Trojan.DownLoader33.5763

Technical Information

Modifies file system

Creates the following files

<Current directory>\d.cab
<Current directory>\$dpx$.tmp\e261d5d006a6c941ada286eaf1abc1c1.tmp
<Current directory>\$dpx$.tmp\a2f017feead91b4ba63f38faaea53e76.tmp
<Current directory>\$dpx$.tmp\751070471f55de4cb32687e84f4227cc.tmp
<Current directory>\$dpx$.tmp\530990c955981b43872c7aeeb7155bef.tmp
<Current directory>\$dpx$.tmp\49efede0edf929498f636270bb79e31c.tmp
<Current directory>\$dpx$.tmp\e4a86c0335f20d4c8a98b13926f5707b.tmp
<Current directory>\$dpx$.tmp\0aa22fcb25efd548bf3cb50295ff79c7.tmp
<Current directory>\$dpx$.tmp\b6cced13432bc749834198b61abd1651.tmp
<Current directory>\$dpx$.tmp\7aa98fb60a8dba498b32e716956499fa.tmp
<Current directory>\$dpx$.tmp\b8f93c0e9648c44895dea1c39b6a5f7a.tmp
<Current directory>\$dpx$.tmp\a119c1f8bc6e2b4c8ebe4f019b80b1f9.tmp
<Current directory>\$dpx$.tmp\5b837ef26a8b9045ab5a4fb63292e7bb.tmp
<Current directory>\$dpx$.tmp\4cba104e5ac10944a49b874495f09330.tmp
<Current directory>\$dpx$.tmp\cad1de7850f4b3439704e62fd1e8df1a.tmp
<Current directory>\$dpx$.tmp\f9cfeea786a9c04b901881203fdd8e2b.tmp
<Current directory>\$dpx$.tmp\f0d96ec8eac1ab45aa09926b9b572ac9.tmp
<Current directory>\$dpx$.tmp\ccbd679629a733458bf1fdc14751527c.tmp
<Current directory>\$dpx$.tmp\bbbfa747bdca794fab01703ca628dc33.tmp
<Current directory>\$dpx$.tmp\7538c68be90b0a4287252b6de2353280.tmp
<Current directory>\$dpx$.tmp\3d1bb752110a524b8503d5647eb8c380.tmp
<Current directory>\$dpx$.tmp\37785328dd324144874879fcef74924c.tmp
<Current directory>\$dpx$.tmp\78555732d448544b91e10ec0f85ed8bc.tmp
<Current directory>\$dpx$.tmp\5b86345e665cbb4aba660af359e118b2.tmp
<Current directory>\$dpx$.tmp\4e9fdcad0232dc4782674d14c94c6d2e.tmp
<Current directory>\$dpx$.tmp\88e9579fb153a648863a5431068c084a.tmp
<Current directory>\$dpx$.tmp\54f9f2d995ca3e42b9f9044a36943c6f.tmp
<Current directory>\$dpx$.tmp\0b60cb843c3f2649a23a77a61406c7ec.tmp
<Current directory>\$dpx$.tmp\fd8b0710cce2fa47a25ef739606e6038.tmp
<Current directory>\$dpx$.tmp\fab338aa1032e14b8459a0e0f48296ff.tmp
<Current directory>\$dpx$.tmp\969cf25cae6e0c45be785d964eaac88a.tmp
<Current directory>\$dpx$.tmp\1a8a4f6e708824439b2198fee2b9c71c.tmp
<Current directory>\$dpx$.tmp\1db05d87e149a34bb80892ec12add8bb.tmp
<Current directory>\$dpx$.tmp\2ee7033fb6b5ea4c92d44b4a1b52887a.tmp
<Current directory>\$dpx$.tmp\5555ed656737474283a598be301e68e3.tmp
<Current directory>\$dpx$.tmp\fe2284109fbec248a383a5c2b72fadd8.tmp
<Current directory>\$dpx$.tmp\d5fec51793e9ff429a5f3977f3b94f29.tmp
<Current directory>\$dpx$.tmp\369758d654ead14a9d1238801b6ecbe7.tmp
<Current directory>\$dpx$.tmp\c5833b4723e73242a3c7f4226f9c7330.tmp
<Current directory>\$dpx$.tmp\3c5c819cbba3e049a62aa5a62c939fdd.tmp
<Current directory>\$dpx$.tmp\9f5accfff81e4543a97d536c9682beeb.tmp
<Current directory>\$dpx$.tmp\f4340180aeb07247bb634ada7dad199e.tmp
<Current directory>\$dpx$.tmp\77faf4ce3d22114aafc65d23c4e25ac0.tmp
<Current directory>\$dpx$.tmp\94356cea57949f40b2d007c2a849ad19.tmp
<Current directory>\$dpx$.tmp\bc86af7fdfb8ad4cb300cb39f97ae905.tmp

Sets the 'hidden' attribute to the following files

<Current directory>\api-ms-win-core-console-l1-1-0.dll
<Current directory>\api-ms-win-crt-conio-l1-1-0.dll
<Current directory>\api-ms-win-crt-convert-l1-1-0.dll
<Current directory>\api-ms-win-crt-environment-l1-1-0.dll
<Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
<Current directory>\api-ms-win-crt-heap-l1-1-0.dll
<Current directory>\api-ms-win-crt-locale-l1-1-0.dll
<Current directory>\api-ms-win-crt-math-l1-1-0.dll
<Current directory>\api-ms-win-core-timezone-l1-1-0.dll
<Current directory>\api-ms-win-core-util-l1-1-0.dll
<Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
<Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
<Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
<Current directory>\api-ms-win-crt-string-l1-1-0.dll
<Current directory>\api-ms-win-crt-time-l1-1-0.dll
<Current directory>\api-ms-win-crt-utility-l1-1-0.dll
<Current directory>\msvcp140.dll
<Current directory>\opencl.dll
<Current directory>\api-ms-win-crt-private-l1-1-0.dll
<Current directory>\api-ms-win-crt-process-l1-1-0.dll
<Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
<Current directory>\api-ms-win-core-synch-l1-2-0.dll
<Current directory>\api-ms-win-core-synch-l1-1-0.dll
<Current directory>\api-ms-win-core-debug-l1-1-0.dll
<Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-2-0.dll
<Current directory>\api-ms-win-core-file-l2-1-0.dll
<Current directory>\api-ms-win-core-handle-l1-1-0.dll
<Current directory>\api-ms-win-core-heap-l1-1-0.dll
<Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
<Current directory>\api-ms-win-core-datetime-l1-1-0.dll
<Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
<Current directory>\api-ms-win-core-memory-l1-1-0.dll
<Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
<Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
<Current directory>\api-ms-win-core-profile-l1-1-0.dll
<Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
<Current directory>\api-ms-win-core-string-l1-1-0.dll
<Current directory>\api-ms-win-core-localization-l1-2-0.dll
<Current directory>\ucrtbase.dll
<Current directory>\vcruntime140.dll

Deletes the following files

<Current directory>\d.cab

Moves the following files

from <Current directory>\$dpx$.tmp\4e9fdcad0232dc4782674d14c94c6d2e.tmp to <Current directory>\api-ms-win-core-console-l1-1-0.dll
from <Current directory>\$dpx$.tmp\751070471f55de4cb32687e84f4227cc.tmp to <Current directory>\api-ms-win-crt-conio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\530990c955981b43872c7aeeb7155bef.tmp to <Current directory>\api-ms-win-crt-convert-l1-1-0.dll
from <Current directory>\$dpx$.tmp\49efede0edf929498f636270bb79e31c.tmp to <Current directory>\api-ms-win-crt-environment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e4a86c0335f20d4c8a98b13926f5707b.tmp to <Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
from <Current directory>\$dpx$.tmp\0aa22fcb25efd548bf3cb50295ff79c7.tmp to <Current directory>\api-ms-win-crt-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\b6cced13432bc749834198b61abd1651.tmp to <Current directory>\api-ms-win-crt-locale-l1-1-0.dll
from <Current directory>\$dpx$.tmp\7aa98fb60a8dba498b32e716956499fa.tmp to <Current directory>\api-ms-win-crt-math-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e261d5d006a6c941ada286eaf1abc1c1.tmp to <Current directory>\api-ms-win-core-timezone-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a2f017feead91b4ba63f38faaea53e76.tmp to <Current directory>\api-ms-win-core-util-l1-1-0.dll
from <Current directory>\$dpx$.tmp\b8f93c0e9648c44895dea1c39b6a5f7a.tmp to <Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
from <Current directory>\$dpx$.tmp\4cba104e5ac10944a49b874495f09330.tmp to <Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\cad1de7850f4b3439704e62fd1e8df1a.tmp to <Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f9cfeea786a9c04b901881203fdd8e2b.tmp to <Current directory>\api-ms-win-crt-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f0d96ec8eac1ab45aa09926b9b572ac9.tmp to <Current directory>\api-ms-win-crt-time-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ccbd679629a733458bf1fdc14751527c.tmp to <Current directory>\api-ms-win-crt-utility-l1-1-0.dll
from <Current directory>\$dpx$.tmp\bbbfa747bdca794fab01703ca628dc33.tmp to <Current directory>\msvcp140.dll
from <Current directory>\$dpx$.tmp\7538c68be90b0a4287252b6de2353280.tmp to <Current directory>\opencl.dll
from <Current directory>\$dpx$.tmp\a119c1f8bc6e2b4c8ebe4f019b80b1f9.tmp to <Current directory>\api-ms-win-crt-private-l1-1-0.dll
from <Current directory>\$dpx$.tmp\5b837ef26a8b9045ab5a4fb63292e7bb.tmp to <Current directory>\api-ms-win-crt-process-l1-1-0.dll
from <Current directory>\$dpx$.tmp\3d1bb752110a524b8503d5647eb8c380.tmp to <Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
from <Current directory>\$dpx$.tmp\78555732d448544b91e10ec0f85ed8bc.tmp to <Current directory>\api-ms-win-core-synch-l1-2-0.dll
from <Current directory>\$dpx$.tmp\94356cea57949f40b2d007c2a849ad19.tmp to <Current directory>\api-ms-win-core-synch-l1-1-0.dll
from <Current directory>\$dpx$.tmp\54f9f2d995ca3e42b9f9044a36943c6f.tmp to <Current directory>\api-ms-win-core-debug-l1-1-0.dll
from <Current directory>\$dpx$.tmp\0b60cb843c3f2649a23a77a61406c7ec.tmp to <Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
from <Current directory>\$dpx$.tmp\fd8b0710cce2fa47a25ef739606e6038.tmp to <Current directory>\api-ms-win-core-file-l1-1-0.dll
from <Current directory>\$dpx$.tmp\fab338aa1032e14b8459a0e0f48296ff.tmp to <Current directory>\api-ms-win-core-file-l1-2-0.dll
from <Current directory>\$dpx$.tmp\969cf25cae6e0c45be785d964eaac88a.tmp to <Current directory>\api-ms-win-core-file-l2-1-0.dll
from <Current directory>\$dpx$.tmp\1a8a4f6e708824439b2198fee2b9c71c.tmp to <Current directory>\api-ms-win-core-handle-l1-1-0.dll
from <Current directory>\$dpx$.tmp\1db05d87e149a34bb80892ec12add8bb.tmp to <Current directory>\api-ms-win-core-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\2ee7033fb6b5ea4c92d44b4a1b52887a.tmp to <Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
from <Current directory>\$dpx$.tmp\88e9579fb153a648863a5431068c084a.tmp to <Current directory>\api-ms-win-core-datetime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\5555ed656737474283a598be301e68e3.tmp to <Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
from <Current directory>\$dpx$.tmp\d5fec51793e9ff429a5f3977f3b94f29.tmp to <Current directory>\api-ms-win-core-memory-l1-1-0.dll
from <Current directory>\$dpx$.tmp\369758d654ead14a9d1238801b6ecbe7.tmp to <Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c5833b4723e73242a3c7f4226f9c7330.tmp to <Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\3c5c819cbba3e049a62aa5a62c939fdd.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
from <Current directory>\$dpx$.tmp\9f5accfff81e4543a97d536c9682beeb.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
from <Current directory>\$dpx$.tmp\f4340180aeb07247bb634ada7dad199e.tmp to <Current directory>\api-ms-win-core-profile-l1-1-0.dll
from <Current directory>\$dpx$.tmp\77faf4ce3d22114aafc65d23c4e25ac0.tmp to <Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
from <Current directory>\$dpx$.tmp\5b86345e665cbb4aba660af359e118b2.tmp to <Current directory>\api-ms-win-core-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\fe2284109fbec248a383a5c2b72fadd8.tmp to <Current directory>\api-ms-win-core-localization-l1-2-0.dll
from <Current directory>\$dpx$.tmp\37785328dd324144874879fcef74924c.tmp to <Current directory>\ucrtbase.dll
from <Current directory>\$dpx$.tmp\bc86af7fdfb8ad4cb300cb39f97ae905.tmp to <Current directory>\vcruntime140.dll

Network activity

TCP

'lp##.abbny.com':443

UDP

DNS ASK lp##.beahh.com
DNS ASK lp##.abbny.com
DNS ASK lp##.haqo.net

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a
'<SYSTEM32>\expand.exe' d.cab -f:* .

Технології

Терміни

Навчання

Міфи

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней