Trojan.DownLoader11.23968

Technical Information

To ensure autorun and distribution:

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\srvBrowserProtect] 'Start' = '00000002'

Malicious functions:

Creates and executes the following:

'%PROGRAM_FILES%\BrowserProtect\srvBrowserProtect.exe'
'%TEMP%\nsr2.tmp\ns4.tmp' taskkill /f /im myproxy.exe
'%TEMP%\nsr2.tmp\ns3.tmp' taskkill /f /im BrowserProtectIU.exe

Executes the following:

'<SYSTEM32>\taskkill.exe' /f /im myproxy.exe
'<SYSTEM32>\taskkill.exe' /f /im BrowserProtectIU.exe

Modifies file system :

Creates the following files:

%TEMP%\nsp10.tmp
%TEMP%\nsnF.tmp
%TEMP%\nslE.tmp
%TEMP%\nsp13.tmp
%TEMP%\nsc12.tmp
%TEMP%\nsl11.tmp
%TEMP%\nsfA.tmp
%TEMP%\nsd9.tmp
%TEMP%\nsx8.tmp
%TEMP%\nszD.tmp
%TEMP%\nssC.tmp
%TEMP%\nshB.tmp
%TEMP%\nst1C.tmp
%TEMP%\nso1B.tmp
%TEMP%\nsd1A.tmp
%PROGRAM_FILES%\BrowserProtect\versionBPSrvSw
%PROGRAM_FILES%\BrowserProtect\updateSrv\updateBPSrv.zip
%PROGRAM_FILES%\BrowserProtect\uninstall.exe
%TEMP%\nsv16.tmp
%TEMP%\nsi15.tmp
%TEMP%\nsl14.tmp
%TEMP%\nsr19.tmp
%TEMP%\nse18.tmp
%TEMP%\nsm17.tmp
%TEMP%\nsq7.tmp
%PROGRAM_FILES%\BrowserProtect\proxy\exclusions
%PROGRAM_FILES%\BrowserProtect\proxy\config
%TEMP%\nsr2.tmp\tkDecript.dll
%PROGRAM_FILES%\BrowserProtect\proxy\zlibwapi.dll
%PROGRAM_FILES%\BrowserProtect\proxy\myproxy.exe
%PROGRAM_FILES%\BrowserProtect\proxy\matches
%TEMP%\nsr2.tmp\ns3.tmp
%TEMP%\nsr2.tmp\nsExec.dll
%TEMP%\nsr2.tmp\SimpleSC.dll
%TEMP%\nsr2.tmp\nsBR.dll
%TEMP%\nsr2.tmp\System.dll
%TEMP%\nsr2.tmp\ns4.tmp
%PROGRAM_FILES%\BrowserProtect\search-with-eazelbar.xml
%PROGRAM_FILES%\BrowserProtect\translations.xml
%PROGRAM_FILES%\BrowserProtect\Newtonsoft.Json.dll
%TEMP%\nsx6.tmp
%TEMP%\nsy5.tmp
%PROGRAM_FILES%\BrowserProtect\Web Data
%PROGRAM_FILES%\BrowserProtect\BrowserProtectIUW8.exe
%PROGRAM_FILES%\BrowserProtect\srvBrowserProtect.exe
%PROGRAM_FILES%\BrowserProtect\BrowserProtectIU.exe
%PROGRAM_FILES%\BrowserProtect\Interop.Shell32.dll
%PROGRAM_FILES%\BrowserProtect\config.xml
%PROGRAM_FILES%\BrowserProtect\srvBrowserProtectW8.exe

Deletes the following files:

%TEMP%\nsr2.tmp\nsExec.dll
%TEMP%\nsr2.tmp\nsBR.dll
%PROGRAM_FILES%\BrowserProtect\proxy\config.old
%TEMP%\nsr2.tmp\SimpleSC.dll
%PROGRAM_FILES%\BrowserProtect\updateSrv\updateBPSrv.zip
%TEMP%\nsr2.tmp\tkDecript.dll
%TEMP%\nsr2.tmp\System.dll
%PROGRAM_FILES%\BrowserProtect\BrowserProtectIUW8.exe
%TEMP%\nsr2.tmp\ns4.tmp
%TEMP%\nsr2.tmp\ns3.tmp
%PROGRAM_FILES%\BrowserProtect\BrowserProtectIUW8.exe.config
%PROGRAM_FILES%\BrowserProtect\config.xml.old
%PROGRAM_FILES%\BrowserProtect\BrowserProtectIU.exe.config.old
%PROGRAM_FILES%\BrowserProtect\srvBrowserProtectW8.exe

Moves the following files:

from %TEMP%\nsl14.tmp to %PROGRAM_FILES%\BrowserProtect\config.xml
from %TEMP%\nsi15.tmp to %PROGRAM_FILES%\BrowserProtect\config.xml
from %TEMP%\nsv16.tmp to %PROGRAM_FILES%\BrowserProtect\config.xml
from %TEMP%\nsl11.tmp to %PROGRAM_FILES%\BrowserProtect\config.xml
from %TEMP%\nsc12.tmp to %PROGRAM_FILES%\BrowserProtect\config.xml
from %TEMP%\nsp13.tmp to %PROGRAM_FILES%\BrowserProtect\config.xml
from %TEMP%\nsm17.tmp to %PROGRAM_FILES%\BrowserProtect\config.xml
from %TEMP%\nsd1A.tmp to %PROGRAM_FILES%\BrowserProtect\proxy\config
from %TEMP%\nso1B.tmp to %PROGRAM_FILES%\BrowserProtect\proxy\config
from %TEMP%\nst1C.tmp to %PROGRAM_FILES%\BrowserProtect\proxy\config
from %TEMP%\nse18.tmp to %PROGRAM_FILES%\BrowserProtect\config.xml
from %TEMP%\nsr19.tmp to %PROGRAM_FILES%\BrowserProtect\config.xml
from %PROGRAM_FILES%\BrowserProtect\proxy\config to %PROGRAM_FILES%\BrowserProtect\proxy\config.old
from %TEMP%\nsp10.tmp to %PROGRAM_FILES%\BrowserProtect\config.xml
from %PROGRAM_FILES%\BrowserProtect\config.xml to %PROGRAM_FILES%\BrowserProtect\config.xml.old
from %TEMP%\nsq7.tmp to %PROGRAM_FILES%\BrowserProtect\config.xml
from %TEMP%\nsx8.tmp to %PROGRAM_FILES%\BrowserProtect\config.xml
from %PROGRAM_FILES%\BrowserProtect\BrowserProtectIU.exe.config to %PROGRAM_FILES%\BrowserProtect\BrowserProtectIU.exe.config.old
from %TEMP%\nsy5.tmp to %PROGRAM_FILES%\BrowserProtect\BrowserProtectIU.exe.config
from %TEMP%\nsx6.tmp to %PROGRAM_FILES%\BrowserProtect\BrowserProtectIU.exe.config
from %TEMP%\nsd9.tmp to %PROGRAM_FILES%\BrowserProtect\config.xml
from %TEMP%\nszD.tmp to %PROGRAM_FILES%\BrowserProtect\config.xml
from %TEMP%\nslE.tmp to %PROGRAM_FILES%\BrowserProtect\config.xml
from %TEMP%\nsnF.tmp to %PROGRAM_FILES%\BrowserProtect\config.xml
from %TEMP%\nsfA.tmp to %PROGRAM_FILES%\BrowserProtect\config.xml
from %TEMP%\nshB.tmp to %PROGRAM_FILES%\BrowserProtect\config.xml
from %TEMP%\nssC.tmp to %PROGRAM_FILES%\BrowserProtect\config.xml