Trojan.DownLoader34.26989

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKCU>\Software\Classes\televzr\shell\open\command] '' = '%LOCALAPPDATA%\televzr_light\Televzr Light.exe "%1"'
[<HKCU>\Software\Classes\mkv\shell\open\command] '' = '%LOCALAPPDATA%\televzr_light\Televzr Light.exe "%1"'
[<HKCU>\Software\Classes\mp4\shell\open\command] '' = '%LOCALAPPDATA%\televzr_light\Televzr Light.exe "%1"'
[<HKCU>\Software\Classes\avi\shell\open\command] '' = '%LOCALAPPDATA%\televzr_light\Televzr Light.exe "%1"'
[<HKCU>\Software\Classes\m4v\shell\open\command] '' = '%LOCALAPPDATA%\televzr_light\Televzr Light.exe "%1"'

Modifies file system

Creates the following files

%TEMP%\nsncd98.tmp\system.dll
%LOCALAPPDATA%\televzr_light\resources.pak
%LOCALAPPDATA%\televzr_light\locales\zh-tw.pak
%LOCALAPPDATA%\televzr_light\locales\zh-cn.pak
%LOCALAPPDATA%\televzr_light\locales\vi.pak
%LOCALAPPDATA%\televzr_light\locales\uk.pak
%LOCALAPPDATA%\televzr_light\locales\tr.pak
%LOCALAPPDATA%\televzr_light\locales\th.pak
%LOCALAPPDATA%\televzr_light\locales\te.pak
%LOCALAPPDATA%\televzr_light\locales\ta.pak
%LOCALAPPDATA%\televzr_light\locales\sw.pak
%LOCALAPPDATA%\televzr_light\locales\sv.pak
%LOCALAPPDATA%\televzr_light\locales\sr.pak
%LOCALAPPDATA%\televzr_light\locales\sl.pak
%LOCALAPPDATA%\televzr_light\locales\sk.pak
%LOCALAPPDATA%\televzr_light\locales\ru.pak
%LOCALAPPDATA%\televzr_light\locales\ro.pak
%LOCALAPPDATA%\televzr_light\locales\pt-pt.pak
%LOCALAPPDATA%\televzr_light\locales\pt-br.pak
%LOCALAPPDATA%\televzr_light\locales\pl.pak
%LOCALAPPDATA%\televzr_light\resources\app-update.yml
%LOCALAPPDATA%\televzr_light\resources\app.asar
%LOCALAPPDATA%\televzr_light\resources\app.asar.unpacked\bundle\7f8b663e6218621b36b1867f8f2ff543.ico
%LOCALAPPDATA%\televzr_light\resources\app.asar.unpacked\bundle\c0edcf9115ff85441b19ff0e2f387c2d.ico
%TEMP%\nsncd98.tmp\winshell.dll
%APPDATA%\microsoft\windows\start menu\programs\televzr light.lnk
%LOCALAPPDATA%\televzr_light\uninstall televzr light.exe
%LOCALAPPDATA%\televzr_light-updater\package.7z
%LOCALAPPDATA%\televzr_light\vulkan-1.dll
%LOCALAPPDATA%\televzr_light\vk_swiftshader.dll
%LOCALAPPDATA%\televzr_light\televzr light.exe
%LOCALAPPDATA%\televzr_light\swiftshader\libglesv2.dll
%LOCALAPPDATA%\televzr_light\swiftshader\libegl.dll
%LOCALAPPDATA%\televzr_light\resources\bin_ia32\youtube-dl.exe
%LOCALAPPDATA%\televzr_light\resources\elevate.exe
%LOCALAPPDATA%\televzr_light\resources\bin_ia32\ffprobe.exe
%LOCALAPPDATA%\televzr_light\resources\bin_ia32\ffmpeg.exe
%LOCALAPPDATA%\televzr_light\libglesv2.dll
%LOCALAPPDATA%\televzr_light\libegl.dll
%LOCALAPPDATA%\televzr_light\ffmpeg.dll
%LOCALAPPDATA%\televzr_light\d3dcompiler_47.dll
%LOCALAPPDATA%\televzr_light\vk_swiftshader_icd.json
%LOCALAPPDATA%\televzr_light\v8_context_snapshot.bin
%LOCALAPPDATA%\televzr_light\snapshot_blob.bin
%HOMEPATH%\desktop\televzr light.lnk
%LOCALAPPDATA%\televzr_light\locales\nl.pak
%LOCALAPPDATA%\televzr_light\locales\nb.pak
%LOCALAPPDATA%\televzr_light\locales\ms.pak
%LOCALAPPDATA%\televzr_light\locales\da.pak
%LOCALAPPDATA%\televzr_light\locales\cs.pak
%LOCALAPPDATA%\televzr_light\locales\ca.pak
%LOCALAPPDATA%\televzr_light\locales\bn.pak
%LOCALAPPDATA%\televzr_light\locales\bg.pak
%LOCALAPPDATA%\televzr_light\locales\ar.pak
%LOCALAPPDATA%\televzr_light\locales\am.pak
%LOCALAPPDATA%\televzr_light\licenses.chromium.html
%LOCALAPPDATA%\televzr_light\license.electron.txt
%LOCALAPPDATA%\televzr_light\icudtl.dat
%LOCALAPPDATA%\televzr_light\chrome_200_percent.pak
%LOCALAPPDATA%\televzr_light\chrome_100_percent.pak
%TEMP%\nsncd98.tmp\nsis7z.dll
%TEMP%\nsncd98.tmp\package.7z
%TEMP%\nsncd98.tmp\inetc.dll
%TEMP%\nsncd98.tmp\nsprocess.dll
%TEMP%\nsncd98.tmp\spiderbanner.dll
%TEMP%\nsncd98.tmp\nsexec.dll
%TEMP%\nsncd98.tmp\stdutils.dll
%LOCALAPPDATA%\televzr_light\locales\de.pak
%LOCALAPPDATA%\televzr_light\locales\el.pak
%LOCALAPPDATA%\televzr_light\locales\en-gb.pak
%LOCALAPPDATA%\televzr_light\locales\en-us.pak
%LOCALAPPDATA%\televzr_light\locales\ml.pak
%LOCALAPPDATA%\televzr_light\locales\lv.pak
%LOCALAPPDATA%\televzr_light\locales\lt.pak
%LOCALAPPDATA%\televzr_light\locales\ko.pak
%LOCALAPPDATA%\televzr_light\locales\kn.pak
%LOCALAPPDATA%\televzr_light\locales\ja.pak
%LOCALAPPDATA%\televzr_light\locales\it.pak
%LOCALAPPDATA%\televzr_light\locales\id.pak
%LOCALAPPDATA%\televzr_light\locales\hu.pak
%LOCALAPPDATA%\televzr_light\locales\hi.pak
%LOCALAPPDATA%\televzr_light\locales\hr.pak
%LOCALAPPDATA%\televzr_light\locales\he.pak
%LOCALAPPDATA%\televzr_light\locales\gu.pak
%LOCALAPPDATA%\televzr_light\locales\fr.pak
%LOCALAPPDATA%\televzr_light\locales\fil.pak
%LOCALAPPDATA%\televzr_light\locales\fi.pak
%LOCALAPPDATA%\televzr_light\locales\fa.pak
%LOCALAPPDATA%\televzr_light\locales\et.pak
%LOCALAPPDATA%\televzr_light\locales\es.pak
%LOCALAPPDATA%\televzr_light\locales\es-419.pak
%LOCALAPPDATA%\televzr_light\locales\mr.pak
%TEMP%\nsncd98.tmp\setuserfta.exe

Moves the following files

from %TEMP%\nsncd98.tmp\package.7z to %LOCALAPPDATA%\televzr_light-updater\package.7z

Network activity

TCP

HTTP GET requests

http://de####p.televzr.com/download/updater/latest/televzr_light.nsis.7z
http://cd###elevzr.com/light/televzr_light-1.9.49-ia32.nsis.7z
http://cd###elevzr.com/setUserFTA_1.7.1.exe
http://cd###elevzr.com/setUserFTA_1.7.1.exe.sha512

HTTP POST requests

http://www.go#####analytics.com/collect

UDP

DNS ASK go#####analytics.com
DNS ASK de####p.televzr.com
DNS ASK cd###elevzr.com

Miscellaneous

Searches for the following windows

ClassName: '#32770' WindowName: ''

Creates and executes the following

'%TEMP%\nsncd98.tmp\setuserfta.exe' .mkv televzr
'%TEMP%\nsncd98.tmp\setuserfta.exe' .mp4 televzr
'%TEMP%\nsncd98.tmp\setuserfta.exe' .avi televzr
'%TEMP%\nsncd98.tmp\setuserfta.exe' .m4v televzr
'%WINDIR%\syswow64\cmd.exe' /C more < "<Full path to file>:Zone.Identifier"' (with hidden window)
'%TEMP%\nsncd98.tmp\setuserfta.exe' .mkv televzr' (with hidden window)
'%TEMP%\nsncd98.tmp\setuserfta.exe' .mp4 televzr' (with hidden window)
'%TEMP%\nsncd98.tmp\setuserfta.exe' .avi televzr' (with hidden window)
'%TEMP%\nsncd98.tmp\setuserfta.exe' .m4v televzr' (with hidden window)

Executes the following