Trojan.DownLoader11.45799

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'aeEkEEcE.exe' = '%ALLUSERSPROFILE%\BWogoUMg\aeEkEEcE.exe'

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\FkYQcQph] 'Start' = '00000002'

Malicious functions:

Creates and executes the following:

'%ALLUSERSPROFILE%\BWogoUMg\aeEkEEcE.exe'
'%ALLUSERSPROFILE%\lwQggIEM\nwAEcgMA.exe'

Modifies file system :

Creates the following files:

C:\RCX2A.tmp
<Current directory>\TQcs.exe
<Current directory>\zaYk.ico
C:\RCX2B.tmp
<Current directory>\FIMs.exe
<Current directory>\xeMQ.ico
C:\RCX28.tmp
<Current directory>\DMgu.exe
<Current directory>\nywg.ico
C:\RCX29.tmp
<Current directory>\IsAw.exe
<Current directory>\FYQE.ico
C:\RCX2E.tmp
<Current directory>\ecEw.exe
<Current directory>\IewE.ico
C:\RCX2F.tmp
<Current directory>\vwYW.exe
<Current directory>\hKsE.ico
C:\RCX2C.tmp
<Current directory>\GQwq.exe
<Current directory>\QQIQ.ico
C:\RCX2D.tmp
<Current directory>\YkgW.exe
<Current directory>\zcUE.ico
C:\RCX22.tmp
<Current directory>\dswS.exe
<Current directory>\LgYA.ico
C:\RCX23.tmp
<Current directory>\qkcQ.exe
<Current directory>\veos.ico
C:\RCX20.tmp
<Current directory>\DcQi.exe
<Current directory>\cgIU.ico
C:\RCX21.tmp
<Current directory>\nkUi.exe
<Current directory>\HuIU.ico
C:\RCX26.tmp
<Current directory>\UQYi.exe
<Current directory>\yMoY.ico
C:\RCX27.tmp
<Current directory>\yMgi.exe
<Current directory>\HAUc.ico
C:\RCX24.tmp
<Current directory>\vgMY.exe
<Current directory>\zuQw.ico
C:\RCX25.tmp
<Current directory>\AQcq.exe
<Current directory>\voEk.ico
C:\RCX3A.tmp
<Current directory>\gcke.exe
<Current directory>\QycA.ico
C:\RCX3B.tmp
<Current directory>\Esog.exe
<Current directory>\esMs.ico
C:\RCX38.tmp
<Current directory>\NUcI.exe
<Current directory>\cmIk.ico
C:\RCX39.tmp
<Current directory>\gkog.exe
<Current directory>\aOcs.ico
C:\RCX3E.tmp
<Current directory>\FkQS.exe
<Current directory>\EuIQ.ico
C:\RCX3F.tmp
<Current directory>\swsc.exe
<Current directory>\OIIM.ico
C:\RCX3C.tmp
<Current directory>\bAUA.exe
<Current directory>\aOwU.ico
C:\RCX3D.tmp
<Current directory>\RoAM.exe
<Current directory>\uegU.ico
C:\RCX32.tmp
<Current directory>\bMMI.exe
<Current directory>\WSUI.ico
C:\RCX33.tmp
<Current directory>\akog.exe
<Current directory>\aoUQ.ico
C:\RCX30.tmp
<Current directory>\qAQe.exe
<Current directory>\ykQc.ico
C:\RCX31.tmp
<Current directory>\mwke.exe
<Current directory>\gwUw.ico
C:\RCX36.tmp
<Current directory>\DQsc.exe
<Current directory>\VGMM.ico
C:\RCX37.tmp
<Current directory>\zYYy.exe
<Current directory>\qikM.ico
C:\RCX34.tmp
<Current directory>\QsYc.exe
<Current directory>\MmsM.ico
C:\RCX35.tmp
<Current directory>\LMQC.exe
<Current directory>\zaIk.ico
C:\RCXA.tmp
<Current directory>\Kgcc.exe
<Current directory>\COgM.ico
C:\RCXB.tmp
<Current directory>\oMUg.exe
<Current directory>\KaIE.ico
C:\RCX8.tmp
<Current directory>\voAS.exe
<Current directory>\JmEU.ico
C:\RCX9.tmp
<Current directory>\eEkU.exe
<Current directory>\nKQs.ico
C:\RCXE.tmp
<Current directory>\RAYk.exe
<Current directory>\kEcg.ico
C:\RCXF.tmp
<Current directory>\JcwY.exe
<Current directory>\GgIo.ico
C:\RCXC.tmp
<Current directory>\uIIs.exe
<Current directory>\MiUA.ico
C:\RCXD.tmp
<Current directory>\Mswq.exe
<Current directory>\OQEQ.ico
C:\RCX2.tmp
<Current directory>\eUAq.exe
<Current directory>\VaIc.ico
C:\RCX3.tmp
<Current directory>\fIog.exe
<Current directory>\dyEQ.ico
<Current directory>\mYUk.ico
%ALLUSERSPROFILE%\lwQggIEM\nwAEcgMA.exe
%ALLUSERSPROFILE%\casg.txt
C:\RCX1.tmp
<Current directory>\REwC.exe
C:\RCX6.tmp
<Current directory>\EoYM.exe
<Current directory>\UCcI.ico
C:\RCX7.tmp
<Current directory>\Xkwy.exe
<Current directory>\qIAM.ico
C:\RCX4.tmp
<Current directory>\vsEO.exe
<Current directory>\gMsw.ico
C:\RCX5.tmp
<Current directory>\EsIq.exe
<Current directory>\Gksg.ico
C:\RCX1A.tmp
<Current directory>\DIEK.exe
<Current directory>\MGok.ico
C:\RCX1B.tmp
<Current directory>\lcEA.exe
<Current directory>\EUsQ.ico
C:\RCX18.tmp
<Current directory>\DMMs.exe
<Current directory>\RmsE.ico
C:\RCX19.tmp
<Current directory>\qwws.exe
<Current directory>\WoYY.ico
C:\RCX1E.tmp
<Current directory>\asos.exe
<Current directory>\xGEA.ico
C:\RCX1F.tmp
<Current directory>\OEgQ.exe
<Current directory>\EMgg.ico
C:\RCX1C.tmp
<Current directory>\lUEC.exe
<Current directory>\BYYg.ico
C:\RCX1D.tmp
<Current directory>\Gkgg.exe
<Current directory>\ZiYo.ico
C:\RCX12.tmp
<Current directory>\iAIw.exe
<Current directory>\ewwo.ico
C:\RCX13.tmp
<Current directory>\AEwI.exe
<Current directory>\Fyss.ico
C:\RCX10.tmp
<Current directory>\uIMS.exe
<Current directory>\BmYg.ico
C:\RCX11.tmp
<Current directory>\EEMo.exe
<Current directory>\ReoM.ico
C:\RCX16.tmp
<Current directory>\ocwE.exe
<Current directory>\VaYQ.ico
C:\RCX17.tmp
<Current directory>\lwoC.exe
<Current directory>\TuIE.ico
C:\RCX14.tmp
<Current directory>\Bggy.exe
<Current directory>\DGAs.ico
C:\RCX15.tmp
<Current directory>\GwoO.exe
<Current directory>\wIgs.ico

Sets the 'hidden' attribute to the following files:

%ALLUSERSPROFILE%\BWogoUMg\aeEkEEcE.exe
%ALLUSERSPROFILE%\lwQggIEM\nwAEcgMA.exe

Deletes the following files:

<Current directory>\TQcs.exe
<Current directory>\zaYk.ico
<Current directory>\FIMs.exe
<Current directory>\FYQE.ico
<Current directory>\DMgu.exe
<Current directory>\nywg.ico
<Current directory>\IsAw.exe
<Current directory>\xeMQ.ico
<Current directory>\ecEw.exe
<Current directory>\IewE.ico
<Current directory>\vwYW.exe
<Current directory>\zcUE.ico
<Current directory>\GQwq.exe
<Current directory>\QQIQ.ico
<Current directory>\YkgW.exe
<Current directory>\HAUc.ico
<Current directory>\dswS.exe
<Current directory>\LgYA.ico
<Current directory>\qkcQ.exe
<Current directory>\HuIU.ico
<Current directory>\DcQi.exe
<Current directory>\cgIU.ico
<Current directory>\nkUi.exe
<Current directory>\veos.ico
<Current directory>\UQYi.exe
<Current directory>\yMoY.ico
<Current directory>\yMgi.exe
<Current directory>\voEk.ico
<Current directory>\vgMY.exe
<Current directory>\zuQw.ico
<Current directory>\AQcq.exe
<Current directory>\aOcs.ico
<Current directory>\gcke.exe
<Current directory>\QycA.ico
<Current directory>\gkog.exe
<Current directory>\qikM.ico
<Current directory>\NUcI.exe
<Current directory>\cmIk.ico
<Current directory>\Esog.exe
<Current directory>\uegU.ico
<Current directory>\FkQS.exe
<Current directory>\EuIQ.ico
<Current directory>\RoAM.exe
<Current directory>\esMs.ico
<Current directory>\bAUA.exe
<Current directory>\aOwU.ico
<Current directory>\zYYy.exe
<Current directory>\gwUw.ico
<Current directory>\bMMI.exe
<Current directory>\WSUI.ico
<Current directory>\mwke.exe
<Current directory>\hKsE.ico
<Current directory>\qAQe.exe
<Current directory>\ykQc.ico
<Current directory>\akog.exe
<Current directory>\zaIk.ico
<Current directory>\DQsc.exe
<Current directory>\VGMM.ico
<Current directory>\LMQC.exe
<Current directory>\aoUQ.ico
<Current directory>\QsYc.exe
<Current directory>\MmsM.ico
<Current directory>\oMUg.exe
<Current directory>\KaIE.ico
<Current directory>\uIIs.exe
<Current directory>\COgM.ico
<Current directory>\eEkU.exe
<Current directory>\nKQs.ico
<Current directory>\Kgcc.exe
<Current directory>\MiUA.ico
<Current directory>\JcwY.exe
<Current directory>\GgIo.ico
<Current directory>\uIMS.exe
<Current directory>\kEcg.ico
<Current directory>\Mswq.exe
<Current directory>\OQEQ.ico
<Current directory>\RAYk.exe
<Current directory>\JmEU.ico
<Current directory>\fIog.exe
<Current directory>\dyEQ.ico
<Current directory>\vsEO.exe
<Current directory>\VaIc.ico
<Current directory>\REwC.exe
<Current directory>\mYUk.ico
<Current directory>\eUAq.exe
<Current directory>\gMsw.ico
<Current directory>\Xkwy.exe
<Current directory>\qIAM.ico
<Current directory>\voAS.exe
<Current directory>\UCcI.ico
<Current directory>\EsIq.exe
<Current directory>\Gksg.ico
<Current directory>\EoYM.exe
<Current directory>\MGok.ico
<Current directory>\lcEA.exe
<Current directory>\EUsQ.ico
<Current directory>\DIEK.exe
<Current directory>\RmsE.ico
<Current directory>\qwws.exe
<Current directory>\WoYY.ico
<Current directory>\lUEC.exe
<Current directory>\xGEA.ico
<Current directory>\OEgQ.exe
<Current directory>\EMgg.ico
<Current directory>\asos.exe
<Current directory>\BYYg.ico
<Current directory>\Gkgg.exe
<Current directory>\ZiYo.ico
<Current directory>\DMMs.exe
<Current directory>\ewwo.ico
<Current directory>\AEwI.exe
<Current directory>\Fyss.ico
<Current directory>\iAIw.exe
<Current directory>\BmYg.ico
<Current directory>\EEMo.exe
<Current directory>\ReoM.ico
<Current directory>\Bggy.exe
<Current directory>\VaYQ.ico
<Current directory>\lwoC.exe
<Current directory>\TuIE.ico
<Current directory>\ocwE.exe
<Current directory>\DGAs.ico
<Current directory>\GwoO.exe
<Current directory>\wIgs.ico

Moves the following files:

from C:\RCX2A.tmp to <Current directory>\TQcs.exe
from C:\RCX29.tmp to <Current directory>\IsAw.exe
from C:\RCX28.tmp to <Current directory>\DMgu.exe
from C:\RCX2B.tmp to <Current directory>\FIMs.exe
from C:\RCX2E.tmp to <Current directory>\ecEw.exe
from C:\RCX2D.tmp to <Current directory>\YkgW.exe
from C:\RCX2C.tmp to <Current directory>\GQwq.exe
from C:\RCX27.tmp to <Current directory>\yMgi.exe
from C:\RCX22.tmp to <Current directory>\dswS.exe
from C:\RCX21.tmp to <Current directory>\nkUi.exe
from C:\RCX20.tmp to <Current directory>\DcQi.exe
from C:\RCX23.tmp to <Current directory>\qkcQ.exe
from C:\RCX26.tmp to <Current directory>\UQYi.exe
from C:\RCX25.tmp to <Current directory>\AQcq.exe
from C:\RCX24.tmp to <Current directory>\vgMY.exe
from C:\RCX2F.tmp to <Current directory>\vwYW.exe
from C:\RCX3A.tmp to <Current directory>\gcke.exe
from C:\RCX39.tmp to <Current directory>\gkog.exe
from C:\RCX38.tmp to <Current directory>\NUcI.exe
from C:\RCX3B.tmp to <Current directory>\Esog.exe
from C:\RCX3E.tmp to <Current directory>\FkQS.exe
from C:\RCX3D.tmp to <Current directory>\RoAM.exe
from C:\RCX3C.tmp to <Current directory>\bAUA.exe
from C:\RCX37.tmp to <Current directory>\zYYy.exe
from C:\RCX32.tmp to <Current directory>\bMMI.exe
from C:\RCX31.tmp to <Current directory>\mwke.exe
from C:\RCX30.tmp to <Current directory>\qAQe.exe
from C:\RCX33.tmp to <Current directory>\akog.exe
from C:\RCX36.tmp to <Current directory>\DQsc.exe
from C:\RCX35.tmp to <Current directory>\LMQC.exe
from C:\RCX34.tmp to <Current directory>\QsYc.exe
from C:\RCXB.tmp to <Current directory>\oMUg.exe
from C:\RCXA.tmp to <Current directory>\Kgcc.exe
from C:\RCX9.tmp to <Current directory>\eEkU.exe
from C:\RCXC.tmp to <Current directory>\uIIs.exe
from C:\RCXF.tmp to <Current directory>\JcwY.exe
from C:\RCXE.tmp to <Current directory>\RAYk.exe
from C:\RCXD.tmp to <Current directory>\Mswq.exe
from C:\RCX8.tmp to <Current directory>\voAS.exe
from C:\RCX3.tmp to <Current directory>\fIog.exe
from C:\RCX2.tmp to <Current directory>\eUAq.exe
from C:\RCX1.tmp to <Current directory>\REwC.exe
from C:\RCX4.tmp to <Current directory>\vsEO.exe
from C:\RCX7.tmp to <Current directory>\Xkwy.exe
from C:\RCX6.tmp to <Current directory>\EoYM.exe
from C:\RCX5.tmp to <Current directory>\EsIq.exe
from C:\RCX10.tmp to <Current directory>\uIMS.exe
from C:\RCX1B.tmp to <Current directory>\lcEA.exe
from C:\RCX1A.tmp to <Current directory>\DIEK.exe
from C:\RCX19.tmp to <Current directory>\qwws.exe
from C:\RCX1C.tmp to <Current directory>\lUEC.exe
from C:\RCX1F.tmp to <Current directory>\OEgQ.exe
from C:\RCX1E.tmp to <Current directory>\asos.exe
from C:\RCX1D.tmp to <Current directory>\Gkgg.exe
from C:\RCX18.tmp to <Current directory>\DMMs.exe
from C:\RCX13.tmp to <Current directory>\AEwI.exe
from C:\RCX12.tmp to <Current directory>\iAIw.exe
from C:\RCX11.tmp to <Current directory>\EEMo.exe
from C:\RCX14.tmp to <Current directory>\Bggy.exe
from C:\RCX17.tmp to <Current directory>\lwoC.exe
from C:\RCX16.tmp to <Current directory>\ocwE.exe
from C:\RCX15.tmp to <Current directory>\GwoO.exe

Network activity:

Connects to:

'74.##5.232.51':80
'19#.#86.45.170':9999
'20#.#7.164.69':9999
'20#.#19.204.12':9999

TCP:

HTTP GET requests:

74.##5.232.51/

UDP:

DNS ASK google.com

Miscellaneous:

Searches for the following windows:

ClassName: '' WindowName: 'aeEkEEcE.exe'
ClassName: '' WindowName: 'pUccUkoM.exe'

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней