Trojan.Carberp.2677

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

<SYSTEM32>\tasks\nvngxupdatecheckdaily_{78821544-1544-1544-1544-788215441544}

Malicious functions

Injects code into

the following system processes:

%WINDIR%\microsoft.net\framework\v4.0.30319\addinprocess32.exe

the following user processes:

7d0e.tmp.exe

Reads files which store third party applications passwords

%LOCALAPPDATA%\google\chrome\user data\default\login data
%LOCALAPPDATA%\google\chrome\user data\default\web data
%LOCALAPPDATA%\google\chrome\user data\default\cookies
%APPDATA%\opera software\opera stable\login data

Modifies file system

Creates the following files

%TEMP%\4dd3.tmp
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-crt-utility-l1-1-0.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-crt-time-l1-1-0.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-crt-string-l1-1-0.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-crt-stdio-l1-1-0.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-crt-runtime-l1-1-0.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-crt-process-l1-1-0.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-crt-private-l1-1-0.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-crt-multibyte-l1-1-0.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-crt-math-l1-1-0.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-crt-locale-l1-1-0.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-file-l1-2-0.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-crt-heap-l1-1-0.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-crt-environment-l1-1-0.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-crt-convert-l1-1-0.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-crt-conio-l1-1-0.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-util-l1-1-0.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-timezone-l1-1-0.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-sysinfo-l1-1-0.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-synch-l1-2-0.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-synch-l1-1-0.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-string-l1-1-0.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-rtlsupport-l1-1-0.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-crt-filesystem-l1-1-0.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-file-l2-1-0.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-handle-l1-1-0.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-heap-l1-1-0.dll
%TEMP%\23af.tmp.exe
%APPDATA%\edgecp\microsoftedgecps.exe
%ALLUSERSPROFILE%\q2u1v8x1w0u1v8x1w0\igec10xurec9.ige
%TEMP%\1231.tmp.exe
%TEMP%\f7cd.tmp.exe
%LOCALAPPDATA%low\wxxth3wdmxm.zip
%LOCALAPPDATA%low\machineinfo.txt
%TEMP%\e1eb.tmp.exe
%TEMP%\db17.tmp.exe
%LOCALAPPDATA%low\5gmvdu0xn-shm
%LOCALAPPDATA%low\5gmvdu0xn
%LOCALAPPDATA%low\gksx9feji-shm
%LOCALAPPDATA%low\gksx9feji
%LOCALAPPDATA%low\firefox_urls.txt
%LOCALAPPDATA%low\mehizbf0a-shm
%LOCALAPPDATA%low\mehizbf0a
%TEMP%\b177.tmp.exe
%LOCALAPPDATA%low\fraqbc8ws-shm
%LOCALAPPDATA%low\fraqbc8ws
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-memory-l1-1-0.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-localization-l1-2-0.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-libraryloader-l1-1-0.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-interlocked-l1-1-0.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-profile-l1-1-0.dll
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\microsoftedgecps.lnk
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-processthreads-l1-1-1.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-processenvironment-l1-1-0.dll
%ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
%ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
%TEMP%\nsx83d0.tmp\system.dll
%APPDATA%\55292128
%APPDATA%\microsoft\windows\start menu\programs\zsadsadsad\dsffffffdd.lnk
%APPDATA%\microsoft\windows\start menu\programs\zsadsadsad\qasdadsdsd.lnk
%LOCALAPPDATA%low\bbsqwy6yhk
%LOCALAPPDATA%low\gxix4a2dre
%LOCALAPPDATA%low\exuieaoeii
%LOCALAPPDATA%low\3solbph71y
%ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
%LOCALAPPDATA%low\x3cf3ednhm
%LOCALAPPDATA%low\rywtiizs2t
%LOCALAPPDATA%low\1xvpfvjcrg
%LOCALAPPDATA%low\fraqbc8wsa
%TEMP%\7d0e.tmp.exe
%LOCALAPPDATA%low\sqlite3.dll
%TEMP%\76b7.tmp.exe
%TEMP%\6b60.tmp.exe
%TEMP%\5a5f.tmp.exe
%APPDATA%\cwufceu
%APPDATA%\ervdhug
%LOCALAPPDATA%low\rqf69azbla
%LOCALAPPDATA%\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\ih7oe4ur9pw5zj0o.zip
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\nssdbm3.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-namedpipe-l1-1-0.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\nssckbi.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\nss3.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\msvcp140.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\mozmapi32_inuse.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\mozmapi32.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\mozglue.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\mapiproxy_inuse.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\mapiproxy.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\libegl.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\lgpllibs.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\ldif60.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\ldap60.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\ia2marshal.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\freebl3.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\breakpadinjector.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\accessiblemarshal.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\accessiblehandler.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\vcruntime140.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\ucrtbase.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\softokn3.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\qipcap.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\prldap60.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-processthreads-l1-1-0.dll
%APPDATA%\edgecp\id.conf

Sets the 'hidden' attribute to the following files

%APPDATA%\ervdhug
%APPDATA%\cwufceu

Deletes the following files

%LOCALAPPDATA%low\fraqbc8wsa
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-crt-time-l1-1-0.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-crt-string-l1-1-0.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-crt-stdio-l1-1-0.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-crt-runtime-l1-1-0.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-crt-process-l1-1-0.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-crt-private-l1-1-0.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-crt-multibyte-l1-1-0.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-crt-utility-l1-1-0.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-crt-math-l1-1-0.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-crt-heap-l1-1-0.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-crt-filesystem-l1-1-0.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-crt-environment-l1-1-0.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-crt-convert-l1-1-0.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-crt-conio-l1-1-0.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-util-l1-1-0.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-timezone-l1-1-0.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-crt-locale-l1-1-0.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\breakpadinjector.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\freebl3.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\ia2marshal.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\ucrtbase.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\softokn3.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\qipcap.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\prldap60.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\nssdbm3.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\nssckbi.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\nss3.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\msvcp140.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\mozmapi32_inuse.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\mozmapi32.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\mozglue.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\mapiproxy_inuse.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\mapiproxy.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\libegl.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\lgpllibs.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\ldif60.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\ldap60.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-sysinfo-l1-1-0.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\vcruntime140.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-synch-l1-2-0.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-string-l1-1-0.dll
%LOCALAPPDATA%low\5gmvdu0xn-shm
%LOCALAPPDATA%low\gksx9feji
%LOCALAPPDATA%low\gksx9feji-shm
%LOCALAPPDATA%low\mehizbf0a
%LOCALAPPDATA%low\mehizbf0a-shm
%LOCALAPPDATA%low\fraqbc8ws
%LOCALAPPDATA%low\fraqbc8ws-shm
%LOCALAPPDATA%low\5gmvdu0xn
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\ih7oe4ur9pw5zj0o.zip
%LOCALAPPDATA%low\gxix4a2dre
%LOCALAPPDATA%low\exuieaoeii
%LOCALAPPDATA%low\3solbph71y
%LOCALAPPDATA%low\x3cf3ednhm
%LOCALAPPDATA%low\rqf69azbla
%LOCALAPPDATA%low\rywtiizs2t
%LOCALAPPDATA%low\1xvpfvjcrg
%LOCALAPPDATA%low\bbsqwy6yhk
%ALLUSERSPROFILE%\q2u1v8x1w0u1v8x1w0\igec10xurec9.ige
%LOCALAPPDATA%low\wxxth3wdmxm.zip
%LOCALAPPDATA%low\firefox_urls.txt
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-rtlsupport-l1-1-0.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-profile-l1-1-0.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-processthreads-l1-1-1.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-processthreads-l1-1-0.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-processenvironment-l1-1-0.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-namedpipe-l1-1-0.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-memory-l1-1-0.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-localization-l1-2-0.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-libraryloader-l1-1-0.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-interlocked-l1-1-0.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-heap-l1-1-0.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-handle-l1-1-0.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-file-l2-1-0.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-file-l1-2-0.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\accessiblemarshal.dll
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\accessiblehandler.dll
%LOCALAPPDATA%low\machineinfo.txt
%LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-synch-l1-1-0.dll
%LOCALAPPDATA%low\sqlite3.dll

Substitutes the following files

%ALLUSERSPROFILE%\q2u1v8x1w0u1v8x1w0\igec10xurec9.ige

Deletes itself.

Network activity

Connects to

'si####salabim.top':443
'sk#.#huua.ru':443
'80.##.245.80':80
'a.###ganfor.ru':443
'3x##.oradza.ru':443
'17#.#0.40.83':81
'18#.#93.88.150':80
'te##te.in':443
'94.##3.94.198':3214
'xt#.#radza.ru':443

TCP

HTTP GET requests

http://10############6831-service1002012510022020.space/raccon.exe
http://10############6831-service1002012510022020.space/reestr.exe

HTTP POST requests

http://10###########lder1002002131-service1002.space/
http://10##########older33417-01242510022020.space/
http://10############6831-service1002012510022020.space/
http://80.##.245.80/log/
http://94.###.94.198:3214/ via 94.##3.94.198
http://17#.#0.40.83:81/ via 17#.#0.40.83

'te##te.in':443

'si####salabim.top':443

'sk#.#huua.ru':443

UDP

DNS ASK 10###########lder1002002131-service1002.space
DNS ASK 10###########lder1002002231-service1002.space
DNS ASK 10##########older3100231-service1002.space
DNS ASK 10###########lder1002002431-service1002.space
DNS ASK 10###########lder1002002531-service1002.space
DNS ASK 10##########older33417-01242510022020.space
DNS ASK 10############5831-service1002012510022020.space
DNS ASK 10############6831-service1002012510022020.space
DNS ASK te##te.in
DNS ASK si####salabim.top
DNS ASK sk#.#huua.ru
DNS ASK a.###ganfor.ru
DNS ASK 3x##.oradza.ru
DNS ASK xt#.#radza.ru

Miscellaneous

Creates and executes the following

'%TEMP%\5a5f.tmp.exe'
'%TEMP%\6b60.tmp.exe'
'%TEMP%\76b7.tmp.exe'
'%TEMP%\7d0e.tmp.exe'
'%TEMP%\b177.tmp.exe'
'%TEMP%\db17.tmp.exe'
'%TEMP%\e1eb.tmp.exe'
'%TEMP%\f7cd.tmp.exe'
'%TEMP%\1231.tmp.exe'
'%TEMP%\23af.tmp.exe'
'%APPDATA%\edgecp\microsoftedgecps.exe'
'%APPDATA%\edgecp\microsoftedgecps.exe' ' (with hidden window)
'%WINDIR%\syswow64\wbem\wmic.exe' /Node:localhost /Namespace:\\root\SecurityCenter2 path AntiVirusProduct get DisplayName /FORMAT:List' (with hidden window)

Executes the following

'%WINDIR%\microsoft.net\framework\v4.0.30319\addinprocess32.exe'
'%WINDIR%\syswow64\wbem\wmic.exe' /Node:localhost /Namespace:\\root\SecurityCenter2 path AntiVirusProduct get DisplayName /FORMAT:List
'%WINDIR%\syswow64\explorer.exe'
'%WINDIR%\explorer.exe'

Технології

Терміни

Навчання

Міфи

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней