Trojan.DownLoader34.59948

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

%APPDATA%\microsoft\windows\start menu\programs\startup\microsoftantimalware.exe

Modifies file system

Creates the following files

%TEMP%\_mei23442\vcruntime140.dll
%TEMP%\_mei29962\api-ms-win-core-localization-l1-2-0.dll
%TEMP%\_mei29962\api-ms-win-core-memory-l1-1-0.dll
%TEMP%\_mei29962\api-ms-win-core-namedpipe-l1-1-0.dll
%TEMP%\_mei29962\api-ms-win-core-processenvironment-l1-1-0.dll
%TEMP%\_mei29962\api-ms-win-core-processthreads-l1-1-0.dll
%TEMP%\_mei29962\api-ms-win-core-interlocked-l1-1-0.dll
%TEMP%\_mei29962\api-ms-win-core-libraryloader-l1-1-0.dll
%TEMP%\_mei29962\api-ms-win-core-processthreads-l1-1-1.dll
%TEMP%\_mei29962\api-ms-win-core-string-l1-1-0.dll
%TEMP%\_mei29962\api-ms-win-core-synch-l1-1-0.dll
%TEMP%\_mei29962\api-ms-win-core-synch-l1-2-0.dll
%TEMP%\_mei29962\api-ms-win-core-sysinfo-l1-1-0.dll
%TEMP%\_mei29962\api-ms-win-core-timezone-l1-1-0.dll
%TEMP%\_mei29962\api-ms-win-core-profile-l1-1-0.dll
%TEMP%\_mei29962\api-ms-win-core-rtlsupport-l1-1-0.dll
%TEMP%\_mei29962\api-ms-win-core-heap-l1-1-0.dll
%TEMP%\_mei29962\api-ms-win-core-handle-l1-1-0.dll
%TEMP%\_mei29962\api-ms-win-core-file-l2-1-0.dll
%TEMP%\_mei29962\_cffi_backend.cp37-win_amd64.pyd
%TEMP%\_mei29962\_ctypes.pyd
%TEMP%\_mei29962\_decimal.pyd
%TEMP%\_mei29962\_hashlib.pyd
%TEMP%\_mei29962\_lzma.pyd
%TEMP%\_mei29962\_queue.pyd
%TEMP%\_mei29962\_bz2.pyd
%TEMP%\_mei29962\_socket.pyd
%TEMP%\_mei29962\api-ms-win-core-console-l1-1-0.dll
%TEMP%\_mei29962\api-ms-win-core-datetime-l1-1-0.dll
%TEMP%\_mei29962\api-ms-win-core-debug-l1-1-0.dll
%TEMP%\_mei29962\api-ms-win-core-errorhandling-l1-1-0.dll
%TEMP%\_mei29962\api-ms-win-core-file-l1-1-0.dll
%TEMP%\_mei29962\api-ms-win-core-file-l1-2-0.dll
%TEMP%\_mei29962\_ssl.pyd
%TEMP%\_mei29962\api-ms-win-core-util-l1-1-0.dll
%TEMP%\_mei29962\api-ms-win-crt-convert-l1-1-0.dll
%TEMP%\_mei29962\cryptography-2.7-py3.7.egg-info\wheel
%TEMP%\_mei29962\api-ms-win-crt-environment-l1-1-0.dll
%TEMP%\_mei29962\win32api.pyd
%TEMP%\_mei29962\win32evtlog.pyd
%TEMP%\_mei29962\win32wnet.pyd
%TEMP%\_mei29962\base_library.zip
%TEMP%\_mei29962\certifi\cacert.pem
%TEMP%\_mei29962\ucrtbase.dll
%TEMP%\_mei29962\unicodedata.pyd
%TEMP%\_mei29962\cryptography-2.7-py3.7.egg-info\authors.rst
%TEMP%\_mei29962\cryptography-2.7-py3.7.egg-info\license.apache
%TEMP%\_mei29962\cryptography-2.7-py3.7.egg-info\license.bsd
%TEMP%\_mei29962\cryptography-2.7-py3.7.egg-info\license.psf
%TEMP%\_mei29962\cryptography-2.7-py3.7.egg-info\metadata
%TEMP%\_mei29962\cryptography-2.7-py3.7.egg-info\record
%TEMP%\_mei29962\cryptography-2.7-py3.7.egg-info\installer
%TEMP%\_mei29962\cryptography-2.7-py3.7.egg-info\license
%TEMP%\_mei29962\select.pyd
%TEMP%\_mei29962\pywintypes37.dll
%TEMP%\_mei29962\python37.dll
%TEMP%\_mei29962\api-ms-win-crt-heap-l1-1-0.dll
%TEMP%\_mei29962\api-ms-win-crt-locale-l1-1-0.dll
%TEMP%\_mei29962\api-ms-win-crt-math-l1-1-0.dll
%TEMP%\_mei29962\api-ms-win-crt-process-l1-1-0.dll
%TEMP%\_mei29962\api-ms-win-crt-runtime-l1-1-0.dll
%TEMP%\_mei29962\api-ms-win-crt-stdio-l1-1-0.dll
%TEMP%\_mei29962\api-ms-win-crt-filesystem-l1-1-0.dll
%TEMP%\_mei29962\api-ms-win-crt-string-l1-1-0.dll
%TEMP%\_mei29962\api-ms-win-crt-utility-l1-1-0.dll
%TEMP%\_mei29962\cryptography\hazmat\bindings\_constant_time.cp37-win_amd64.pyd
%TEMP%\_mei29962\cryptography\hazmat\bindings\_openssl.cp37-win_amd64.pyd
%TEMP%\_mei29962\libcrypto-1_1-x64.dll
%TEMP%\_mei29962\libssl-1_1-x64.dll
%TEMP%\_mei29962\pyexpat.pyd
%TEMP%\_mei29962\api-ms-win-crt-time-l1-1-0.dll
%TEMP%\_mei29962\vcruntime140.dll
%TEMP%\_mei29962\api-ms-win-crt-conio-l1-1-0.dll
%TEMP%\_mei29962\microsoftantimalware.exe.manifest
%TEMP%\_mei23442\api-ms-win-crt-conio-l1-1-0.dll
%TEMP%\_mei23442\api-ms-win-core-localization-l1-2-0.dll
%TEMP%\_mei23442\api-ms-win-core-memory-l1-1-0.dll
%TEMP%\_mei23442\api-ms-win-core-namedpipe-l1-1-0.dll
%TEMP%\_mei23442\api-ms-win-core-processenvironment-l1-1-0.dll
%TEMP%\_mei23442\api-ms-win-core-processthreads-l1-1-0.dll
%TEMP%\_mei23442\api-ms-win-core-interlocked-l1-1-0.dll
%TEMP%\_mei23442\api-ms-win-core-libraryloader-l1-1-0.dll
%TEMP%\_mei23442\api-ms-win-core-processthreads-l1-1-1.dll
%TEMP%\_mei23442\api-ms-win-core-string-l1-1-0.dll
%TEMP%\_mei23442\api-ms-win-core-synch-l1-1-0.dll
%TEMP%\_mei23442\api-ms-win-core-synch-l1-2-0.dll
%TEMP%\_mei23442\api-ms-win-core-sysinfo-l1-1-0.dll
%TEMP%\_mei23442\api-ms-win-core-timezone-l1-1-0.dll
%TEMP%\_mei23442\api-ms-win-core-profile-l1-1-0.dll
%TEMP%\_mei23442\api-ms-win-core-rtlsupport-l1-1-0.dll
%TEMP%\_mei23442\api-ms-win-core-heap-l1-1-0.dll
%TEMP%\_mei23442\api-ms-win-core-handle-l1-1-0.dll
%TEMP%\_mei23442\api-ms-win-core-file-l2-1-0.dll
%TEMP%\_mei23442\_cffi_backend.cp37-win_amd64.pyd
%TEMP%\_mei23442\_ctypes.pyd
%TEMP%\_mei23442\_decimal.pyd
%TEMP%\_mei23442\_hashlib.pyd
%TEMP%\_mei23442\_lzma.pyd
%TEMP%\_mei23442\_queue.pyd
%TEMP%\_mei23442\_bz2.pyd
%TEMP%\_mei23442\_socket.pyd
%TEMP%\_mei23442\api-ms-win-core-console-l1-1-0.dll
%TEMP%\_mei23442\api-ms-win-core-datetime-l1-1-0.dll
%TEMP%\_mei23442\api-ms-win-core-debug-l1-1-0.dll
%TEMP%\_mei23442\api-ms-win-core-errorhandling-l1-1-0.dll
%TEMP%\_mei23442\api-ms-win-core-file-l1-1-0.dll
%TEMP%\_mei23442\api-ms-win-core-file-l1-2-0.dll
%TEMP%\_mei23442\_ssl.pyd
%TEMP%\_mei23442\api-ms-win-core-util-l1-1-0.dll
%TEMP%\_mei23442\api-ms-win-crt-convert-l1-1-0.dll
%TEMP%\_mei23442\cryptography-2.7-py3.7.egg-info\wheel
%TEMP%\_mei23442\api-ms-win-crt-environment-l1-1-0.dll
%TEMP%\_mei23442\unicodedata.pyd
%TEMP%\_mei23442\win32api.pyd
%TEMP%\_mei23442\win32evtlog.pyd
%TEMP%\_mei23442\base_library.zip
%TEMP%\_mei23442\certifi\cacert.pem
%TEMP%\_mei23442\setup.exe.manifest
%TEMP%\_mei23442\ucrtbase.dll
%TEMP%\_mei23442\cryptography-2.7-py3.7.egg-info\authors.rst
%TEMP%\_mei23442\cryptography-2.7-py3.7.egg-info\license.apache
%TEMP%\_mei23442\cryptography-2.7-py3.7.egg-info\license.bsd
%TEMP%\_mei23442\cryptography-2.7-py3.7.egg-info\license.psf
%TEMP%\_mei23442\cryptography-2.7-py3.7.egg-info\metadata
%TEMP%\_mei23442\cryptography-2.7-py3.7.egg-info\record
%TEMP%\_mei23442\cryptography-2.7-py3.7.egg-info\installer
%TEMP%\_mei23442\cryptography-2.7-py3.7.egg-info\license
%TEMP%\_mei23442\select.pyd
%TEMP%\_mei23442\pywintypes37.dll
%TEMP%\_mei23442\python37.dll
%TEMP%\_mei23442\api-ms-win-crt-heap-l1-1-0.dll
%TEMP%\_mei23442\api-ms-win-crt-locale-l1-1-0.dll
%TEMP%\_mei23442\api-ms-win-crt-math-l1-1-0.dll
%TEMP%\_mei23442\api-ms-win-crt-process-l1-1-0.dll
%TEMP%\_mei23442\api-ms-win-crt-runtime-l1-1-0.dll
%TEMP%\_mei23442\api-ms-win-crt-stdio-l1-1-0.dll
%TEMP%\_mei23442\api-ms-win-crt-filesystem-l1-1-0.dll
%TEMP%\_mei23442\api-ms-win-crt-string-l1-1-0.dll
%TEMP%\_mei23442\api-ms-win-crt-utility-l1-1-0.dll
%TEMP%\_mei23442\cryptography\hazmat\bindings\_constant_time.cp37-win_amd64.pyd
%TEMP%\_mei23442\cryptography\hazmat\bindings\_openssl.cp37-win_amd64.pyd
%TEMP%\_mei23442\libcrypto-1_1-x64.dll
%TEMP%\_mei23442\libssl-1_1-x64.dll
%TEMP%\_mei23442\pyexpat.pyd
%TEMP%\_mei23442\api-ms-win-crt-time-l1-1-0.dll
%TEMP%\_mei23442\cryptography-2.7-py3.7.egg-info\top_level.txt
%TEMP%\_mei29962\cryptography-2.7-py3.7.egg-info\top_level.txt

Deletes the following files

%TEMP%\_mei23442\api-ms-win-core-console-l1-1-0.dll
%TEMP%\_mei23442\cryptography-2.7-py3.7.egg-info\wheel
%TEMP%\_mei23442\cryptography-2.7-py3.7.egg-info\top_level.txt
%TEMP%\_mei23442\cryptography-2.7-py3.7.egg-info\record
%TEMP%\_mei23442\cryptography-2.7-py3.7.egg-info\metadata
%TEMP%\_mei23442\cryptography-2.7-py3.7.egg-info\license.psf
%TEMP%\_mei23442\cryptography-2.7-py3.7.egg-info\license.bsd
%TEMP%\_mei23442\libcrypto-1_1-x64.dll
%TEMP%\_mei23442\cryptography-2.7-py3.7.egg-info\license.apache
%TEMP%\_mei23442\cryptography-2.7-py3.7.egg-info\installer
%TEMP%\_mei23442\cryptography-2.7-py3.7.egg-info\authors.rst
%TEMP%\_mei23442\cryptography\hazmat\bindings\_openssl.cp37-win_amd64.pyd
%TEMP%\_mei23442\cryptography\hazmat\bindings\_constant_time.cp37-win_amd64.pyd
%TEMP%\_mei23442\certifi\cacert.pem
%TEMP%\_mei23442\base_library.zip
%TEMP%\_mei23442\cryptography-2.7-py3.7.egg-info\license
%TEMP%\_mei23442\libssl-1_1-x64.dll
%TEMP%\_mei23442\pyexpat.pyd
%TEMP%\_mei23442\python37.dll
%TEMP%\_mei23442\_queue.pyd
%TEMP%\_mei23442\_lzma.pyd
%TEMP%\_mei23442\_hashlib.pyd
%TEMP%\_mei23442\_decimal.pyd
%TEMP%\_mei23442\_ctypes.pyd
%TEMP%\_mei23442\_cffi_backend.cp37-win_amd64.pyd
%TEMP%\_mei23442\_bz2.pyd
%TEMP%\_mei23442\win32evtlog.pyd
%TEMP%\_mei23442\win32api.pyd
%TEMP%\_mei23442\vcruntime140.dll
%TEMP%\_mei23442\unicodedata.pyd
%TEMP%\_mei23442\ucrtbase.dll
%TEMP%\_mei23442\setup.exe.manifest
%TEMP%\_mei23442\select.pyd
%TEMP%\_mei23442\pywintypes37.dll
%TEMP%\_mei23442\api-ms-win-crt-utility-l1-1-0.dll
%TEMP%\_mei23442\_socket.pyd
%TEMP%\_mei23442\api-ms-win-crt-time-l1-1-0.dll
%TEMP%\_mei23442\api-ms-win-crt-stdio-l1-1-0.dll
%TEMP%\_mei23442\api-ms-win-core-processenvironment-l1-1-0.dll
%TEMP%\_mei23442\api-ms-win-core-namedpipe-l1-1-0.dll
%TEMP%\_mei23442\api-ms-win-core-memory-l1-1-0.dll
%TEMP%\_mei23442\api-ms-win-core-localization-l1-2-0.dll
%TEMP%\_mei23442\api-ms-win-core-libraryloader-l1-1-0.dll
%TEMP%\_mei23442\api-ms-win-core-interlocked-l1-1-0.dll
%TEMP%\_mei23442\api-ms-win-core-processthreads-l1-1-0.dll
%TEMP%\_mei23442\api-ms-win-core-heap-l1-1-0.dll
%TEMP%\_mei23442\api-ms-win-core-file-l2-1-0.dll
%TEMP%\_mei23442\api-ms-win-core-file-l1-2-0.dll
%TEMP%\_mei23442\api-ms-win-core-file-l1-1-0.dll
%TEMP%\_mei23442\api-ms-win-core-errorhandling-l1-1-0.dll
%TEMP%\_mei23442\api-ms-win-core-debug-l1-1-0.dll
%TEMP%\_mei23442\api-ms-win-core-datetime-l1-1-0.dll
%TEMP%\_mei23442\api-ms-win-core-handle-l1-1-0.dll
%TEMP%\_mei23442\api-ms-win-core-processthreads-l1-1-1.dll
%TEMP%\_mei23442\api-ms-win-core-profile-l1-1-0.dll
%TEMP%\_mei23442\api-ms-win-core-rtlsupport-l1-1-0.dll
%TEMP%\_mei23442\api-ms-win-crt-runtime-l1-1-0.dll
%TEMP%\_mei23442\api-ms-win-crt-process-l1-1-0.dll
%TEMP%\_mei23442\api-ms-win-crt-math-l1-1-0.dll
%TEMP%\_mei23442\api-ms-win-crt-locale-l1-1-0.dll
%TEMP%\_mei23442\api-ms-win-crt-heap-l1-1-0.dll
%TEMP%\_mei23442\api-ms-win-crt-filesystem-l1-1-0.dll
%TEMP%\_mei23442\api-ms-win-crt-environment-l1-1-0.dll
%TEMP%\_mei23442\api-ms-win-crt-convert-l1-1-0.dll
%TEMP%\_mei23442\api-ms-win-crt-conio-l1-1-0.dll
%TEMP%\_mei23442\api-ms-win-core-util-l1-1-0.dll
%TEMP%\_mei23442\api-ms-win-core-timezone-l1-1-0.dll
%TEMP%\_mei23442\api-ms-win-core-sysinfo-l1-1-0.dll
%TEMP%\_mei23442\api-ms-win-core-synch-l1-2-0.dll
%TEMP%\_mei23442\api-ms-win-core-synch-l1-1-0.dll
%TEMP%\_mei23442\api-ms-win-core-string-l1-1-0.dll
%TEMP%\_mei23442\api-ms-win-crt-string-l1-1-0.dll
%TEMP%\_mei23442\_ssl.pyd

Network activity

TCP

HTTP GET requests

http://ki##.6te.net/api/?de######################

HTTP POST requests

http://ki##.6te.net/api/register.php

'drive.google.com':443

'do#########ocs.googleusercontent.com':443

UDP

DNS ASK drive.google.com
DNS ASK do#########ocs.googleusercontent.com
DNS ASK ki##.6te.net

Miscellaneous

Creates and executes the following

'%APPDATA%\microsoft\windows\start menu\programs\startup\microsoftantimalware.exe'

Executes the following

'<SYSTEM32>\cmd.exe' /c cd %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup && start MicrosoftAntiMalware.exe

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней