Trojan.DownLoader24.63430

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Classes\ArchiveLeader\shell\open\command] '' = '"%APPDATA%\ArchiveLeader\ArchiveLeader.exe" "%1"'

Malicious functions:

Executes the following:

'<SYSTEM32>\taskkill.exe' /f /im ArchiveLeader.exe
'%TEMP%\is-KR7V9.tmp\<File name>_temp.tmp' /SL5="$50092,2101536,121344,<Current directory>\<File name>_temp.exe" /VERYSILENT /SUPPRESSMESSAGES -fromprelauncher -installmytopapps -installamigobrowser -installpult paramsfromcontainer="-i...
'%TEMP%\is-UGEJC.tmp\OffersInstaller_ArchiveLeader.tmp' /SL5="$20144,210970,121344,%TEMP%\OffersInstaller_ArchiveLeader.exe" /VERYSILENT /PathToAmigoInstaller="%TEMP%\\02062017083701\amigo-distr.exe" /PathToMyTopAppsInstaller="%TEMP%\\02062017083701...
'%TEMP%\OffersInstaller_ArchiveLeader.exe' /VERYSILENT /PathToAmigoInstaller="%TEMP%\\02062017083701\amigo-distr.exe" /PathToMyTopAppsInstaller="%TEMP%\\02062017083701\MyTopApps-distr.exe" /PathToPultInstaller="%TEMP%\\02062017083701\sw...
'%TEMP%\is-G8C9L.tmp\<File name>_temp.tmp' /SL5="$40092,2101536,121344,<Current directory>\<File name>_temp.exe" paramsfromcontainer="-installamigobrowser -ukraine -installpult -installmytopapps glclid="
'<Current directory>\<File name>_temp.exe' paramsfromcontainer="-installamigobrowser -ukraine -installpult -installmytopapps glclid="
'<Current directory>\<File name>_temp.exe' /VERYSILENT /SUPPRESSMESSAGES -fromprelauncher -installmytopapps -installamigobrowser -installpult paramsfromcontainer="-installamigobrowser -ukraine -installpult -installmytopapps glclid="
'%TEMP%\02062017083627\prelauncher.exe' parentinstaller="<Current directory>\<File name>_temp.exe" paramsfromcontainer="-installamigobrowser -ukraine -installpult -installmytopapps glclid="

Modifies file system:

Creates the following files:

%TEMP%\is-HAIJB.tmp\is-D4JBE.tmp
%TEMP%\is-HAIJB.tmp\is-2DLBU.tmp
%APPDATA%\ArchiveLeader\is-D100J.tmp
%APPDATA%\ArchiveLeader\is-C5UGO.tmp
%APPDATA%\ArchiveLeader\is-JTF2M.tmp
%ALLUSERSPROFILE%\Start Menu\Programs\ArchiveLeader\ArchiveLeader.lnk
%TEMP%\is-MP9BK.tmp\idp.dll
%TEMP%\02062017083701\MyTopApps-distr.exe
%TEMP%\is-UGEJC.tmp\OffersInstaller_ArchiveLeader.tmp
%APPDATA%\ArchiveLeader\unins000.dat
%TEMP%\is-HAIJB.tmp\OffersInstaller_ArchiveLeader.exe
%TEMP%\is-QNQVU.tmp\prelauncher.exe
%TEMP%\02062017083627\prelauncher.exe
%APPDATA%\ArchiveLeader\settings.ini
<Current directory>\<File name>_temp.exe
%TEMP%\is-G8C9L.tmp\<File name>_temp.tmp
%TEMP%\is-KR7V9.tmp\<File name>_temp.tmp
%TEMP%\is-HAIJB.tmp\is-R0BR9.tmp
%TEMP%\is-HAIJB.tmp\is-8A51Q.tmp
%APPDATA%\ArchiveLeader\is-HMF8K.tmp
%TEMP%\is-HAIJB.tmp\EULA-Amigo.txt
%TEMP%\is-HAIJB.tmp\EULA-Pult.txt

Deletes the following files:

%TEMP%\is-HAIJB.tmp\prelauncher.exe
%TEMP%\is-HAIJB.tmp\OffersInstaller_ArchiveLeader.exe
%TEMP%\is-KR7V9.tmp\<File name>_temp.tmp
%TEMP%\is-HAIJB.tmp\EULA-Pult.txt
%TEMP%\is-QNQVU.tmp\prelauncher.exe
%TEMP%\is-G8C9L.tmp\<File name>_temp.tmp
%TEMP%\is-HAIJB.tmp\EULA-Amigo.txt

Moves the following files:

from %APPDATA%\ArchiveLeader\is-D100J.tmp to %APPDATA%\ArchiveLeader\appicon.ico
from %TEMP%\is-HAIJB.tmp\is-D4JBE.tmp to %TEMP%\is-HAIJB.tmp\prelauncher.exe
from %TEMP%\is-HAIJB.tmp\is-2DLBU.tmp to %TEMP%\is-HAIJB.tmp\OffersInstaller_ArchiveLeader.exe
from %APPDATA%\ArchiveLeader\is-HMF8K.tmp to %APPDATA%\ArchiveLeader\unins000.exe
from %APPDATA%\ArchiveLeader\is-C5UGO.tmp to %APPDATA%\ArchiveLeader\ArchiveLeader.exe
from %APPDATA%\ArchiveLeader\is-JTF2M.tmp to %APPDATA%\ArchiveLeader\unrar.dll

Network activity:

Connects to:

'di###rprdct.com':80
'ic###atch.com':80
'al####atistics.com':80

TCP:

HTTP GET requests:

http://ic###atch.com/bin/icon.exe
http://di###rprdct.com/76222462/switcher_ua.exe?am###############################################################################################################################################...
http://al####atistics.com/productApi/installStart?pr###########################################
http://al####atistics.com/productApi/launch?pr############################
http://al####atistics.com/productApi/buttonInstallClick?pr####################################

UDP: