Trojan.DownLoader25.22266

Technical Information

To ensure autorun and distribution:

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\HideIPLaucherService] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\HideIPLaucherService] 'ImagePath' = '%ProgramFiles%\Hide ALL IP\LauncherService.exe'

Malicious functions:

Creates and executes the following:

'%ProgramFiles%\Hide ALL IP\LauncherService.exe' start nolaunchanyfile.txt
'%ProgramFiles%\Hide ALL IP\LauncherService.exe'
'%CommonProgramFiles%\~exnerog.tmp' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
'%TEMP%\is-LFJL3.tmp\~exnerog.tmp' /SL5="$100E0,4408957,56832,%CommonProgramFiles%\~exnerog.tmp" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-

Executes the following:

'<SYSTEM32>\net.exe' start HideIPLaucherService
'<SYSTEM32>\net1.exe' start HideIPLaucherService
'<SYSTEM32>\net.exe' stop HideIPLaucherService
'<SYSTEM32>\net1.exe' stop HideIPLaucherService

Modifies file system:

Creates the following files:

%ProgramFiles%\Hide ALL IP\is-J6E99.tmp
%ProgramFiles%\Hide ALL IP\is-OVVHL.tmp
%ProgramFiles%\Hide ALL IP\is-AA2GM.tmp
%ProgramFiles%\Hide ALL IP\is-3KERL.tmp
%ProgramFiles%\Hide ALL IP\is-UKCEV.tmp
%ProgramFiles%\Hide ALL IP\is-4VPB2.tmp
%ProgramFiles%\Hide ALL IP\is-K8I0P.tmp
%ALLUSERSPROFILE%\Desktop\Hide ALL IP.lnk
%ProgramFiles%\Hide ALL IP\unins000.msg
%ProgramFiles%\Hide ALL IP\unins000.dat
%ALLUSERSPROFILE%\Start Menu\Programs\Hide ALL IP\Uninstall Hide ALL IP.lnk
%ProgramFiles%\Hide ALL IP\is-SDOM3.tmp
%ProgramFiles%\Hide ALL IP\is-M8K4E.tmp
%ALLUSERSPROFILE%\Start Menu\Programs\Hide ALL IP\Hide ALL IP.lnk
%ProgramFiles%\Hide ALL IP\is-3CPLR.tmp
%ProgramFiles%\Hide ALL IP\is-P063V.tmp
%ProgramFiles%\Hide ALL IP\is-EGNDR.tmp
%ProgramFiles%\Hide ALL IP\is-O0FUM.tmp
%TEMP%\aut1.tmp
%CommonProgramFiles%\~exnerog.tmp
%ProgramFiles%\Hide ALL IP\is-84P1G.tmp
%ProgramFiles%\Hide ALL IP\is-SGG4S.tmp
%ProgramFiles%\Hide ALL IP\is-RGF2S.tmp
%ProgramFiles%\Hide ALL IP\is-S2NB0.tmp
%ProgramFiles%\Hide ALL IP\is-DJJ4O.tmp
%ProgramFiles%\Hide ALL IP\is-JSLFB.tmp
%ProgramFiles%\Hide ALL IP\is-BEP84.tmp
%ProgramFiles%\Hide ALL IP\is-3INQC.tmp

Sets the 'hidden' attribute to the following files:

%CommonProgramFiles%\~exnerog.tmp

Deletes the following files:

%TEMP%\aut1.tmp

Moves the following files:

from %ProgramFiles%\Hide ALL IP\is-K8I0P.tmp to %ProgramFiles%\Hide ALL IP\networkdllx64.dll
from %ProgramFiles%\Hide ALL IP\is-3KERL.tmp to %ProgramFiles%\Hide ALL IP\bigflags.dat
from %ProgramFiles%\Hide ALL IP\is-4VPB2.tmp to %ProgramFiles%\Hide ALL IP\sntutils.dll
from %ProgramFiles%\Hide ALL IP\is-S2NB0.tmp to %ProgramFiles%\Hide ALL IP\sntx64tool.dll
from %ProgramFiles%\Hide ALL IP\is-UKCEV.tmp to %ProgramFiles%\Hide ALL IP\networkdllx64_L.dll
from %ProgramFiles%\Hide ALL IP\is-SDOM3.tmp to %ProgramFiles%\Hide ALL IP\AutoUpgrade.exe
from %ProgramFiles%\Hide ALL IP\is-M8K4E.tmp to %ProgramFiles%\Hide ALL IP\hideallip.buildnum
from %ProgramFiles%\Hide ALL IP\is-AA2GM.tmp to %ProgramFiles%\Hide ALL IP\cookieintf.dll
from %ProgramFiles%\Hide ALL IP\is-J6E99.tmp to %ProgramFiles%\Hide ALL IP\ipdb.dat
from %ProgramFiles%\Hide ALL IP\is-OVVHL.tmp to %ProgramFiles%\Hide ALL IP\networktunnelx64helper.exe
from %ProgramFiles%\Hide ALL IP\is-RGF2S.tmp to %ProgramFiles%\Hide ALL IP\networkdll.dll
from %ProgramFiles%\Hide ALL IP\is-P063V.tmp to %ProgramFiles%\Hide ALL IP\libeay32.dll
from %ProgramFiles%\Hide ALL IP\is-EGNDR.tmp to %ProgramFiles%\Hide ALL IP\hideallip.dat
from %ProgramFiles%\Hide ALL IP\is-3CPLR.tmp to %ProgramFiles%\Hide ALL IP\ssleay32.dll
from %ProgramFiles%\Hide ALL IP\is-84P1G.tmp to %ProgramFiles%\Hide ALL IP\unins000.exe
from %ProgramFiles%\Hide ALL IP\is-O0FUM.tmp to %ProgramFiles%\Hide ALL IP\networkdll_L.dll
from %ProgramFiles%\Hide ALL IP\is-DJJ4O.tmp to %ProgramFiles%\Hide ALL IP\networktunnelx64.sys
from %ProgramFiles%\Hide ALL IP\is-SGG4S.tmp to %ProgramFiles%\Hide ALL IP\networkdlllsp.dll
from %ProgramFiles%\Hide ALL IP\is-3INQC.tmp to %ProgramFiles%\Hide ALL IP\networktunneldrv.zap
from %ProgramFiles%\Hide ALL IP\is-JSLFB.tmp to %ProgramFiles%\Hide ALL IP\HideAllIP.exe
from %ProgramFiles%\Hide ALL IP\is-BEP84.tmp to %ProgramFiles%\Hide ALL IP\LauncherService.exe