443
'localhost':49214
'va######nsportnature.com':443
'as####olcano.com':443
'localhost':49238
'bo###upnj.com':443
'localhost':49280
'localhost':49270
'ax####velops.com':443
'ap####vip-br.com':443
'ar####ptions.com':443
'an####oradio.com':443
'ap####top-br.com':443
'localhost':49232
'an####erdomo.com':443
'bu###dudu.com':443
'localhost':49216
'localhost':49220
'localhost':49212
'localhost':49234
'aw####alazel.com':443
'ap####esclub.com':443
'localhost':49268
'localhost':49282
'localhost':49250
'localhost':49292
'localhost':49226
'localhost':49266
'localhost':49366

UDP

DNS ASK se####ation17io.io
DNS ASK ba###s184.com
DNS ASK as####edward.com
DNS ASK br#####servicesllc.com
DNS ASK as####-buyer.com
DNS ASK sr###roduct.com
DNS ASK au####ysk-pl.com
DNS ASK va######nsportnature.com
DNS ASK as###humi.com
DNS ASK an####esifre.com
DNS ASK br###luxe.com
DNS ASK ay####coffee.com
DNS ASK ax####velops.com
DNS ASK bb###neco.com
DNS ASK ar####-amade.com
DNS ASK at###noir.com
DNS ASK an####erdomo.com
DNS ASK ba####zerian.com
DNS ASK as###ajit.com
DNS ASK re###tcha.cloud
DNS ASK sa###mi-sp.com
DNS ASK ba####magico.com
DNS ASK ba####banhan.com
DNS ASK ba####zuriel.com
DNS ASK be####amille.com
DNS ASK be####bet-br.com
DNS ASK be####santai.com
DNS ASK be####pro-br.com
DNS ASK bi####ionusa.com
DNS ASK al####rminum.com
DNS ASK an####oradio.com
DNS ASK ar####eideas.com
DNS ASK bo###upnj.com
DNS ASK ar####sagora.com
DNS ASK tr##c.com
DNS ASK ba###aius.com
DNS ASK bd###acus.com
DNS ASK be###niet.com
DNS ASK ap####esclub.com
DNS ASK bm###ybar.com
DNS ASK ap####top-br.com
DNS ASK bu###dudu.com
DNS ASK ap####vip-br.com
DNS ASK ss###raders.com
DNS ASK ap####ru-seo.com
DNS ASK al####dallas.com
DNS ASK ar####ptions.com
DNS ASK bl####tjoins.com
DNS ASK so###mviver.com
DNS ASK an####eorban.com
DNS ASK as####munity.com
DNS ASK as####olcano.com
DNS ASK an####uplink.com
DNS ASK au####liamod.com
DNS ASK aw####alazel.com
DNS ASK b2####lition.com
DNS ASK ap####max-br.com
DNS ASK be###ours.com
DNS ASK ap####win-br.com
DNS ASK ba####g-stay.com
DNS ASK un###quotes.com
DNS ASK ba###s435.com
DNS ASK aq####ave-tr.com
DNS ASK jo##.bestsup.su
DNS ASK as####fotech.com
DNS ASK bl####9music.com

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: 'Xd5431_Flash2253FixClass_Xd5431'

Creates and executes the following

'%TEMP%\425.exe'
'%TEMP%\31db.exe'
'%TEMP%\is-3cbp8.tmp\31db.tmp' /SL5="$F0242,2376314,54272,%TEMP%\31DB.exe"
'%TEMP%\4e32.exe'
'%TEMP%\676d.exe'
'%TEMP%\7f80.exe'
'%LOCALAPPDATA%\menu\menu.exe' -i
'%LOCALAPPDATA%\menu\menu.exe' -s

Executes the following

'<SYSTEM32>\regsvr32.exe' /s %TEMP%\29BF.dll

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней