Trojan.DownLoader32.38783

Technical Information

Modifies file system

Creates the following files

<Current directory>\d.cab
<Current directory>\$dpx$.tmp\e240225668b4c74cb1b2e96b180bb697.tmp
<Current directory>\$dpx$.tmp\0208def2b3d6c04fbff167273dc665fa.tmp
<Current directory>\$dpx$.tmp\12b2418466b34c479f552f6fe2ad75a6.tmp
<Current directory>\$dpx$.tmp\e63623971e460149bb4b3cd35e73643e.tmp
<Current directory>\$dpx$.tmp\af432634730e864f9d7e3eaaa5a762f4.tmp
<Current directory>\$dpx$.tmp\9a8f65e0675519429d5a1c509e66a06e.tmp
<Current directory>\$dpx$.tmp\8b79eaab0a6fb44facb569304051805c.tmp
<Current directory>\$dpx$.tmp\3bacfb9bffdf164c851c0c806a8c843a.tmp
<Current directory>\$dpx$.tmp\12b2dd27c82dd6428f231772a8804a4b.tmp
<Current directory>\$dpx$.tmp\9fad9e511228114fa5c0c53bf0f773d9.tmp
<Current directory>\$dpx$.tmp\635834757fc6a2458ffd75e4d6dd6490.tmp
<Current directory>\$dpx$.tmp\e7d992261bc6674b86f8eccd425194a1.tmp
<Current directory>\$dpx$.tmp\4291bb053a639840a6bc2334f1fab7e9.tmp
<Current directory>\$dpx$.tmp\64072748449c8a4f95a3460459aedd96.tmp
<Current directory>\$dpx$.tmp\e4f534fcedebbf449c8ff02074606891.tmp
<Current directory>\$dpx$.tmp\26b61b47f4e0904e9097b1a51257c71c.tmp
<Current directory>\$dpx$.tmp\6c58b7c2162cff41864b1a71ceb04a25.tmp
<Current directory>\$dpx$.tmp\2fd87299368cc84680565a88d55e9e7f.tmp
<Current directory>\$dpx$.tmp\a64877d3a83d8b46bbd363a0ed8e7d21.tmp
<Current directory>\$dpx$.tmp\5077918a4d901a4ab9106c18018ba161.tmp
<Current directory>\$dpx$.tmp\cf5acc9a66d03549956be31c1c954a1a.tmp
<Current directory>\$dpx$.tmp\7e4d463be686f646ba3799b80ab5aa66.tmp
<Current directory>\$dpx$.tmp\812e02eae43ce54aa6c0db78364bd297.tmp
<Current directory>\$dpx$.tmp\ab344bd0cad9d54d9d8a945cde7ec36c.tmp
<Current directory>\$dpx$.tmp\e6731f2fa5b0ce42b26e1b5bfc2ce9f2.tmp
<Current directory>\$dpx$.tmp\5df3b3b7b1998c4c8e0e2be3cd849bf3.tmp
<Current directory>\$dpx$.tmp\0e84dbd10ad2c94e8eeef0a449784b75.tmp
<Current directory>\$dpx$.tmp\a79ffafa37223b488cccbfd14cd8350f.tmp
<Current directory>\$dpx$.tmp\df6c60201c78b447950d4e439bc9a1ea.tmp
<Current directory>\$dpx$.tmp\60d8ac9d7a916042828643c40d82faad.tmp
<Current directory>\$dpx$.tmp\06f6a3e37b796142a8429fbcfbf3ee8d.tmp
<Current directory>\$dpx$.tmp\808f16d263aa40409a94f44939fcbede.tmp
<Current directory>\$dpx$.tmp\5b1aa79eba16724882111978e39c5526.tmp
<Current directory>\$dpx$.tmp\fa180f858dc39c43b93597599d73b978.tmp
<Current directory>\$dpx$.tmp\ddbff680dda89b40a2abdc62d088e86d.tmp
<Current directory>\$dpx$.tmp\f69c43451842ef4e82ede71d5f6e4ab4.tmp
<Current directory>\$dpx$.tmp\d430dd1c86bbb942adbc90fc88c19221.tmp
<Current directory>\$dpx$.tmp\2378ea2e8207fb45b447a3b266dd95b4.tmp
<Current directory>\$dpx$.tmp\01a7f5d2db06214f958a1d82c76aef25.tmp
<Current directory>\$dpx$.tmp\955054aa22fab04099155f0e575cfd27.tmp
<Current directory>\$dpx$.tmp\21790adabc7db74493f617cc7c2631f8.tmp
<Current directory>\$dpx$.tmp\6ec54bd14e78cb48a32b409a244bb9d8.tmp
<Current directory>\$dpx$.tmp\d245cb7502eceb49a8c363e1655bc65f.tmp
<Current directory>\$dpx$.tmp\1a64a558b987914cb4e36d078e959fa6.tmp

Sets the 'hidden' attribute to the following files

<Current directory>\api-ms-win-core-console-l1-1-0.dll
<Current directory>\api-ms-win-crt-conio-l1-1-0.dll
<Current directory>\api-ms-win-crt-convert-l1-1-0.dll
<Current directory>\api-ms-win-crt-environment-l1-1-0.dll
<Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
<Current directory>\api-ms-win-crt-heap-l1-1-0.dll
<Current directory>\api-ms-win-crt-locale-l1-1-0.dll
<Current directory>\api-ms-win-crt-math-l1-1-0.dll
<Current directory>\api-ms-win-core-timezone-l1-1-0.dll
<Current directory>\api-ms-win-core-util-l1-1-0.dll
<Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
<Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
<Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
<Current directory>\api-ms-win-crt-string-l1-1-0.dll
<Current directory>\api-ms-win-crt-time-l1-1-0.dll
<Current directory>\api-ms-win-crt-utility-l1-1-0.dll
<Current directory>\msvcp140.dll
<Current directory>\opencl.dll
<Current directory>\api-ms-win-crt-private-l1-1-0.dll
<Current directory>\api-ms-win-crt-process-l1-1-0.dll
<Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
<Current directory>\api-ms-win-core-synch-l1-2-0.dll
<Current directory>\api-ms-win-core-synch-l1-1-0.dll
<Current directory>\api-ms-win-core-debug-l1-1-0.dll
<Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-2-0.dll
<Current directory>\api-ms-win-core-file-l2-1-0.dll
<Current directory>\api-ms-win-core-handle-l1-1-0.dll
<Current directory>\api-ms-win-core-heap-l1-1-0.dll
<Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
<Current directory>\api-ms-win-core-datetime-l1-1-0.dll
<Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
<Current directory>\api-ms-win-core-memory-l1-1-0.dll
<Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
<Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
<Current directory>\api-ms-win-core-profile-l1-1-0.dll
<Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
<Current directory>\api-ms-win-core-string-l1-1-0.dll
<Current directory>\api-ms-win-core-localization-l1-2-0.dll
<Current directory>\ucrtbase.dll
<Current directory>\vcruntime140.dll

Deletes the following files

<Current directory>\d.cab

Moves the following files

from <Current directory>\$dpx$.tmp\ab344bd0cad9d54d9d8a945cde7ec36c.tmp to <Current directory>\api-ms-win-core-console-l1-1-0.dll
from <Current directory>\$dpx$.tmp\12b2418466b34c479f552f6fe2ad75a6.tmp to <Current directory>\api-ms-win-crt-conio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e63623971e460149bb4b3cd35e73643e.tmp to <Current directory>\api-ms-win-crt-convert-l1-1-0.dll
from <Current directory>\$dpx$.tmp\af432634730e864f9d7e3eaaa5a762f4.tmp to <Current directory>\api-ms-win-crt-environment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\9a8f65e0675519429d5a1c509e66a06e.tmp to <Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
from <Current directory>\$dpx$.tmp\8b79eaab0a6fb44facb569304051805c.tmp to <Current directory>\api-ms-win-crt-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\3bacfb9bffdf164c851c0c806a8c843a.tmp to <Current directory>\api-ms-win-crt-locale-l1-1-0.dll
from <Current directory>\$dpx$.tmp\12b2dd27c82dd6428f231772a8804a4b.tmp to <Current directory>\api-ms-win-crt-math-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e240225668b4c74cb1b2e96b180bb697.tmp to <Current directory>\api-ms-win-core-timezone-l1-1-0.dll
from <Current directory>\$dpx$.tmp\0208def2b3d6c04fbff167273dc665fa.tmp to <Current directory>\api-ms-win-core-util-l1-1-0.dll
from <Current directory>\$dpx$.tmp\9fad9e511228114fa5c0c53bf0f773d9.tmp to <Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
from <Current directory>\$dpx$.tmp\4291bb053a639840a6bc2334f1fab7e9.tmp to <Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\64072748449c8a4f95a3460459aedd96.tmp to <Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e4f534fcedebbf449c8ff02074606891.tmp to <Current directory>\api-ms-win-crt-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\26b61b47f4e0904e9097b1a51257c71c.tmp to <Current directory>\api-ms-win-crt-time-l1-1-0.dll
from <Current directory>\$dpx$.tmp\6c58b7c2162cff41864b1a71ceb04a25.tmp to <Current directory>\api-ms-win-crt-utility-l1-1-0.dll
from <Current directory>\$dpx$.tmp\2fd87299368cc84680565a88d55e9e7f.tmp to <Current directory>\msvcp140.dll
from <Current directory>\$dpx$.tmp\a64877d3a83d8b46bbd363a0ed8e7d21.tmp to <Current directory>\opencl.dll
from <Current directory>\$dpx$.tmp\635834757fc6a2458ffd75e4d6dd6490.tmp to <Current directory>\api-ms-win-crt-private-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e7d992261bc6674b86f8eccd425194a1.tmp to <Current directory>\api-ms-win-crt-process-l1-1-0.dll
from <Current directory>\$dpx$.tmp\5077918a4d901a4ab9106c18018ba161.tmp to <Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
from <Current directory>\$dpx$.tmp\7e4d463be686f646ba3799b80ab5aa66.tmp to <Current directory>\api-ms-win-core-synch-l1-2-0.dll
from <Current directory>\$dpx$.tmp\d245cb7502eceb49a8c363e1655bc65f.tmp to <Current directory>\api-ms-win-core-synch-l1-1-0.dll
from <Current directory>\$dpx$.tmp\5df3b3b7b1998c4c8e0e2be3cd849bf3.tmp to <Current directory>\api-ms-win-core-debug-l1-1-0.dll
from <Current directory>\$dpx$.tmp\0e84dbd10ad2c94e8eeef0a449784b75.tmp to <Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a79ffafa37223b488cccbfd14cd8350f.tmp to <Current directory>\api-ms-win-core-file-l1-1-0.dll
from <Current directory>\$dpx$.tmp\df6c60201c78b447950d4e439bc9a1ea.tmp to <Current directory>\api-ms-win-core-file-l1-2-0.dll
from <Current directory>\$dpx$.tmp\60d8ac9d7a916042828643c40d82faad.tmp to <Current directory>\api-ms-win-core-file-l2-1-0.dll
from <Current directory>\$dpx$.tmp\06f6a3e37b796142a8429fbcfbf3ee8d.tmp to <Current directory>\api-ms-win-core-handle-l1-1-0.dll
from <Current directory>\$dpx$.tmp\808f16d263aa40409a94f44939fcbede.tmp to <Current directory>\api-ms-win-core-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\5b1aa79eba16724882111978e39c5526.tmp to <Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e6731f2fa5b0ce42b26e1b5bfc2ce9f2.tmp to <Current directory>\api-ms-win-core-datetime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\fa180f858dc39c43b93597599d73b978.tmp to <Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f69c43451842ef4e82ede71d5f6e4ab4.tmp to <Current directory>\api-ms-win-core-memory-l1-1-0.dll
from <Current directory>\$dpx$.tmp\d430dd1c86bbb942adbc90fc88c19221.tmp to <Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
from <Current directory>\$dpx$.tmp\2378ea2e8207fb45b447a3b266dd95b4.tmp to <Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\01a7f5d2db06214f958a1d82c76aef25.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
from <Current directory>\$dpx$.tmp\955054aa22fab04099155f0e575cfd27.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
from <Current directory>\$dpx$.tmp\21790adabc7db74493f617cc7c2631f8.tmp to <Current directory>\api-ms-win-core-profile-l1-1-0.dll
from <Current directory>\$dpx$.tmp\6ec54bd14e78cb48a32b409a244bb9d8.tmp to <Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
from <Current directory>\$dpx$.tmp\812e02eae43ce54aa6c0db78364bd297.tmp to <Current directory>\api-ms-win-core-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ddbff680dda89b40a2abdc62d088e86d.tmp to <Current directory>\api-ms-win-core-localization-l1-2-0.dll
from <Current directory>\$dpx$.tmp\cf5acc9a66d03549956be31c1c954a1a.tmp to <Current directory>\ucrtbase.dll
from <Current directory>\$dpx$.tmp\1a64a558b987914cb4e36d078e959fa6.tmp to <Current directory>\vcruntime140.dll

Network activity

TCP

'lp##.abbny.com':443
'lp##.haqo.net':443

UDP

DNS ASK lp##.beahh.com
DNS ASK lp##.abbny.com
DNS ASK lp##.haqo.net

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a
'<SYSTEM32>\expand.exe' d.cab -f:* .

Технології

Терміни

Навчання

Міфи

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней