Trojan.DownLoader33.2079

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\Software\Classes\exefile\shell\open\command] '' = '%WINDIR%\svchost.com "%1" %*'
[<HKCU>\software\microsoft\windows\currentversion\run] 'scripts' = 'wscript.exe //B "%APPDATA%\scripts.js"'
[<HKLM>\software\Wow6432Node\microsoft\windows\currentversion\run] 'scripts' = 'wscript.exe //B "%APPDATA%\scripts.js"'

Creates or modifies the following files

%APPDATA%\microsoft\windows\start menu\programs\startup\windows defender.vbs
%APPDATA%\microsoft\windows\start menu\programs\startup\scripts.js

Infects the following executable files

C:\far2\far.exe
%ProgramFiles(x86)%\Mozilla Thunderbird\maintenanceservice_installer.exe
%ProgramFiles(x86)%\Mozilla Thunderbird\maintenanceservice.exe
%ProgramFiles(x86)%\Mozilla Thunderbird\crashreporter.exe
%ProgramFiles(x86)%\Mozilla Firefox\wow_helper.exe
%ProgramFiles(x86)%\Mozilla Firefox\webapprt-stub.exe
%ProgramFiles(x86)%\Mozilla Firefox\webapp-uninstaller.exe
%ProgramFiles(x86)%\Mozilla Firefox\updater.exe
%ProgramFiles(x86)%\Mozilla Firefox\uninstall\helper.exe
%ProgramFiles(x86)%\Mozilla Firefox\plugin-hang-ui.exe
%ProgramFiles(x86)%\Mozilla Firefox\plugin-container.exe
%ProgramFiles(x86)%\Mozilla Firefox\maintenanceservice_installer.exe
%ProgramFiles(x86)%\Mozilla Firefox\maintenanceservice.exe
%ProgramFiles(x86)%\Mozilla Firefox\crashreporter.exe
%ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\disco.exe
%ProgramFiles(x86)%\mIRC\uninstall.exe
%ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\GuiDebug\DbgCLR.exe
%ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\xsd.exe
%ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\wsdl.exe
%ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\WinRes.exe
%ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\WinCV.exe
%ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\sn.exe
%ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\setreg.exe
%ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\PEVerify.exe
%ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\PermView.exe
%ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\nmake.exe
%ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\mscordmp.exe
%ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\Jbimp.exe
%ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\ildasm.exe
%ProgramFiles(x86)%\mIRC\mirc.exe
%ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\gacutil.exe
%ProgramFiles(x86)%\Mozilla Thunderbird\thunderbird.exe
%ProgramFiles(x86)%\Steam\bin\x64launcher.exe
%ProgramFiles(x86)%\Steam\uninstall.exe
%ProgramFiles(x86)%\Steam\steamerrorreporter64.exe
%ProgramFiles(x86)%\Steam\streaming_client.exe
%ProgramFiles(x86)%\Steam\steamerrorreporter.exe
%ProgramFiles(x86)%\Steam\Steam.exe
%ProgramFiles(x86)%\Steam\steam\games\appid_6520.exe
%ProgramFiles(x86)%\Steam\steam\games\appid_17340.exe
%ProgramFiles(x86)%\Steam\steam\games\appid_6510.exe
%ProgramFiles(x86)%\Steam\steam\games\appid_17330.exe
%ProgramFiles(x86)%\Steam\steam\games\appid_17300.exe
%ProgramFiles(x86)%\Steam\steam\games\appid_10560.exe
%ProgramFiles(x86)%\Steam\steam\games\appid_10540.exe
%ProgramFiles(x86)%\Steam\GameOverlayUI.exe
%ProgramFiles(x86)%\Mozilla Thunderbird\updater.exe
%ProgramFiles(x86)%\Mozilla Thunderbird\uninstall\helper.exe
%ProgramFiles(x86)%\Steam\bin\wow_helper.exe
%ProgramFiles(x86)%\Steam\bin\steamwebhelper.exe
%ProgramFiles(x86)%\Steam\bin\steamservice.exe
%ProgramFiles(x86)%\Steam\bin\html5app_steam.exe
%ProgramFiles(x86)%\QIP 2012\unins000.exe
%ProgramFiles(x86)%\QIP 2012\qip.exe
%ProgramFiles(x86)%\Pidgin\pidgin.exe
%ProgramFiles(x86)%\Pidgin\pidgin-uninst.exe
%ProgramFiles(x86)%\Opera\launcher.exe
%ProgramFiles(x86)%\Opera\29.0.1795.47\wow_helper.exe
%ProgramFiles(x86)%\Opera\29.0.1795.47\opera_crashreporter.exe
%ProgramFiles(x86)%\Opera\29.0.1795.47\opera_autoupdate.exe
%ProgramFiles(x86)%\Opera\29.0.1795.47\installer.exe
%ProgramFiles(x86)%\Steam\bin\x86launcher.exe
%ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\cordbg.exe
%ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\certmgr.exe
%ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\AxImp.exe
%CommonProgramFiles(x86)%\microsoft shared\VSTO\10.0\VSTOInstaller.exe
%CommonProgramFiles(x86)%\microsoft shared\VS7Debug\vs7jit.exe
%CommonProgramFiles(x86)%\microsoft shared\TextConv\WksConv\Wkconv.exe
%CommonProgramFiles(x86)%\microsoft shared\Help\dexplore.exe
%CommonProgramFiles(x86)%\Java\Java Update\jusched.exe
%CommonProgramFiles(x86)%\Java\Java Update\jucheck.exe
%CommonProgramFiles(x86)%\Java\Java Update\jaureg.exe
%CommonProgramFiles(x86)%\Adobe\ARM\1.0\armsvc.exe
%CommonProgramFiles(x86)%\Adobe\ARM\1.0\AdobeARMHelper.exe
%CommonProgramFiles(x86)%\Adobe\ARM\1.0\AdobeARM.exe
%ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\wow_helper.exe
%ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
%CommonProgramFiles(x86)%\PX Storage Engine\pxcpyi64.exe
%ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe
%ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\Eula.exe
%ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\arh.exe
%ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
%ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe
%ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
%ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
%ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe
%ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
%ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\dwtrig20.exe
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\DW20.EXE
C:\MSOCache\All Users\{90140000-0011-0000-1000-0000000FF1CE}-C\setup.exe
C:\MSOCache\All Users\{90140000-0011-0000-1000-0000000FF1CE}-C\ose.exe
%ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe
%CommonProgramFiles(x86)%\PX Storage Engine\pxhpinst.exe
%CommonProgramFiles(x86)%\PX Storage Engine\pxcpya64.exe
%CommonProgramFiles(x86)%\PX Storage Engine\pxinsa64.exe
%ProgramFiles(x86)%\Microsoft Visual Studio .NET 2003\Vc7\bin\link.exe
%ProgramFiles(x86)%\Google\Update\GoogleUpdate.exe
%ProgramFiles(x86)%\Microsoft Visual Studio .NET 2003\Vc7\bin\cl.exe
%ProgramFiles(x86)%\Microsoft Visual Studio .NET 2003\Common7\Packages\Debugger\ManagedDbgCA.exe
%ProgramFiles(x86)%\Microsoft Office\Office14\MSOHTMED.EXE
%ProgramFiles(x86)%\K-Lite Codec Pack\unins000.exe
%ProgramFiles(x86)%\K-Lite Codec Pack\Tools\SetACL_x86.exe
%ProgramFiles(x86)%\K-Lite Codec Pack\Tools\SetACL_x64.exe
%ProgramFiles(x86)%\K-Lite Codec Pack\Tools\mediainfo.exe
%ProgramFiles(x86)%\K-Lite Codec Pack\Tools\GraphStudioNext64.exe
%ProgramFiles(x86)%\K-Lite Codec Pack\Tools\GraphStudioNext.exe
%ProgramFiles(x86)%\K-Lite Codec Pack\Tools\CodecTweakTool.exe
%ProgramFiles(x86)%\K-Lite Codec Pack\MPC-HC64\mpc-hc64.exe
%ProgramFiles(x86)%\K-Lite Codec Pack\Filters\Haali\gdsmux.exe
%ProgramFiles(x86)%\K-Lite Codec Pack\Filters\Haali\dsmux.exe
%ProgramFiles(x86)%\Google\Update\1.3.26.9\GoogleUpdateWebPlugin.exe
%CommonProgramFiles(x86)%\PX Storage Engine\pxinsi64.exe
%ProgramFiles(x86)%\Google\Update\1.3.26.9\GoogleUpdateSetup.exe
%ProgramFiles(x86)%\Google\Update\1.3.26.9\GoogleUpdateOnDemand.exe
%ProgramFiles(x86)%\Google\Update\1.3.26.9\GoogleUpdateComRegisterShell64.exe
%ProgramFiles(x86)%\Google\Update\1.3.26.9\GoogleUpdateBroker.exe
%ProgramFiles(x86)%\Google\Update\1.3.26.9\GoogleUpdate.exe
%ProgramFiles(x86)%\Google\Update\1.3.26.9\GoogleCrashHandler64.exe
%ProgramFiles(x86)%\Google\Update\1.3.26.9\GoogleCrashHandler.exe
%ProgramFiles(x86)%\Google\Chrome\Application\chrome.exe
%ProgramFiles(x86)%\Google\Chrome\Application\42.0.2311.135\nacl64.exe
%ProgramFiles(x86)%\Google\Chrome\Application\42.0.2311.135\Installer\setup.exe
%ProgramFiles(x86)%\Google\Chrome\Application\42.0.2311.135\Installer\chrmstp.exe
%ProgramFiles(x86)%\Google\Chrome\Application\42.0.2311.135\delegate_execute.exe
%CommonProgramFiles(x86)%\Steam\SteamService.exe
%ProgramFiles(x86)%\Steam\WriteMiniDump.exe
%ProgramFiles(x86)%\Winamp\Elevator.exe

Creates the following files on removable media

<Drive name for removable media>:\scripts.js
<Drive name for removable media>:\background.lnk
<Drive name for removable media>:\hhhlcert.lnk
<Drive name for removable media>:\tunpersonalca1.lnk
<Drive name for removable media>:\irgeek.lnk
<Drive name for removable media>:\systisoft.lnk
<Drive name for removable media>:\investmentbankca_ca8.lnk
<Drive name for removable media>:\ck.lnk
<Drive name for removable media>:\asm.lnk
<Drive name for removable media>:\cbz.lnk
<Drive name for removable media>:\2015-02-patients-topic-work-related-asthma-jobs.lnk
<Drive name for removable media>:\fil_20060629111052.lnk
<Drive name for removable media>:\spib_pima.lnk
<Drive name for removable media>:\2015-02-worms-nanoparticle-toxicity.lnk
<Drive name for removable media>:\video_1.lnk
<Drive name for removable media>:\51.lnk
<Drive name for removable media>:\d0068197bb5a41fea16a220c45390606.lnk
<Drive name for removable media>:\lom602.lnk
<Drive name for removable media>:\64bit_notes.lnk
<Drive name for removable media>:\bg_search_box.lnk
<Drive name for removable media>:\contenttypes.lnk
<Drive name for removable media>:\digest.lnk
<Drive name for removable media>:\swc_2009-03-02.lnk
<Drive name for removable media>:\taxus_baccata.lnk
<Drive name for removable media>:\sioc.lnk
<Drive name for removable media>:\asaprojectcompetition.lnk
<Drive name for removable media>:\roozenedowebinar.lnk
<Drive name for removable media>:\middaugh_keynote.lnk
<Drive name for removable media>:\waterresourcesag.lnk
<Drive name for removable media>:\indogerman2010.lnk
<Drive name for removable media>:\iso27k_isms_implementation_and_certification_process_overview_v2.lnk
<Drive name for removable media>:\hypothyroidism_slides.lnk
<Drive name for removable media>:\file1.lnk
<Drive name for removable media>:\sacs_presentation_sacs_qep_improving_rt_education_final.lnk
<Drive name for removable media>:\accountsreceivable.lnk
<Drive name for removable media>:\ppswamp.lnk
<Drive name for removable media>:\sim_gametheory_to_finance.lnk
<Drive name for removable media>:\video.lnk
<Drive name for removable media>:\7790_preview.lnk
<Drive name for removable media>:\firefly1.lnk
<Drive name for removable media>:\dag2_panel1_320_ref.lnk
<Drive name for removable media>:\spanner.lnk
<Drive name for removable media>:\sdksampleprivdeveloper.lnk
<Drive name for removable media>:\file_p_00000000_1371597592.lnk
<Drive name for removable media>:\holycrosschurchinstructions.lnk
<Drive name for removable media>:\thlps_keeper_mayer_1965.lnk
<Drive name for removable media>:\issi2013_template_for_posters.lnk
<Drive name for removable media>:\applicantform_en.lnk
<Drive name for removable media>:\cveuropeo.lnk
<Drive name for removable media>:\fi51.lnk
<Drive name for removable media>:\pmd.lnk
<Drive name for removable media>:\dotnetfx45_full_setup.lnk
<Drive name for removable media>:\contosoroot_1.lnk
<Drive name for removable media>:\coffee.lnk
<Drive name for removable media>:\dashborder_120.lnk
<Drive name for removable media>:\toolbar.lnk
<Drive name for removable media>:\dashborder_192.lnk
<Drive name for removable media>:\default.lnk
<Drive name for removable media>:\archer.lnk
<Drive name for removable media>:\military_callsigns_0311.lnk
<Drive name for removable media>:\metac.lnk
<Drive name for removable media>:\jre-7u75-windows-i586-iftw.lnk
<Drive name for removable media>:\tree_view.lnk
<Drive name for removable media>:\hadac_newsletter_july_2010_final.lnk
<Drive name for removable media>:\scan.lnk
<Drive name for removable media>:\etc6_m_1.lnk
<Drive name for removable media>:\210252809.lnk
<Drive name for removable media>:\2.lnk
<Drive name for removable media>:\parnas_01.lnk
<Drive name for removable media>:\13.lnk
<Drive name for removable media>:\168.lnk
<Drive name for removable media>:\1189.lnk
<Drive name for removable media>:\region-north-karelia.lnk
<Drive name for removable media>:\pushkin.lnk
<Drive name for removable media>:\ituneshelpunavailable.lnk
<Drive name for removable media>:\browse.lnk
<Drive name for removable media>:\howto-index.lnk
<Drive name for removable media>:\alert.lnk
<Drive name for removable media>:\api-hashmap.lnk
<Drive name for removable media>:\about.lnk
<Drive name for removable media>:\iisstart.lnk
<Drive name for removable media>:\fungalnameauthors.lnk

Modifies file system

Creates the following files

%TEMP%\nsha376.tmp
%APPDATA%\list.vbe
%APPDATA%\ndch.vbe
%APPDATA%\reverse.vbe
%APPDATA%\snp.vbs
%APPDATA%\scripts.js
%APPDATA%\[2020] amazon gift card code generator + checker [cracked] [hq] [very fast].exe
%TEMP%\3582-490\[2020] amazon gift card code generator + checker [cracked] [hq] [very fast].exe
%WINDIR%\svchost.com
%WINDIR%\directx.sys

Sets the 'hidden' attribute to the following files

<Drive name for removable media>:\scripts.js

Deletes the following files

%WINDIR%\svchost.com

Miscellaneous

Creates and executes the following

'%WINDIR%\syswow64\wscript.exe' "%APPDATA%\list.vbe"
'%WINDIR%\syswow64\wscript.exe' "%APPDATA%\ndch.vbe"
'%WINDIR%\syswow64\wscript.exe' "%APPDATA%\reverse.vbe"
'%WINDIR%\syswow64\wscript.exe' "%APPDATA%\Snp.vbs"
'%WINDIR%\syswow64\wscript.exe' "%APPDATA%\scripts.js"
'%APPDATA%\[2020] amazon gift card code generator + checker [cracked] [hq] [very fast].exe'
'%TEMP%\3582-490\[2020] amazon gift card code generator + checker [cracked] [hq] [very fast].exe'
'%WINDIR%\svchost.com' "<SYSTEM32>\WINDOW~1\v1.0\powershell.exe" -noexit -en WwBBAHAAcABEAG8AbQBhAGkAbgBdADoAOgAoACcAPwB1AHIAcgBlAG4AdABAAG8AbQBhAGkAbgAnAC4AcgBlAHAAbABhAGMAZQAoACcAPwAnACwAJwBDACcAKQAuAHIAZQBwAGwAYQB...
'%WINDIR%\svchost.com' "<SYSTEM32>\WINDOW~1\v1.0\powershell.exe" -noexit -en WwBBAHAAcABEAG8AbQBhAGkAbgBdADoAOgAoACcAPwB1AHIAcgBlAG4AdABAAG8AbQBhAGkAbgAnAC4AcgBlAHAAbABhAGMAZQAoACcAPwAnACwAJwBDACcAKQAuAHIAZQBwAGwAYQB...' (with hidden window)

Технології

Терміни

Навчання

Міфи

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней