Trojan.DownLoader11.45760

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'aeEkEEcE.exe' = '%ALLUSERSPROFILE%\BWogoUMg\aeEkEEcE.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'pUccUkoM.exe' = '%HOMEPATH%\fCkYUMIQ\pUccUkoM.exe'

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\FkYQcQph] 'Start' = '00000002'

Malicious functions:

To complicate detection of its presence in the operating system,

forces the system hide from view:

hidden files
file extensions

blocks the following features:

User Account Control (UAC)

Creates and executes the following:

'%ALLUSERSPROFILE%\lwQggIEM\nwAEcgMA.exe'
'%TEMP%\bc_loader.exe'
'%HOMEPATH%\fCkYUMIQ\pUccUkoM.exe'
'%ALLUSERSPROFILE%\BWogoUMg\aeEkEEcE.exe'

Executes the following:

'<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
'<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
'<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1

Modifies file system :

Creates the following files:

<Current directory>\oCQo.ico
C:\RCX34.tmp
<Current directory>\iwwY.exe
<Current directory>\WAUo.exe
<Current directory>\CAcM.exe
<Current directory>\OeME.ico
C:\RCX35.tmp
<Current directory>\SQQw.ico
<Current directory>\lUQM.exe
<Current directory>\SuMo.ico
C:\RCX31.tmp
C:\RCX32.tmp
C:\RCX33.tmp
<Current directory>\iYgo.exe
<Current directory>\TOQQ.ico
<Current directory>\YyUE.ico
C:\RCX39.tmp
<Current directory>\AkAo.exe
<Current directory>\rQoe.exe
<Current directory>\MsAU.exe
<Current directory>\VisA.ico
C:\RCX3A.tmp
<Current directory>\XkgA.ico
<Current directory>\loUK.exe
<Current directory>\Ookg.ico
C:\RCX36.tmp
C:\RCX37.tmp
C:\RCX38.tmp
<Current directory>\KwkK.exe
<Current directory>\pkQo.ico
<Current directory>\vwcs.ico
C:\RCX2A.tmp
<Current directory>\NIYQ.exe
<Current directory>\kkEy.exe
<Current directory>\Wkgg.exe
<Current directory>\oYYc.ico
C:\RCX2B.tmp
<Current directory>\PwMA.ico
<Current directory>\nUgm.exe
<Current directory>\EcAs.ico
C:\RCX27.tmp
C:\RCX28.tmp
C:\RCX29.tmp
<Current directory>\owko.exe
<Current directory>\aEoE.ico
<Current directory>\mEIA.ico
C:\RCX2F.tmp
<Current directory>\Uwke.exe
<Current directory>\QQww.exe
<Current directory>\PUwu.exe
<Current directory>\OWQU.ico
C:\RCX30.tmp
<Current directory>\UQcg.ico
<Current directory>\KoYk.exe
<Current directory>\smcY.ico
C:\RCX2C.tmp
C:\RCX2D.tmp
C:\RCX2E.tmp
<Current directory>\KUEW.exe
<Current directory>\qcQc.ico
C:\RCX3B.tmp
<Current directory>\gcko.exe
<Current directory>\HeIw.ico
C:\RCX48.tmp
C:\RCX49.tmp
C:\RCX4A.tmp
<Current directory>\LsgQ.exe
<Current directory>\bwwM.ico
<Current directory>\lwAg.exe
C:\RCX46.tmp
<Current directory>\GEEi.exe
<Current directory>\Fmog.ico
<Current directory>\FwwE.ico
<Current directory>\iGUE.ico
C:\RCX47.tmp
<Current directory>\AgEO.exe
<Current directory>\yMAK.exe
<Current directory>\CGsw.ico
C:\RCX4D.tmp
C:\RCX4E.tmp
C:\RCX4F.tmp
<Current directory>\ykUS.exe
<Current directory>\zMkE.ico
<Current directory>\JMgE.exe
C:\RCX4B.tmp
<Current directory>\lMIi.exe
<Current directory>\LOIw.ico
<Current directory>\WqEs.ico
<Current directory>\QIow.ico
C:\RCX4C.tmp
<Current directory>\nYcg.exe
<Current directory>\BwIu.exe
<Current directory>\IyAk.ico
C:\RCX3E.tmp
C:\RCX3F.tmp
C:\RCX40.tmp
<Current directory>\Pggm.exe
<Current directory>\emIw.ico
<Current directory>\EEoq.exe
C:\RCX3C.tmp
<Current directory>\JocA.exe
<Current directory>\PSsI.ico
<Current directory>\wucY.ico
<Current directory>\wUwc.ico
C:\RCX3D.tmp
<Current directory>\ZEsw.exe
<Current directory>\hkUg.exe
<Current directory>\RSYg.ico
C:\RCX43.tmp
C:\RCX44.tmp
C:\RCX45.tmp
<Current directory>\oggA.exe
<Current directory>\pggA.ico
<Current directory>\xAQA.exe
C:\RCX41.tmp
<Current directory>\egQG.exe
<Current directory>\UQkE.ico
<Current directory>\qQcA.ico
<Current directory>\WwAc.ico
C:\RCX42.tmp
<Current directory>\tAgg.exe
C:\RCXC.tmp
<Current directory>\EoUC.exe
<Current directory>\BQQU.ico
<Current directory>\LmQQ.ico
<Current directory>\wIgE.ico
C:\RCXD.tmp
<Current directory>\XcUC.exe
C:\RCXB.tmp
<Current directory>\ZgAQ.ico
C:\RCX9.tmp
<Current directory>\swci.exe
<Current directory>\bwwu.exe
<Current directory>\Pkow.exe
<Current directory>\LGoQ.ico
C:\RCXA.tmp
C:\RCX11.tmp
<Current directory>\rEoU.exe
<Current directory>\MWUA.ico
<Current directory>\sUgw.ico
<Current directory>\uKkI.ico
C:\RCX12.tmp
<Current directory>\LUcK.exe
C:\RCX10.tmp
<Current directory>\XwQY.ico
C:\RCXE.tmp
<Current directory>\MYYc.exe
<Current directory>\zIkE.exe
<Current directory>\sAIw.exe
<Current directory>\PyMY.ico
C:\RCXF.tmp
C:\RCX2.tmp
<Current directory>\GYwO.exe
<Current directory>\jGgI.ico
<Current directory>\kycI.ico
<Current directory>\AyUI.ico
C:\RCX3.tmp
<Current directory>\Owco.exe
%ALLUSERSPROFILE%\casg.txt
%TEMP%\TIsAIoMI.bat
%ALLUSERSPROFILE%\lwQggIEM\nwAEcgMA.exe
%TEMP%\bc_loader.exe
C:\RCX1.tmp
<Current directory>\mIsK.exe
<Current directory>\CikI.ico
C:\RCX7.tmp
<Current directory>\cYYW.exe
<Current directory>\ImAo.ico
<Current directory>\XQIc.ico
<Current directory>\AyUE.ico
C:\RCX8.tmp
<Current directory>\GIIs.exe
C:\RCX6.tmp
<Current directory>\rYMI.ico
C:\RCX4.tmp
<Current directory>\pscg.exe
<Current directory>\QAco.exe
<Current directory>\Ugsi.exe
<Current directory>\loUk.ico
C:\RCX5.tmp
<Current directory>\LAAO.exe
<Current directory>\hGIk.ico
C:\RCX20.tmp
<Current directory>\RsIO.exe
<Current directory>\oMYm.exe
<Current directory>\GUgK.exe
<Current directory>\yEQg.ico
C:\RCX21.tmp
<Current directory>\aYkY.ico
<Current directory>\Mcgi.exe
<Current directory>\ksgA.ico
C:\RCX1D.tmp
C:\RCX1E.tmp
C:\RCX1F.tmp
<Current directory>\GgIk.exe
<Current directory>\BWMU.ico
<Current directory>\sgEY.ico
C:\RCX25.tmp
<Current directory>\mIoO.exe
<Current directory>\zkgE.exe
<Current directory>\gUkm.exe
<Current directory>\rSks.ico
C:\RCX26.tmp
<Current directory>\gGcw.ico
<Current directory>\qkso.exe
<Current directory>\SeAk.ico
C:\RCX22.tmp
C:\RCX23.tmp
C:\RCX24.tmp
<Current directory>\ZcYU.exe
<Current directory>\jQYc.ico
<Current directory>\OGcc.ico
C:\RCX16.tmp
<Current directory>\PAYq.exe
<Current directory>\aEAs.exe
<Current directory>\NMkQ.exe
<Current directory>\qwUo.ico
C:\RCX17.tmp
<Current directory>\uOMk.ico
<Current directory>\QIcG.exe
<Current directory>\oqQc.ico
C:\RCX13.tmp
C:\RCX14.tmp
C:\RCX15.tmp
<Current directory>\ewoE.exe
<Current directory>\gWwQ.ico
<Current directory>\beMo.ico
C:\RCX1B.tmp
<Current directory>\IMYu.exe
<Current directory>\uMEG.exe
<Current directory>\WIIu.exe
<Current directory>\lIAg.ico
C:\RCX1C.tmp
<Current directory>\DGQM.ico
<Current directory>\awka.exe
<Current directory>\ZysI.ico
C:\RCX18.tmp
C:\RCX19.tmp
C:\RCX1A.tmp
<Current directory>\goEo.exe
<Current directory>\GyMY.ico

Sets the 'hidden' attribute to the following files:

%ALLUSERSPROFILE%\lwQggIEM\nwAEcgMA.exe
%ALLUSERSPROFILE%\BWogoUMg\aeEkEEcE.exe
%HOMEPATH%\fCkYUMIQ\pUccUkoM.exe

Deletes the following files:

<Current directory>\WAUo.exe
<Current directory>\SQQw.ico
<Current directory>\CAcM.exe
<Current directory>\oCQo.ico
<Current directory>\iwwY.exe
<Current directory>\SuMo.ico
<Current directory>\lUQM.exe
<Current directory>\TOQQ.ico
<Current directory>\iYgo.exe
<Current directory>\OeME.ico
<Current directory>\rQoe.exe
<Current directory>\XkgA.ico
<Current directory>\MsAU.exe
<Current directory>\YyUE.ico
<Current directory>\AkAo.exe
<Current directory>\Ookg.ico
<Current directory>\loUK.exe
<Current directory>\pkQo.ico
<Current directory>\KwkK.exe
<Current directory>\OWQU.ico
<Current directory>\kkEy.exe
<Current directory>\PwMA.ico
<Current directory>\Wkgg.exe
<Current directory>\vwcs.ico
<Current directory>\NIYQ.exe
<Current directory>\EcAs.ico
<Current directory>\nUgm.exe
<Current directory>\aEoE.ico
<Current directory>\owko.exe
<Current directory>\oYYc.ico
<Current directory>\QQww.exe
<Current directory>\UQcg.ico
<Current directory>\PUwu.exe
<Current directory>\mEIA.ico
<Current directory>\Uwke.exe
<Current directory>\smcY.ico
<Current directory>\KoYk.exe
<Current directory>\qcQc.ico
<Current directory>\KUEW.exe
<Current directory>\iGUE.ico
<Current directory>\lwAg.exe
<Current directory>\HeIw.ico
<Current directory>\gcko.exe
<Current directory>\FwwE.ico
<Current directory>\GEEi.exe
<Current directory>\pggA.ico
<Current directory>\AgEO.exe
<Current directory>\Fmog.ico
<Current directory>\LsgQ.exe
<Current directory>\QIow.ico
<Current directory>\JMgE.exe
<Current directory>\CGsw.ico
<Current directory>\yMAK.exe
<Current directory>\WqEs.ico
<Current directory>\lMIi.exe
<Current directory>\bwwM.ico
<Current directory>\nYcg.exe
<Current directory>\LOIw.ico
<Current directory>\oggA.exe
<Current directory>\wUwc.ico
<Current directory>\EEoq.exe
<Current directory>\IyAk.ico
<Current directory>\BwIu.exe
<Current directory>\wucY.ico
<Current directory>\JocA.exe
<Current directory>\VisA.ico
<Current directory>\ZEsw.exe
<Current directory>\PSsI.ico
<Current directory>\Pggm.exe
<Current directory>\WwAc.ico
<Current directory>\xAQA.exe
<Current directory>\RSYg.ico
<Current directory>\hkUg.exe
<Current directory>\qQcA.ico
<Current directory>\egQG.exe
<Current directory>\emIw.ico
<Current directory>\tAgg.exe
<Current directory>\UQkE.ico
<Current directory>\rSks.ico
<Current directory>\LmQQ.ico
<Current directory>\XcUC.exe
<Current directory>\wIgE.ico
<Current directory>\MYYc.exe
<Current directory>\BQQU.ico
<Current directory>\Pkow.exe
<Current directory>\ZgAQ.ico
<Current directory>\EoUC.exe
<Current directory>\LGoQ.ico
<Current directory>\zIkE.exe
<Current directory>\sUgw.ico
<Current directory>\LUcK.exe
<Current directory>\uKkI.ico
<Current directory>\LAAO.exe
<Current directory>\MWUA.ico
<Current directory>\sAIw.exe
<Current directory>\XwQY.ico
<Current directory>\rEoU.exe
<Current directory>\PyMY.ico
<Current directory>\bwwu.exe
<Current directory>\kycI.ico
<Current directory>\Owco.exe
<Current directory>\AyUI.ico
<Current directory>\pscg.exe
<Current directory>\jGgI.ico
<Current directory>\mIsK.exe
%TEMP%\TIsAIoMI.bat
<Current directory>\GYwO.exe
<Current directory>\CikI.ico
<Current directory>\QAco.exe
<Current directory>\XQIc.ico
<Current directory>\GIIs.exe
<Current directory>\AyUE.ico
<Current directory>\swci.exe
<Current directory>\ImAo.ico
<Current directory>\Ugsi.exe
<Current directory>\rYMI.ico
<Current directory>\cYYW.exe
<Current directory>\loUk.ico
<Current directory>\oMYm.exe
<Current directory>\aYkY.ico
<Current directory>\GUgK.exe
<Current directory>\hGIk.ico
<Current directory>\RsIO.exe
<Current directory>\ksgA.ico
<Current directory>\Mcgi.exe
<Current directory>\BWMU.ico
<Current directory>\GgIk.exe
<Current directory>\yEQg.ico
<Current directory>\zkgE.exe
<Current directory>\gGcw.ico
<Current directory>\gUkm.exe
<Current directory>\sgEY.ico
<Current directory>\mIoO.exe
<Current directory>\SeAk.ico
<Current directory>\qkso.exe
<Current directory>\jQYc.ico
<Current directory>\ZcYU.exe
<Current directory>\lIAg.ico
<Current directory>\aEAs.exe
<Current directory>\uOMk.ico
<Current directory>\NMkQ.exe
<Current directory>\OGcc.ico
<Current directory>\PAYq.exe
<Current directory>\oqQc.ico
<Current directory>\QIcG.exe
<Current directory>\gWwQ.ico
<Current directory>\ewoE.exe
<Current directory>\qwUo.ico
<Current directory>\uMEG.exe
<Current directory>\DGQM.ico
<Current directory>\WIIu.exe
<Current directory>\beMo.ico
<Current directory>\IMYu.exe
<Current directory>\ZysI.ico
<Current directory>\awka.exe
<Current directory>\GyMY.ico
<Current directory>\goEo.exe

Moves the following files:

from C:\RCX34.tmp to <Current directory>\iwwY.exe
from C:\RCX35.tmp to <Current directory>\WAUo.exe
from C:\RCX32.tmp to <Current directory>\lUQM.exe
from C:\RCX33.tmp to <Current directory>\iYgo.exe
from C:\RCX36.tmp to <Current directory>\CAcM.exe
from C:\RCX39.tmp to <Current directory>\AkAo.exe
from C:\RCX3A.tmp to <Current directory>\rQoe.exe
from C:\RCX37.tmp to <Current directory>\loUK.exe
from C:\RCX38.tmp to <Current directory>\KwkK.exe
from C:\RCX31.tmp to <Current directory>\PUwu.exe
from C:\RCX2A.tmp to <Current directory>\NIYQ.exe
from C:\RCX2B.tmp to <Current directory>\kkEy.exe
from C:\RCX28.tmp to <Current directory>\nUgm.exe
from C:\RCX29.tmp to <Current directory>\owko.exe
from C:\RCX2C.tmp to <Current directory>\Wkgg.exe
from C:\RCX2F.tmp to <Current directory>\Uwke.exe
from C:\RCX30.tmp to <Current directory>\QQww.exe
from C:\RCX2D.tmp to <Current directory>\KoYk.exe
from C:\RCX2E.tmp to <Current directory>\KUEW.exe
from C:\RCX3B.tmp to <Current directory>\MsAU.exe
from C:\RCX48.tmp to <Current directory>\lwAg.exe
from C:\RCX49.tmp to <Current directory>\gcko.exe
from C:\RCX46.tmp to <Current directory>\GEEi.exe
from C:\RCX47.tmp to <Current directory>\AgEO.exe
from C:\RCX4A.tmp to <Current directory>\LsgQ.exe
from C:\RCX4D.tmp to <Current directory>\JMgE.exe
from C:\RCX4E.tmp to <Current directory>\yMAK.exe
from C:\RCX4B.tmp to <Current directory>\lMIi.exe
from C:\RCX4C.tmp to <Current directory>\nYcg.exe
from C:\RCX45.tmp to <Current directory>\oggA.exe
from C:\RCX3E.tmp to <Current directory>\EEoq.exe
from C:\RCX3F.tmp to <Current directory>\BwIu.exe
from C:\RCX3C.tmp to <Current directory>\JocA.exe
from C:\RCX3D.tmp to <Current directory>\ZEsw.exe
from C:\RCX40.tmp to <Current directory>\Pggm.exe
from C:\RCX43.tmp to <Current directory>\xAQA.exe
from C:\RCX44.tmp to <Current directory>\hkUg.exe
from C:\RCX41.tmp to <Current directory>\egQG.exe
from C:\RCX42.tmp to <Current directory>\tAgg.exe
from C:\RCXD.tmp to <Current directory>\XcUC.exe
from C:\RCXE.tmp to <Current directory>\MYYc.exe
from C:\RCXB.tmp to <Current directory>\Pkow.exe
from C:\RCXC.tmp to <Current directory>\EoUC.exe
from C:\RCXF.tmp to <Current directory>\zIkE.exe
from C:\RCX12.tmp to <Current directory>\LUcK.exe
from C:\RCX13.tmp to <Current directory>\LAAO.exe
from C:\RCX10.tmp to <Current directory>\sAIw.exe
from C:\RCX11.tmp to <Current directory>\rEoU.exe
from C:\RCXA.tmp to <Current directory>\bwwu.exe
from C:\RCX3.tmp to <Current directory>\Owco.exe
from C:\RCX4.tmp to <Current directory>\pscg.exe
from C:\RCX1.tmp to <Current directory>\mIsK.exe
from C:\RCX2.tmp to <Current directory>\GYwO.exe
from C:\RCX5.tmp to <Current directory>\QAco.exe
from C:\RCX8.tmp to <Current directory>\GIIs.exe
from C:\RCX9.tmp to <Current directory>\swci.exe
from C:\RCX6.tmp to <Current directory>\Ugsi.exe
from C:\RCX7.tmp to <Current directory>\cYYW.exe
from C:\RCX14.tmp to <Current directory>\QIcG.exe
from C:\RCX21.tmp to <Current directory>\oMYm.exe
from C:\RCX22.tmp to <Current directory>\GUgK.exe
from C:\RCX1F.tmp to <Current directory>\GgIk.exe
from C:\RCX20.tmp to <Current directory>\RsIO.exe
from C:\RCX23.tmp to <Current directory>\qkso.exe
from C:\RCX26.tmp to <Current directory>\zkgE.exe
from C:\RCX27.tmp to <Current directory>\gUkm.exe
from C:\RCX24.tmp to <Current directory>\ZcYU.exe
from C:\RCX25.tmp to <Current directory>\mIoO.exe
from C:\RCX1E.tmp to <Current directory>\Mcgi.exe
from C:\RCX17.tmp to <Current directory>\aEAs.exe
from C:\RCX18.tmp to <Current directory>\NMkQ.exe
from C:\RCX15.tmp to <Current directory>\ewoE.exe
from C:\RCX16.tmp to <Current directory>\PAYq.exe
from C:\RCX19.tmp to <Current directory>\awka.exe
from C:\RCX1C.tmp to <Current directory>\uMEG.exe
from C:\RCX1D.tmp to <Current directory>\WIIu.exe
from C:\RCX1A.tmp to <Current directory>\goEo.exe
from C:\RCX1B.tmp to <Current directory>\IMYu.exe

Network activity:

Connects to:

'19#.#86.45.170':9999
'74.##5.232.51':80
'20#.#7.164.69':9999
'20#.#19.204.12':9999

TCP:

HTTP GET requests:

74.##5.232.51/

UDP:

DNS ASK google.com

Miscellaneous:

Searches for the following windows:

ClassName: '' WindowName: 'pUccUkoM.exe'
ClassName: '' WindowName: 'aeEkEEcE.exe'
ClassName: 'Indicator' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней