Trojan.DownLoader25.64163

Technical Information

Malicious functions:

Creates and executes the following:

'%ProgramFiles%\CloudPOS\CloudPOS.exe'

Modifies settings of Windows Internet Explorer:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1609' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '1609' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1609' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] '1609' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1609' = '00000000'

Modifies file system:

Creates the following files:

%ProgramFiles%\CloudPOS\CloudSignaturePad.exe
%ProgramFiles%\CloudPOS\content.data
%ProgramFiles%\CloudPOS\Transaction.dll
%ProgramFiles%\CloudPOS\MSEnum.dll
%ProgramFiles%\CloudPOS\Peripheral.dll
%ProgramFiles%\CloudPOS\PADID
%ProgramFiles%\CloudPOS\content\font.css
%ProgramFiles%\CloudPOS\content\index.html
%ProgramFiles%\CloudPOS\content\backstretch.js
%ProgramFiles%\CloudPOS\content\Oswald-Bold.ttf
%ProgramFiles%\CloudPOS\content\Oswald-Regular.ttf
%WINDIR%\DatacapControls\dsiEMVX.ocx
%WINDIR%\DatacapControls\dsiPDCX.ocx
%ProgramFiles%\CloudPOS\Interop.DSIEMVXLib.dll
%ProgramFiles%\CloudPOS\polaris.cer
%ProgramFiles%\CloudPOS\Interop.DSIPDCXLib.dll
%ProgramFiles%\CloudPOS\Common.dll
%ProgramFiles%\CloudPOS\MPS.POS.Utils.dll
%ProgramFiles%\CloudPOS\MPS.TranSentry.Component.dll
%ProgramFiles%\CloudPOS\MercuryShield.dll
%ProgramFiles%\CloudPOS\DSITransaction.dll
%ProgramFiles%\CloudPOS\IPADLib.dll
%ProgramFiles%\CloudPOS\content\jSignature.min.js
%TEMP%\Cab12.tmp
%TEMP%\Cab14.tmp
%TEMP%\Cab10.tmp
%TEMP%\CabC.tmp
%TEMP%\CabE.tmp
%TEMP%\Cab16.tmp
%TEMP%\Cab1E.tmp
%TEMP%\Cab20.tmp
%TEMP%\Cab1C.tmp
%TEMP%\Cab18.tmp
%TEMP%\Cab1A.tmp
%ProgramFiles%\CloudPOS\content\screen_600.css
%ProgramFiles%\CloudPOS\content\screen_800.css
%ProgramFiles%\CloudPOS\content\screen_400.css
%ProgramFiles%\CloudPOS\content\jquery-1.11.2.min.js
%ProgramFiles%\CloudPOS\content\library.js
%ProgramFiles%\CloudPOS\POSRemoteHelp2.exe
%TEMP%\Cab8.tmp
%TEMP%\CabA.tmp
%TEMP%\Cab6.tmp
%ProgramFiles%\CloudPOS\POSRemoteHelper.exe
%TEMP%\Cab4.tmp
%ProgramFiles%\CloudPOS\PAXPOSLink.dll
%ProgramFiles%\CloudPOS\PaymentSimulator.dll
%ProgramFiles%\CloudPOS\MWGenius.dll
%ProgramFiles%\CloudPOS\CloudGift.dll
%ProgramFiles%\CloudPOS\ValuTec.dll
%ProgramFiles%\CloudPOS\MercuryTransentry.dll
%ProgramFiles%\CloudPOS\icon_help.ico
%ProgramFiles%\CloudPOS\icon_internet.ico
%ProgramFiles%\CloudPOS\VERSION
%ProgramFiles%\CloudPOS\DatacapPDCX.dll
%ProgramFiles%\CloudPOS\POSRemoteHelp.exe
%ProgramFiles%\CloudPOS\CreditCard.dll
%ProgramFiles%\CloudPOS\daReport.dll
%ProgramFiles%\CloudPOS\ConfigurationManager.dll
%TEMP%\nsu2.tmp
%ProgramFiles%\CloudPOS\AutoUpdate.exe
%ProgramFiles%\CloudPOS\POSHardware.dll
%ProgramFiles%\CloudPOS\DBSystem.dll
%ProgramFiles%\CloudPOS\InternetChecker.exe
%ProgramFiles%\CloudPOS\PolarisProxyServer2.dll
%ProgramFiles%\CloudPOS\WinTool.dll
%ProgramFiles%\CloudPOS\CloudPOS.exe
%ProgramFiles%\CloudPOS\icon_reset.ico
%ProgramFiles%\CloudPOS\cash_reg.wav
%ProgramFiles%\CloudPOS\complete.wav
%ProgramFiles%\CloudPOS\reminder.wav
%ProgramFiles%\CloudPOS\done.wav
%ProgramFiles%\CloudPOS\delete.wav
%ProgramFiles%\CloudPOS\option.wav
%ProgramFiles%\CloudPOS\aws_root.cer
%ProgramFiles%\CloudPOS\aws_chain.cer
%ProgramFiles%\CloudPOS\star_chain.cer
%ProgramFiles%\CloudPOS\reinstall.js
%ProgramFiles%\CloudPOS\star_root.cer
%ProgramFiles%\CloudPOS\POSLink.dll
%ProgramFiles%\CloudPOS\JETCOMP.exe
%ProgramFiles%\CloudPOS\ThoughtWorks.QRCode.dll
%ProgramFiles%\CloudPOS\icon_download.ico
%ProgramFiles%\CloudPOS\BarcodeLib.dll
%ProgramFiles%\CloudPOS\Newtonsoft.Json.dll
%ProgramFiles%\CloudPOS\confirm.wav
%ProgramFiles%\CloudPOS\good.wav
%ProgramFiles%\CloudPOS\alert.wav
%ProgramFiles%\CloudPOS\System.Data.SQLite.dll
%ProgramFiles%\CloudPOS\ITapi3.dll

Deletes the following files:

%TEMP%\Cab16.tmp
%TEMP%\Cab18.tmp
%TEMP%\Cab12.tmp
%TEMP%\Cab14.tmp
%TEMP%\Cab1E.tmp
%TEMP%\Cab20.tmp
%TEMP%\Cab1A.tmp
%TEMP%\Cab1C.tmp
%TEMP%\Cab10.tmp
%TEMP%\Cab4.tmp
%TEMP%\Cab6.tmp
%TEMP%\nsk3.tmp\nsProcess.dll
%TEMP%\nsk3.tmp\System.dll
%TEMP%\CabC.tmp
%TEMP%\CabE.tmp
%TEMP%\Cab8.tmp
%TEMP%\CabA.tmp

Network activity:

Connects to:

'www.download.windowsupdate.com':80
'ca#####.digicert.com':80
'wp#d':80

TCP:

HTTP GET requests:

http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
http://11#.#11.111.1/wpad.dat via wp#d
http://ca#####.digicert.com/DigiCertAssuredIDRootCA.crt

UDP: