Trojan.DownLoader33.49472

Добавлен в вирусную базу Dr.Web: 2020-06-03

Описание добавлено: 2020-06-05

Technical Information

Modifies file system

Creates the following files

<Current directory>\bunifu_ui_v1.5.3.dll
<Current directory>\scripts\infinite yield.lua
<Current directory>\scripts\httpget rosehub.txt
<Current directory>\scripts\gscxt0k2.txt
<Current directory>\scripts\gscxt0k2 (2).txt
<Current directory>\scripts\gscxt0k2 (1).txt
<Current directory>\scripts\grab knife v3.txt
<Current directory>\scripts\godarc.txt
<Current directory>\scripts\g7t4hrju.txt
<Current directory>\scripts\firesal sword.txt
<Current directory>\scripts\fe animation.txt
<Current directory>\scripts\fantastic frontier.lua
<Current directory>\scripts\dzvv9agg.txt
<Current directory>\scripts\dexv4.lua
<Current directory>\scripts\dexbypassed.lua
<Current directory>\scripts\dex explorer.txt
<Current directory>\scripts\dex explorer.lua
<Current directory>\scripts\darkdex.lua
<Current directory>\scripts\dark titanreborn.txt
<Current directory>\scripts\crimson sont.txt
<Current directory>\scripts\crazy shotgun.txt
<Current directory>\scripts\cortex_gui.txt
<Current directory>\scripts\cbro_bypassrac.lua
<Current directory>\scripts\bubble gum simulator gui.txt
<Current directory>\scripts\blackjack nightwing.txt
<Current directory>\scripts\big smoke 2.0.txt
<Current directory>\scripts\best saveinstance.lua
<Current directory>\scripts\baldi.txt
<Current directory>\scripts\anime.txt
<Current directory>\scripts\admin_for_auto_rap_suxxxx.txt
<Current directory>\scripts\infinite yield.txt
<Current directory>\scripts\kirito dual swords.txt
<Current directory>\bin\monaco\vs\monaconet.dll
<Current directory>\scripts\l0gbxnfl.txt
<Current directory>\bin\monaco\vs\loader.js
<Current directory>\bin\monaco\vs\editor\standalone\browser\quickopen\symbol-sprite.svg
<Current directory>\bin\monaco\vs\editor\editor.main.nls.zh-tw.js
<Current directory>\bin\monaco\vs\editor\editor.main.nls.zh-cn.js
<Current directory>\bin\monaco\vs\editor\editor.main.nls.ru.js
<Current directory>\bin\monaco\vs\editor\editor.main.nls.ko.js
<Current directory>\bin\monaco\vs\editor\editor.main.nls.js
<Current directory>\bin\monaco\vs\editor\editor.main.nls.ja.js
<Current directory>\bin\monaco\vs\editor\editor.main.nls.it.js
<Current directory>\bin\monaco\vs\editor\editor.main.nls.fr.js
<Current directory>\bin\monaco\vs\editor\editor.main.nls.es.js
<Current directory>\bin\monaco\vs\editor\editor.main.nls.de.js
<Current directory>\bin\monaco\vs\editor\editor.main.js
<Current directory>\bin\monaco\vs\editor\editor.main.css
<Current directory>\bin\monaco\vs\editor\contrib\suggest\media\string_inverse_16x.svg
<Current directory>\bin\monaco\vs\editor\contrib\suggest\media\string_16x.svg
<Current directory>\bin\monaco\vs\basic-languages\lua\lua.js
<Current directory>\bin\monaco\vs\base\worker\workermain.js
<Current directory>\bin\monaco\monaco.html
<Current directory>\temporary.core
<Current directory>\scripts\print.txt
<Current directory>\scripts\penis.txt
<Current directory>\scripts\one_punch_man_(leaked).._(again).txt
<Current directory>\scripts\nnhwsget.txt
<Current directory>\scripts\mr.spy.lua
<Current directory>\scripts\mr.spy v2.txt
<Current directory>\scripts\m4.txt
<Current directory>\scripts\long gauntlet ninja blade.txt
<Current directory>\scripts\--leaked_by_leakingproscripts_--modfied_by_xfxllen_local_p_=.txt
<Current directory>\scripts\2pzftxgg.txt
<Current directory>\scripts\jr8b2z4e.txt
<Current directory>\scripts\1.txt
<Current directory>\scripts\walkspeed.txt
<Current directory>\scripts\vndbubpz.txt
<Current directory>\scripts\vehicle simulator autofarm.lua
<Current directory>\scripts\universalruler.txt
<Current directory>\scripts\universal aimbot.txt
<Current directory>\scripts\topkek workings.txt
<Current directory>\scripts\tf8zhz4w.txt
<Current directory>\scripts\test.lua
<Current directory>\scripts\techno blade.txt
<Current directory>\scripts\swordburst_2_autofarmer.lua
<Current directory>\scripts\sword of a fallen god.txt
<Current directory>\scripts\sponchebob.txt
<Current directory>\scripts\shadow armor.txt
<Current directory>\scripts\saveinstance.lua
<Current directory>\scripts\savegame.txt
<Current directory>\scripts\rpk.txt
<Current directory>\scripts\rovive_noloadstring.lua
<Current directory>\scripts\rovive_aimbot.lua
<Current directory>\scripts\roexploit.txt
<Current directory>\scripts\remote grabber.txt
<Current directory>\scripts\realistic roleplay gui.lua
<Current directory>\scripts\rbworldaimbot.lua
<Current directory>\scripts\rains weed.txt
<Current directory>\script.core
<Current directory>\easyexploits.dll
<Current directory>\nemesisapi.dll
<Current directory>\e2_api.dll
<Current directory>\serverdata\currentversion.core
<Current directory>\fastcoloredtextbox.dll
<Current directory>\guna.ui.dll
<Current directory>\scripts\walkspeed & jumppower all.txt
<Current directory>\scripts\warhammer_script.txt
<Current directory>\scripts\[fe] tornado player.txt
<Current directory>\scripts\wcpee5z7.txt
<Current directory>\scripts\[fe] teleport.txt
<Current directory>\scripts\[fe] suicide gun.txt
<Current directory>\scripts\[fe] spaz local.txt
<Current directory>\scripts\[fe] spasm.txt
<Current directory>\scripts\[fe] shutdown.txt
<Current directory>\scripts\[fe] shoulder ride [press e].txt
<Current directory>\scripts\[fe] s3x.txt
<Current directory>\scripts\[fe] respawn.txt
<Current directory>\scripts\[fe] oof.txt
<Current directory>\scripts\[fe] limb merger.txt
<Current directory>\scripts\[fe] kill [need tools].txt
<Current directory>\scripts\[fe] kfc.txt
<Current directory>\scripts\[fe] invisible.txt
<Current directory>\scripts\[fe] hammer.txt
<Current directory>\scripts\[fe] god.txt
<Current directory>\scripts\[fe] funny.txt
<Current directory>\scripts\[fe] freeze.txt
<Current directory>\scripts\[fe] fly [press e].txt
<Current directory>\scripts\[fe] flood script.txt
<Current directory>\scripts\[fe] fling (r15).txt
<Current directory>\scripts\[fe] fling (r6).txt
<Current directory>\scripts\[fe] double jump.txt
<Current directory>\scripts\[fe] dab.txt
<Current directory>\scripts\[fe] dab all.txt
<Current directory>\scripts\[fe] cmd.txt
<Current directory>\scripts\[fe] click tp tool.txt
<Current directory>\scripts\[fe] bring [need tools].txt
<Current directory>\scripts\zen shooter.txt
<Current directory>\scripts\whnfpggp.txt
<Current directory>\scripts\1 (2).txt
%LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012020060320200604\index.dat

Deletes the following files

<Current directory>\temporary.core
<Current directory>\script.core

Network activity

TCP

HTTP GET requests

http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt

'cd#.##scordapp.com':443

'ft###load.net':21

'di##ord.gg':443

'pa###bin.com':443

'di##ord.com':443

UDP

DNS ASK cd#.##scordapp.com
DNS ASK microsoft.com
DNS ASK ft###load.net
DNS ASK di##ord.gg
DNS ASK pa###bin.com
DNS ASK di##ord.com

Miscellaneous

Searches for the following windows

ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebCheckMonitor' WindowName: ''
ClassName: 'DDEMLMom' WindowName: ''
ClassName: 'IEFrame' WindowName: ''
ClassName: 'Static' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней