Trojan.DownLoader11.40060

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'aeEkEEcE.exe' = '%ALLUSERSPROFILE%\BWogoUMg\aeEkEEcE.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'pUccUkoM.exe' = '%HOMEPATH%\fCkYUMIQ\pUccUkoM.exe'

Malicious functions:

To complicate detection of its presence in the operating system,

forces the system hide from view:

hidden files
file extensions

blocks the following features:

User Account Control (UAC)

Creates and executes the following:

'%ALLUSERSPROFILE%\BWogoUMg\aeEkEEcE.exe'
'%HOMEPATH%\fCkYUMIQ\pUccUkoM.exe'

Executes the following:

'<SYSTEM32>\reg.exe' /c ""%TEMP%\GskUIsAw.bat" "<Full path to virus>""
'<SYSTEM32>\cscript.exe' /c ""%TEMP%\rggsAoQs.bat" "<Full path to virus>""
'<SYSTEM32>\reg.exe' /pid=2520
'<SYSTEM32>\reg.exe' /pid=3072
'<SYSTEM32>\reg.exe' /pid=3604
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\XUsQcgoU.bat" "<Full path to virus>""
'<SYSTEM32>\reg.exe' /c "<Current directory>\<Virus name>"
'<SYSTEM32>\reg.exe' /pid=808
'<SYSTEM32>\reg.exe' /c ""%TEMP%\hKgQEYMo.bat" "<Full path to virus>""
'<SYSTEM32>\reg.exe' /pid=3616
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\BKQMMcgE.bat" "<Full path to virus>""
'<SYSTEM32>\reg.exe' %TEMP%\file.vbs
'<SYSTEM32>\cscript.exe' /pid=532
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\wYcgkkAs.bat" "<Full path to virus>""
'<SYSTEM32>\cscript.exe' /c ""%TEMP%\SSAYowQE.bat" "<Full path to virus>""
'<SYSTEM32>\cscript.exe' /pid=3112
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\uEoMYYUw.bat" "<Full path to virus>""
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\FUYwYoYY.bat" "<Full path to virus>""
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\umIsAIwc.bat" "<Full path to virus>""
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\fKccwocU.bat" "<Full path to virus>""
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\jAAEYUsM.bat" "<Full path to virus>""
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\ZQQkgQQA.bat" "<Full path to virus>""
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\FigYEMco.bat" "<Full path to virus>""
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\AEIEkgsE.bat" "<Full path to virus>""
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\MqsoEAgE.bat" "<Full path to virus>""
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\OOgAMAYY.bat" "<Full path to virus>""
'<SYSTEM32>\cscript.exe' /pid=3256
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\HuwQcYcA.bat" "<Full path to virus>""
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\BWAoMQAc.bat" "<Full path to virus>""
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\wgQYkQAs.bat" "<Full path to virus>""
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\oYAIIQEM.bat" "<Full path to virus>""
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\LYcYYoEI.bat" "<Full path to virus>""
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\wqkUUEIY.bat" "<Full path to virus>""
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\gQYAkowo.bat" "<Full path to virus>""
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\cskksowQ.bat" "<Full path to virus>""
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\LsocEgAE.bat" "<Full path to virus>""
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\gwYAAcsw.bat" "<Full path to virus>""
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\ZKQMcwUc.bat" "<Full path to virus>""
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\ZEkoQIIY.bat" "<Full path to virus>""
'<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
'<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
'<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\ESMwUwUA.bat" "<Full path to virus>""
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\TcAsgYkw.bat" "<Full path to virus>""
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\aYcEAIEo.bat" "<Full path to virus>""
'<SYSTEM32>\cscript.exe' %TEMP%\file.vbs
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\qWwMQowc.bat" "<Full path to virus>""
'<SYSTEM32>\reg.exe' /pid=3104
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\JgwAEYUo.bat" "<Full path to virus>""
'<SYSTEM32>\reg.exe' /pid=3292
'<SYSTEM32>\cscript.exe' /c "<Current directory>\<Virus name>"
'<SYSTEM32>\reg.exe' /pid=3504
'<SYSTEM32>\cscript.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
'<SYSTEM32>\reg.exe' /pid=3392
'<SYSTEM32>\cscript.exe' /pid=2828
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\bOUMIgcU.bat" "<Full path to virus>""
'<SYSTEM32>\reg.exe' /pid=1728
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\ZSocogEU.bat" "<Full path to virus>""
'<SYSTEM32>\reg.exe'
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\FGwQkcsg.bat" "<Full path to virus>""
'<SYSTEM32>\cscript.exe' /pid=2696
'<SYSTEM32>\reg.exe' /pid=2780

Injects code into

the following system processes:

<SYSTEM32>\cscript.exe
<SYSTEM32>\cmd.exe
<SYSTEM32>\reg.exe

Modifies file system :

Creates the following files:

<Current directory>\ikMi.ico
%TEMP%\wgQYkQAs.bat
C:\RCX18.tmp
%TEMP%\lUgUwQgw.bat
C:\RCX19.tmp
<Current directory>\rYgC.exe
<Current directory>\zgsC.exe
<Current directory>\REEu.ico
C:\RCX16.tmp
<Current directory>\jowG.exe
<Current directory>\TUos.ico
C:\RCX17.tmp
<Current directory>\UUsU.ico
%TEMP%\BWAoMQAc.bat
%TEMP%\BCMIQYkI.bat
C:\RCX1C.tmp
%TEMP%\AEIEkgsE.bat
<Current directory>\egoA.exe
C:\RCX1A.tmp
<Current directory>\jkoE.exe
<Current directory>\Fgkk.ico
C:\RCX1B.tmp
<Current directory>\Zsgo.exe
<Current directory>\PsAe.ico
<Current directory>\cUUm.exe
C:\RCX11.tmp
<Current directory>\HkMA.exe
<Current directory>\KcAC.ico
C:\RCX12.tmp
<Current directory>\PYoY.exe
<Current directory>\dYYQ.ico
C:\RCXF.tmp
<Current directory>\JcIi.exe
<Current directory>\lAQw.ico
C:\RCX10.tmp
<Current directory>\IAoa.exe
<Current directory>\xgoG.ico
<Current directory>\CYUA.ico
C:\RCX14.tmp
<Current directory>\sAke.exe
<Current directory>\RIIa.ico
C:\RCX15.tmp
<Current directory>\wEcu.exe
%TEMP%\oYAIIQEM.bat
<Current directory>\JsMk.exe
<Current directory>\IUEm.ico
%TEMP%\HescMwcA.bat
<Current directory>\ToYK.ico
C:\RCX13.tmp
<Current directory>\AEcY.ico
<Current directory>\bMEu.exe
%TEMP%\ZQQkgQQA.bat
<Current directory>\mMwW.ico
%TEMP%\dGAYYgcA.bat
<Current directory>\rAIs.ico
C:\RCX24.tmp
%TEMP%\yqwIcwEQ.bat
C:\RCX22.tmp
<Current directory>\zQUU.exe
C:\RCX23.tmp
<Current directory>\BQMY.exe
<Current directory>\hsAI.ico
%TEMP%\jAAEYUsM.bat
C:\RCX27.tmp
<Current directory>\DUYG.exe
C:\RCX28.tmp
<Current directory>\xEQE.exe
<Current directory>\PIAG.ico
<Current directory>\SMYq.ico
C:\RCX25.tmp
<Current directory>\WAMS.exe
<Current directory>\lkIK.ico
C:\RCX26.tmp
<Current directory>\KYYu.exe
<Current directory>\FsIq.ico
C:\RCX1F.tmp
<Current directory>\AYow.exe
<Current directory>\sYco.ico
<Current directory>\yIEo.ico
%TEMP%\tisgcUAI.bat
%TEMP%\umIsAIwc.bat
<Current directory>\GEYw.ico
C:\RCX1D.tmp
<Current directory>\ykUS.exe
%TEMP%\KiwEwcoI.bat
C:\RCX1E.tmp
<Current directory>\kMEY.exe
%TEMP%\FigYEMco.bat
%TEMP%\ncYAsgIU.bat
%TEMP%\fKccwocU.bat
C:\RCX21.tmp
<Current directory>\RMwW.exe
<Current directory>\MkEo.ico
C:\RCX20.tmp
<Current directory>\BcMI.exe
%TEMP%\FUYwYoYY.bat
%TEMP%\HqkYgYAg.bat
%TEMP%\uEoMYYUw.bat
%TEMP%\bYYEwwcg.bat
%TEMP%\FGwQkcsg.bat
%TEMP%\TAcUAUoo.bat
%TEMP%\bOUMIgcU.bat
%TEMP%\iKcEcogs.bat
%TEMP%\JgwAEYUo.bat
%TEMP%\NwIAcIoo.bat
%TEMP%\ueYgQYkw.bat
%TEMP%\QokgcwIY.bat
%TEMP%\LsocEgAE.bat
%TEMP%\cCIIMoEE.bat
%TEMP%\ZSocogEU.bat
%TEMP%\qWwMQowc.bat
%TEMP%\rggsAoQs.bat
%TEMP%\JgQAQQEk.bat
%TEMP%\wYcgkkAs.bat
%TEMP%\moIgwIEY.bat
%TEMP%\GskUIsAw.bat
%TEMP%\lmgUkYgw.bat
%TEMP%\hKgQEYMo.bat
%TEMP%\BKQMMcgE.bat
%TEMP%\DCIUUQUA.bat
%TEMP%\jaQIgcEI.bat
%TEMP%\SSAYowQE.bat
%TEMP%\tOswsAkU.bat
%TEMP%\XCQUcIMg.bat
%TEMP%\bwgEAUAw.bat
%TEMP%\aYcEAIEo.bat
%TEMP%\CykYAQkM.bat
%TEMP%\ZEkoQIIY.bat
%TEMP%\nScEgwQU.bat
%TEMP%\TcAsgYkw.bat
%TEMP%\XQQIoQYA.bat
%HOMEPATH%\f.inf
%TEMP%\file.vbs
%TEMP%\ESMwUwUA.bat
<Current directory>\<Virus name>
%TEMP%\TwAwAsEo.bat
%TEMP%\cskksowQ.bat
%TEMP%\bYwgokwU.bat
%TEMP%\gwYAAcsw.bat
%TEMP%\ZKQMcwUc.bat
%TEMP%\QgwwUIkA.bat
%TEMP%\sUYUUEck.bat
%TEMP%\gQYAkowo.bat
%TEMP%\fuEYoocQ.bat
%TEMP%\LYcYYoEI.bat
%TEMP%\NkAssAwY.bat
%TEMP%\wqkUUEIY.bat
<Current directory>\IUwc.ico
<Current directory>\Qsgc.exe
%TEMP%\EKgkEgIs.bat
<Current directory>\zwkS.ico
<Current directory>\YswC.exe
<Current directory>\ugwE.ico
C:\RCXA.tmp
<Current directory>\zgsk.ico
C:\RCX8.tmp
<Current directory>\dgkg.exe
%TEMP%\MqsoEAgE.bat
C:\RCX9.tmp
<Current directory>\kAwm.exe
<Current directory>\tMIg.ico
%TEMP%\HuwQcYcA.bat
C:\RCXD.tmp
%TEMP%\CMkogkEo.bat
C:\RCXE.tmp
<Current directory>\egIk.exe
<Current directory>\sUEY.exe
<Current directory>\mksw.ico
C:\RCXB.tmp
<Current directory>\FwEO.exe
<Current directory>\JQcO.ico
C:\RCXC.tmp
<Current directory>\scQW.ico
C:\RCX3.tmp
<Current directory>\tswQ.exe
<Current directory>\awAS.ico
<Current directory>\xoUE.exe
<Current directory>\pAUC.ico
%TEMP%\QgckcUIA.bat
<Current directory>\Xowo.ico
C:\RCX1.tmp
<Current directory>\dIgK.exe
%TEMP%\XUsQcgoU.bat
C:\RCX2.tmp
<Current directory>\bckI.exe
<Current directory>\fAYw.ico
C:\RCX6.tmp
<Current directory>\csUy.exe
%TEMP%\PkAwsMkw.bat
C:\RCX7.tmp
<Current directory>\KsQC.exe
<Current directory>\gYYo.exe
<Current directory>\hwYG.ico
C:\RCX4.tmp
<Current directory>\BYQU.ico
%TEMP%\OOgAMAYY.bat
C:\RCX5.tmp

Sets the 'hidden' attribute to the following files:

%ALLUSERSPROFILE%\BWogoUMg\aeEkEEcE.exe
%HOMEPATH%\fCkYUMIQ\pUccUkoM.exe

Deletes the following files:

<Current directory>\TUos.ico
<Current directory>\rYgC.exe
<Current directory>\ikMi.ico
<Current directory>\jowG.exe
<Current directory>\RIIa.ico
<Current directory>\zgsC.exe
<Current directory>\REEu.ico
%TEMP%\lUgUwQgw.bat
<Current directory>\PsAe.ico
<Current directory>\egoA.exe
<Current directory>\UUsU.ico
%TEMP%\BCMIQYkI.bat
<Current directory>\jkoE.exe
<Current directory>\Fgkk.ico
<Current directory>\Zsgo.exe
<Current directory>\KcAC.ico
<Current directory>\PYoY.exe
<Current directory>\dYYQ.ico
<Current directory>\HkMA.exe
<Current directory>\IAoa.exe
<Current directory>\xgoG.ico
%TEMP%\CMkogkEo.bat
<Current directory>\JsMk.exe
%TEMP%\HescMwcA.bat
<Current directory>\CYUA.ico
<Current directory>\cUUm.exe
<Current directory>\wEcu.exe
<Current directory>\IUEm.ico
<Current directory>\sAke.exe
<Current directory>\ToYK.ico
<Current directory>\hsAI.ico
<Current directory>\bMEu.exe
<Current directory>\mMwW.ico
<Current directory>\BQMY.exe
<Current directory>\zQUU.exe
<Current directory>\FsIq.ico
%TEMP%\yqwIcwEQ.bat
<Current directory>\WAMS.exe
<Current directory>\DUYG.exe
<Current directory>\lkIK.ico
<Current directory>\xEQE.exe
<Current directory>\SMYq.ico
<Current directory>\rAIs.ico
%TEMP%\dGAYYgcA.bat
<Current directory>\KYYu.exe
%TEMP%\KiwEwcoI.bat
<Current directory>\AYow.exe
<Current directory>\sYco.ico
<Current directory>\GEYw.ico
<Current directory>\ykUS.exe
<Current directory>\AEcY.ico
<Current directory>\kMEY.exe
%TEMP%\tisgcUAI.bat
%TEMP%\ncYAsgIU.bat
<Current directory>\RMwW.exe
<Current directory>\MkEo.ico
%TEMP%\HqkYgYAg.bat
<Current directory>\BcMI.exe
<Current directory>\yIEo.ico
%TEMP%\bYYEwwcg.bat
%TEMP%\tOswsAkU.bat
%TEMP%\jaQIgcEI.bat
%TEMP%\SSAYowQE.bat
%TEMP%\hKgQEYMo.bat
%TEMP%\NwIAcIoo.bat
%TEMP%\iKcEcogs.bat
%TEMP%\DCIUUQUA.bat
%TEMP%\JgQAQQEk.bat
<Current directory>\bckI.exe
<Current directory>\Xowo.ico
<Current directory>\tswQ.exe
<Current directory>\IUwc.ico
%TEMP%\lmgUkYgw.bat
%TEMP%\moIgwIEY.bat
<Current directory>\dIgK.exe
%TEMP%\fuEYoocQ.bat
%TEMP%\sUYUUEck.bat
%TEMP%\NkAssAwY.bat
%TEMP%\nScEgwQU.bat
%TEMP%\XQQIoQYA.bat
%TEMP%\CykYAQkM.bat
%TEMP%\bwgEAUAw.bat
%TEMP%\bYwgokwU.bat
%TEMP%\ueYgQYkw.bat
%TEMP%\cCIIMoEE.bat
%TEMP%\TAcUAUoo.bat
%TEMP%\QokgcwIY.bat
%TEMP%\TwAwAsEo.bat
%TEMP%\QgwwUIkA.bat
%TEMP%\XCQUcIMg.bat
%TEMP%\EKgkEgIs.bat
<Current directory>\YswC.exe
<Current directory>\ugwE.ico
<Current directory>\zwkS.ico
<Current directory>\kAwm.exe
<Current directory>\zgsk.ico
<Current directory>\Qsgc.exe
<Current directory>\sUEY.exe
<Current directory>\tMIg.ico
<Current directory>\JcIi.exe
<Current directory>\lAQw.ico
<Current directory>\egIk.exe
<Current directory>\mksw.ico
<Current directory>\FwEO.exe
<Current directory>\JQcO.ico
<Current directory>\pAUC.ico
<Current directory>\gYYo.exe
%TEMP%\GskUIsAw.bat
%TEMP%\rggsAoQs.bat
<Current directory>\awAS.ico
%TEMP%\QgckcUIA.bat
<Current directory>\xoUE.exe
<Current directory>\hwYG.ico
%TEMP%\PkAwsMkw.bat
<Current directory>\dgkg.exe
<Current directory>\scQW.ico
<Current directory>\fAYw.ico
<Current directory>\csUy.exe
<Current directory>\BYQU.ico
<Current directory>\KsQC.exe

Moves the following files:

from C:\RCX1B.tmp to <Current directory>\Zsgo.exe
from C:\RCX1A.tmp to <Current directory>\jkoE.exe
from C:\RCX1C.tmp to <Current directory>\egoA.exe
from C:\RCX1E.tmp to <Current directory>\kMEY.exe
from C:\RCX1D.tmp to <Current directory>\ykUS.exe
from C:\RCX16.tmp to <Current directory>\cUUm.exe
from C:\RCX15.tmp to <Current directory>\wEcu.exe
from C:\RCX17.tmp to <Current directory>\zgsC.exe
from C:\RCX19.tmp to <Current directory>\rYgC.exe
from C:\RCX18.tmp to <Current directory>\jowG.exe
from C:\RCX25.tmp to <Current directory>\WAMS.exe
from C:\RCX24.tmp to <Current directory>\bMEu.exe
from C:\RCX26.tmp to <Current directory>\KYYu.exe
from C:\RCX28.tmp to <Current directory>\xEQE.exe
from C:\RCX27.tmp to <Current directory>\DUYG.exe
from C:\RCX20.tmp to <Current directory>\BcMI.exe
from C:\RCX1F.tmp to <Current directory>\AYow.exe
from C:\RCX21.tmp to <Current directory>\RMwW.exe
from C:\RCX23.tmp to <Current directory>\BQMY.exe
from C:\RCX22.tmp to <Current directory>\zQUU.exe
from C:\RCX7.tmp to <Current directory>\KsQC.exe
from C:\RCX6.tmp to <Current directory>\csUy.exe
from C:\RCX8.tmp to <Current directory>\dgkg.exe
from C:\RCXA.tmp to <Current directory>\Qsgc.exe
from C:\RCX9.tmp to <Current directory>\kAwm.exe
from C:\RCX2.tmp to <Current directory>\bckI.exe
from C:\RCX1.tmp to <Current directory>\dIgK.exe
from C:\RCX3.tmp to <Current directory>\tswQ.exe
from C:\RCX5.tmp to <Current directory>\gYYo.exe
from C:\RCX4.tmp to <Current directory>\xoUE.exe
from C:\RCX11.tmp to <Current directory>\HkMA.exe
from C:\RCX10.tmp to <Current directory>\IAoa.exe
from C:\RCX12.tmp to <Current directory>\PYoY.exe
from C:\RCX14.tmp to <Current directory>\sAke.exe
from C:\RCX13.tmp to <Current directory>\JsMk.exe
from C:\RCXC.tmp to <Current directory>\sUEY.exe
from C:\RCXB.tmp to <Current directory>\YswC.exe
from C:\RCXD.tmp to <Current directory>\FwEO.exe
from C:\RCXF.tmp to <Current directory>\JcIi.exe
from C:\RCXE.tmp to <Current directory>\egIk.exe

Deletes itself.

Network activity:

Connects to:

'19#.#86.45.170':9999
'74.##5.232.51':80
'20#.#7.164.69':9999
'20#.#19.204.12':9999

TCP:

HTTP GET requests:

74.##5.232.51/

UDP:

DNS ASK google.com

Miscellaneous:

Searches for the following windows:

ClassName: 'Indicator' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней