Trojan.DownLoader11.45834

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'aeEkEEcE.exe' = '%ALLUSERSPROFILE%\BWogoUMg\aeEkEEcE.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'pUccUkoM.exe' = '%HOMEPATH%\fCkYUMIQ\pUccUkoM.exe'

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\FkYQcQph] 'Start' = '00000002'

Malicious functions:

To complicate detection of its presence in the operating system,

forces the system hide from view:

hidden files
file extensions

blocks the following features:

User Account Control (UAC)

Creates and executes the following:

'%ALLUSERSPROFILE%\lwQggIEM\nwAEcgMA.exe'
'%ALLUSERSPROFILE%\BWogoUMg\aeEkEEcE.exe'
'%HOMEPATH%\fCkYUMIQ\pUccUkoM.exe'

Executes the following:

'<SYSTEM32>\reg.exe' /pid=3380
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\NaksMMEM.bat" "<Full path to virus>""
'<SYSTEM32>\reg.exe' /pid=3636
'<SYSTEM32>\cscript.exe' /pid=3612
'<SYSTEM32>\reg.exe' /pid=2464
'<SYSTEM32>\reg.exe' /pid=1368
'<SYSTEM32>\reg.exe' /c ""%TEMP%\yKMcgsYc.bat" "<Full path to virus>""
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\PGAksMQQ.bat" "<Full path to virus>""
'<SYSTEM32>\reg.exe' /pid=3012
'<SYSTEM32>\reg.exe'
'<SYSTEM32>\cscript.exe' /pid=3140
'<SYSTEM32>\cscript.exe' /pid=1592
'<SYSTEM32>\reg.exe' /pid=3736
'<SYSTEM32>\reg.exe' /pid=3128
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\vwoYIIUU.bat" "<Full path to virus>""
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\cEQoIsAI.bat" "<Full path to virus>""
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\AmUIYYAA.bat" "<Full path to virus>""
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\MqgUIgEw.bat" "<Full path to virus>""
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\MkQgYMko.bat" "<Full path to virus>""
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\uYMsYYsU.bat" "<Full path to virus>""
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\lOgYcIoU.bat" "<Full path to virus>""
'<SYSTEM32>\reg.exe' /pid=2776
'<SYSTEM32>\cscript.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
'<SYSTEM32>\reg.exe' /pid=3976
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\DsIgQYYw.bat" "<Full path to virus>""
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\SIksoEcQ.bat" "<Full path to virus>""
'<SYSTEM32>\reg.exe' /pid=1148
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\ZUUIsUsQ.bat" "<Full path to virus>""
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\RCQUwYEg.bat" "<Full path to virus>""
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\MYYUwUoA.bat" "<Full path to virus>""
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\ckMAQQAE.bat" "<Full path to virus>""
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\lacQkooc.bat" "<Full path to virus>""
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\heUEwYEc.bat" "<Full path to virus>""
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\McsUgUAw.bat" "<Full path to virus>""
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\heMIYEsU.bat" "<Full path to virus>""
'<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
'<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
'<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\jCUwoMwE.bat" "<Full path to virus>""
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\NeUgMEAU.bat" "<Full path to virus>""
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\RuAEkAoo.bat" "<Full path to virus>""
'<SYSTEM32>\cscript.exe' %TEMP%\file.vbs
'<SYSTEM32>\reg.exe' /c "<Current directory>\<Virus name>"
'<SYSTEM32>\cscript.exe' /pid=1392
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\eWUwwAYs.bat" "<Full path to virus>""
'<SYSTEM32>\reg.exe' /pid=3156
'<SYSTEM32>\reg.exe' /pid=3280
'<SYSTEM32>\reg.exe' /pid=1860
'<SYSTEM32>\reg.exe' /c ""%TEMP%\amgocUgo.bat" "<Full path to virus>""
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\JWgQMMwk.bat" "<Full path to virus>""
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\XcsksQcE.bat" "<Full path to virus>""
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\HuYYAYYs.bat" "<Full path to virus>""
'<SYSTEM32>\reg.exe' /pid=1372
'<SYSTEM32>\reg.exe' /pid=2788
'<SYSTEM32>\cscript.exe' /pid=2776
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\tEIwMUQA.bat" "<Full path to virus>""

Injects code into

the following system processes:

<SYSTEM32>\cscript.exe
<SYSTEM32>\reg.exe
<SYSTEM32>\cmd.exe

Modifies file system :

Creates the following files:

%TEMP%\biAQQoIs.bat
%TEMP%\kacUAkQA.bat
<Current directory>\YoQG.exe
<Current directory>\uOws.ico
C:\RCX15.tmp
%TEMP%\eyEwYggI.bat
C:\RCX14.tmp
<Current directory>\hMQu.exe
<Current directory>\ySIU.ico
C:\RCX16.tmp
%TEMP%\juUAsYcw.bat
%TEMP%\DsIgQYYw.bat
<Current directory>\hMsk.exe
<Current directory>\uaoQ.ico
C:\RCX17.tmp
%TEMP%\UoUwQMYE.bat
%TEMP%\yKMcgsYc.bat
<Current directory>\rEAG.exe
<Current directory>\JsQc.ico
<Current directory>\pQUU.exe
%TEMP%\ySogkMwY.bat
%TEMP%\eWUwwAYs.bat
<Current directory>\WQUs.exe
<Current directory>\rsQc.ico
C:\RCX11.tmp
%TEMP%\QCsEcgoY.bat
%TEMP%\tEIwMUQA.bat
<Current directory>\KYYw.exe
<Current directory>\WGEs.ico
C:\RCX12.tmp
%TEMP%\QscEcAII.bat
C:\RCX13.tmp
<Current directory>\fAkQ.ico
%TEMP%\NaksMMEM.bat
<Current directory>\NAIe.exe
%TEMP%\hKQUIYsw.bat
%TEMP%\amgocUgo.bat
<Current directory>\Dmcg.ico
%TEMP%\PGAksMQQ.bat
C:\RCX18.tmp
%TEMP%\GeAAwYoI.bat
%TEMP%\MqgUIgEw.bat
<Current directory>\zMYU.exe
<Current directory>\nscA.ico
C:\RCX1D.tmp
%TEMP%\EwggcEIM.bat
%TEMP%\vwoYIIUU.bat
<Current directory>\UUks.exe
<Current directory>\TSYs.ico
C:\RCX1E.tmp
%TEMP%\iEMMcMcg.bat
C:\RCX1F.tmp
%TEMP%\cqUUoIYw.bat
%TEMP%\MkQgYMko.bat
<Current directory>\ngkw.exe
%TEMP%\MCAsAwAk.bat
%TEMP%\lOgYcIoU.bat
<Current directory>\uGwc.ico
%TEMP%\uYMsYYsU.bat
C:\RCX1C.tmp
%TEMP%\YQwAgUYE.bat
%TEMP%\SIksoEcQ.bat
<Current directory>\FUEu.exe
<Current directory>\XKss.ico
C:\RCX19.tmp
%TEMP%\vgoUUoMU.bat
%TEMP%\ZUUIsUsQ.bat
<Current directory>\qMgw.exe
<Current directory>\tygI.ico
C:\RCX1A.tmp
%TEMP%\zycQEAwM.bat
%TEMP%\cEQoIsAI.bat
<Current directory>\uMki.exe
<Current directory>\CuMI.ico
C:\RCX1B.tmp
%TEMP%\KukAogIY.bat
%TEMP%\AmUIYYAA.bat
<Current directory>\PUkM.exe
<Current directory>\LIkU.ico
C:\RCX10.tmp
C:\RCX5.tmp
<Current directory>\fkwk.exe
<Current directory>\RGso.ico
%TEMP%\ckMAQQAE.bat
<Current directory>\heQg.ico
<Current directory>\IUQq.exe
<Current directory>\kIkk.ico
%TEMP%\FWgwwIEo.bat
C:\RCX4.tmp
<Current directory>\PgYK.exe
%TEMP%\lkkYoUQA.bat
%TEMP%\MYYUwUoA.bat
<Current directory>\lUQI.exe
<Current directory>\YqUg.ico
C:\RCX7.tmp
%TEMP%\GasQAUQk.bat
C:\RCX6.tmp
<Current directory>\AsoY.exe
<Current directory>\cyoU.ico
C:\RCX3.tmp
%TEMP%\EgQUQsQk.bat
%TEMP%\file.vbs
<Current directory>\tCok.ico
%TEMP%\RuAEkAoo.bat
%TEMP%\jCUwoMwE.bat
%ALLUSERSPROFILE%\lwQggIEM\nwAEcgMA.exe
<Current directory>\<Virus name>
%TEMP%\aOkMAEgs.bat
<Current directory>\qwQO.exe
%TEMP%\NeUgMEAU.bat
C:\RCX2.tmp
<Current directory>\GUkK.exe
<Current directory>\xIgw.ico
<Current directory>\gEok.exe
%TEMP%\CqAMYsgE.bat
C:\RCX1.tmp
<Current directory>\kkcU.ico
%ALLUSERSPROFILE%\casg.txt
C:\RCX8.tmp
<Current directory>\VIgk.ico
%TEMP%\GIMswMYo.bat
<Current directory>\TEMm.exe
%TEMP%\HuYYAYYs.bat
C:\RCXD.tmp
%TEMP%\heUEwYEc.bat
%TEMP%\SIgkoQkc.bat
<Current directory>\nEok.exe
<Current directory>\ESII.ico
C:\RCXE.tmp
%TEMP%\jSUMsMkk.bat
%TEMP%\JWgQMMwk.bat
<Current directory>\hUkU.exe
<Current directory>\kCsU.ico
C:\RCXF.tmp
<Current directory>\eksy.exe
<Current directory>\WwQo.ico
%TEMP%\DaUYcAcc.bat
%TEMP%\XcsksQcE.bat
C:\RCXC.tmp
%TEMP%\VWkQscoE.bat
C:\RCX9.tmp
<Current directory>\RoAe.exe
<Current directory>\JWMw.ico
%TEMP%\lacQkooc.bat
%TEMP%\aiIwEYoo.bat
%TEMP%\RCQUwYEg.bat
<Current directory>\bEYQ.exe
<Current directory>\xiYM.ico
C:\RCXA.tmp
C:\RCXB.tmp
<Current directory>\LQoY.exe
<Current directory>\BUUG.exe
<Current directory>\wAsI.ico
<Current directory>\GckM.ico
%TEMP%\heMIYEsU.bat
%TEMP%\QqssIsIM.bat
%TEMP%\GkAMkwAw.bat
%TEMP%\McsUgUAw.bat

Sets the 'hidden' attribute to the following files:

%ALLUSERSPROFILE%\lwQggIEM\nwAEcgMA.exe
%ALLUSERSPROFILE%\BWogoUMg\aeEkEEcE.exe
%HOMEPATH%\fCkYUMIQ\pUccUkoM.exe

Deletes the following files:

<Current directory>\YoQG.exe
%TEMP%\UoUwQMYE.bat
<Current directory>\uOws.ico
<Current directory>\hMQu.exe
<Current directory>\ySIU.ico
%TEMP%\biAQQoIs.bat
%TEMP%\yKMcgsYc.bat
%TEMP%\kacUAkQA.bat
<Current directory>\hMsk.exe
<Current directory>\rEAG.exe
<Current directory>\JsQc.ico
%TEMP%\juUAsYcw.bat
<Current directory>\WQUs.exe
<Current directory>\rsQc.ico
%TEMP%\QscEcAII.bat
<Current directory>\KYYw.exe
<Current directory>\WGEs.ico
%TEMP%\hKQUIYsw.bat
%TEMP%\eyEwYggI.bat
<Current directory>\pQUU.exe
<Current directory>\fAkQ.ico
<Current directory>\NAIe.exe
<Current directory>\Dmcg.ico
%TEMP%\amgocUgo.bat
<Current directory>\TSYs.ico
%TEMP%\GeAAwYoI.bat
%TEMP%\MCAsAwAk.bat
<Current directory>\CuMI.ico
%TEMP%\EwggcEIM.bat
<Current directory>\UUks.exe
<Current directory>\ngkw.exe
<Current directory>\uGwc.ico
%TEMP%\cqUUoIYw.bat
<Current directory>\zMYU.exe
<Current directory>\nscA.ico
%TEMP%\iEMMcMcg.bat
<Current directory>\tygI.ico
%TEMP%\YQwAgUYE.bat
<Current directory>\FUEu.exe
<Current directory>\uaoQ.ico
%TEMP%\vgoUUoMU.bat
<Current directory>\qMgw.exe
<Current directory>\LIkU.ico
%TEMP%\zycQEAwM.bat
<Current directory>\uMki.exe
<Current directory>\XKss.ico
%TEMP%\KukAogIY.bat
<Current directory>\PUkM.exe
<Current directory>\PgYK.exe
<Current directory>\RGso.ico
<Current directory>\AsoY.exe
<Current directory>\fkwk.exe
<Current directory>\heQg.ico
%TEMP%\GasQAUQk.bat
<Current directory>\lUQI.exe
<Current directory>\YqUg.ico
%TEMP%\VWkQscoE.bat
%TEMP%\lkkYoUQA.bat
<Current directory>\cyoU.ico
%TEMP%\aiIwEYoo.bat
<Current directory>\qwQO.exe
<Current directory>\tCok.ico
<Current directory>\gEok.exe
%TEMP%\aOkMAEgs.bat
%TEMP%\EgQUQsQk.bat
%TEMP%\CqAMYsgE.bat
%TEMP%\FWgwwIEo.bat
<Current directory>\IUQq.exe
<Current directory>\kIkk.ico
<Current directory>\kkcU.ico
<Current directory>\GUkK.exe
<Current directory>\xIgw.ico
<Current directory>\VIgk.ico
%TEMP%\DaUYcAcc.bat
<Current directory>\eksy.exe
<Current directory>\ESII.ico
%TEMP%\GIMswMYo.bat
<Current directory>\TEMm.exe
<Current directory>\kCsU.ico
%TEMP%\QCsEcgoY.bat
%TEMP%\ySogkMwY.bat
<Current directory>\WwQo.ico
%TEMP%\jSUMsMkk.bat
<Current directory>\hUkU.exe
<Current directory>\RoAe.exe
<Current directory>\JWMw.ico
%TEMP%\GkAMkwAw.bat
<Current directory>\bEYQ.exe
<Current directory>\xiYM.ico
%TEMP%\QqssIsIM.bat
<Current directory>\BUUG.exe
<Current directory>\wAsI.ico
<Current directory>\nEok.exe
<Current directory>\LQoY.exe
<Current directory>\GckM.ico
%TEMP%\SIgkoQkc.bat

Moves the following files:

from C:\RCX15.tmp to <Current directory>\hMQu.exe
from C:\RCX16.tmp to <Current directory>\YoQG.exe
from C:\RCX17.tmp to <Current directory>\rEAG.exe
from C:\RCX14.tmp to <Current directory>\pQUU.exe
from C:\RCX11.tmp to <Current directory>\KYYw.exe
from C:\RCX12.tmp to <Current directory>\WQUs.exe
from C:\RCX13.tmp to <Current directory>\NAIe.exe
from C:\RCX18.tmp to <Current directory>\hMsk.exe
from C:\RCX1D.tmp to <Current directory>\UUks.exe
from C:\RCX1E.tmp to <Current directory>\zMYU.exe
from C:\RCX1F.tmp to <Current directory>\ngkw.exe
from C:\RCX1C.tmp to <Current directory>\uMki.exe
from C:\RCX19.tmp to <Current directory>\qMgw.exe
from C:\RCX1A.tmp to <Current directory>\FUEu.exe
from C:\RCX1B.tmp to <Current directory>\PUkM.exe
from C:\RCX10.tmp to <Current directory>\hUkU.exe
from C:\RCX5.tmp to <Current directory>\fkwk.exe
from C:\RCX6.tmp to <Current directory>\PgYK.exe
from C:\RCX7.tmp to <Current directory>\AsoY.exe
from C:\RCX4.tmp to <Current directory>\IUQq.exe
from C:\RCX1.tmp to <Current directory>\qwQO.exe
from C:\RCX2.tmp to <Current directory>\gEok.exe
from C:\RCX3.tmp to <Current directory>\GUkK.exe
from C:\RCX8.tmp to <Current directory>\lUQI.exe
from C:\RCXD.tmp to <Current directory>\nEok.exe
from C:\RCXE.tmp to <Current directory>\TEMm.exe
from C:\RCXF.tmp to <Current directory>\eksy.exe
from C:\RCXC.tmp to <Current directory>\BUUG.exe
from C:\RCX9.tmp to <Current directory>\bEYQ.exe
from C:\RCXA.tmp to <Current directory>\RoAe.exe
from C:\RCXB.tmp to <Current directory>\LQoY.exe

Deletes itself.

Network activity:

Connects to:

'19#.#86.45.170':9999
'74.##5.232.51':80
'20#.#7.164.69':9999
'20#.#19.204.12':9999

TCP:

HTTP GET requests:

74.##5.232.51/

UDP:

DNS ASK google.com

Miscellaneous:

Searches for the following windows:

ClassName: '' WindowName: 'aeEkEEcE.exe'
ClassName: '' WindowName: 'pUccUkoM.exe'
ClassName: 'Indicator' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней