Trojan.DownLoader36.52737

Technical Information

Modifies file system

Creates the following files

%TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\ldcab.exe.ldtmp
C:\inetpub\ftproot\tipray\ldterm\log\mfccbbqfuwdi_user\ldx.log
%TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\ldcab.lddat.ldtmp
%TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\ldcab.ldind.ldtmp
%TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\ldcab.ldx.ldtmp
%TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\ldreject64.exe.ldtmp
%TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\ghhlp32.dll.ldtmp
%TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\ghhlp64.dll.ldtmp
%TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\ldxghijt64.dll.ldtmp
%TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\ldxghijt32.dll.ldtmp
%TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\ldxhook32.dll.ldtmp
%TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\ldxhook64.dll.ldtmp
%TEMP%\ldxsd.dat
%TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\ldxghcore64.sys.ldtmp
%TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\ldxsharedata64.dll.ldtmp
%TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\ldxsharedata32.dll.ldtmp
%TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\lddisk64.sys.ldtmp
%TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\ldx.exe.ldtmp
%TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\ldxguard.exe.ldtmp
%TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\forbit.ini.ldtmp
%TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\lddisk32.sys.ldtmp
%TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\detoured.dll.ldtmp
%TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\ldxsysctrl.dll.ldtmp
%TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\arlib.dll.ldtmp
%TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\ldx32.exe.ldtmp
%TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\ldxghcore32.sys.ldtmp
%TEMP%\@tiprayldx@\forbit.ini

Deletes the following files

%TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\ldcab.exe

Moves the following files

from %TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\ldcab.exe.ldtmp to %TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\ldcab.exe
from %TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\ldcab.ldx.ldtmp to %TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\ldcab.ldx
from %TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\ldreject64.exe.ldtmp to %TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\ldreject64.exe
from %TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\ghhlp32.dll.ldtmp to %TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\ghhlp32.dll
from %TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\ghhlp64.dll.ldtmp to %TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\ghhlp64.dll
from %TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\ldxghijt64.dll.ldtmp to %TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\ldxghijt64.dll
from %TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\ldxghijt32.dll.ldtmp to %TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\ldxghijt32.dll
from %TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\ldxhook32.dll.ldtmp to %TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\ldxhook32.dll
from %TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\ldxhook64.dll.ldtmp to %TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\ldxhook64.dll
from %TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\ldxghcore64.sys.ldtmp to %TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\ldxghcore64.sys
from %TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\ldxghcore32.sys.ldtmp to %TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\ldxghcore32.sys
from %TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\ldxsharedata64.dll.ldtmp to %TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\ldxsharedata64.dll
from %TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\ldxsharedata32.dll.ldtmp to %TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\ldxsharedata32.dll
from %TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\lddisk64.sys.ldtmp to %TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\lddisk64.sys
from %TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\ldx.exe.ldtmp to %TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\ldx.exe
from %TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\ldxguard.exe.ldtmp to %TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\ldxguard.exe
from %TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\forbit.ini.ldtmp to %TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\forbit.ini
from %TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\lddisk32.sys.ldtmp to %TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\lddisk32.sys
from %TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\detoured.dll.ldtmp to %TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\detoured.dll
from %TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\ldxsysctrl.dll.ldtmp to %TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\ldxsysctrl.dll
from %TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\arlib.dll.ldtmp to %TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\arlib.dll
from %TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\ldx32.exe.ldtmp to %TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\ldx32.exe
from %TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\ldcab.ldind.ldtmp to %TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\ldcab.ldind
from %TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\ldcab.lddat.ldtmp to %TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\ldcab.lddat

Substitutes the following files

%TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\ldcab.exe.ldtmp
%TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\ldcab.exe

Network activity

TCP

HTTP POST requests

http://www.ti##ay.com/LdReader/V2/LdReader.asp

UDP

DNS ASK ti##ay.com

Miscellaneous

Creates and executes the following

'%TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\ldx.exe' -srcfile "<Full path to file>"
'%TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\ldxguard.exe' -GuardPath %TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\
'%TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\ldxguard.exe' -GuardPath %TEMP%\@tiprayldx@\a79e14828b126e09a22b23055427f440\' (with hidden window)