Trojan.DownLoader44.48283

Technical Information

To ensure autorun and distribution

Sets the following service settings

[<HKLM>\System\CurrentControlSet\Services\4e4e] 'ImagePath' = '<DRIVERS>\4e4e.sys'

Creates the following services

'4e4e' <DRIVERS>\4e4e.sys

Modifies file system

Creates the following files

%WINDIR%\msh.ini
<Current directory>\tp\ВµГ§ГўВјГ¬ГЎГЄВѕ.bmp
<Current directory>\tp\ВµГ§ГўВјГЄВ§В°Гј.bmp
<Current directory>\tp\ВµГ§ГўВјВІГ¦ВІГ¦1.bmp
<Current directory>\tp\ВµГ§ГўВјВІГ¦ВІГ¦.bmp
<Current directory>\tp\В»В·ВѕВіГ©ГЁГ¶ГЈ.bmp
<Current directory>\tp\ГіГ®ГЇВ·Г©ГЁГ¶ГЈ.bmp
<Current directory>\tp\ГіГ®ГЇВ·Г®В¬В»В¤.bmp
<Current directory>\tp\В»Г®В¶ВЇГЎГ¬ГЁВЎ.bmp
<Current directory>\tp\В»Г®В¶ВЇГ§В©ВµВЅ.bmp
<Current directory>\tp\В»Г®В¶ВЇВЅГ§ГЈГ¦.bmp
<Current directory>\tp\В·ГѕГЄГ®.bmp
<Current directory>\tp\Г®ГѕВ·ВЁГ¶В§ГґВ®.bmp
<Current directory>\tp\Г¬ГЎВ±ГІВµГ§ГўВјВЅГ§ГЈГ¦.bmp
<Current directory>\tp\ГҐГҐВ¶ГіГ¶Г°.bmp
<Current directory>\tp\ВµГґГЇГџВµГ§ГўВј2.bmp
<Current directory>\tp\ВµГ§ГўВјВґГГ®Гі.bmp
<Current directory>\tp\ГЁВ·ГЁГЇГ°ВГ¶Гє.bmp
<Current directory>\tp\ВіГЅГўГ¶.bmp
<Current directory>\tp\ГЁВ·ГЁГЇВЅГёГВј.bmp
<Current directory>\tp\Г¦ГЇВіГ«.bmp
<Current directory>\tp\ГЈГҐГҐГ©Г¶В§ГґВ®.bmp
<Current directory>\tp\ГЈГҐГҐГ©ВјВјГ¤Гј.bmp
<Current directory>\tp\ГЈГҐГҐГ©ГЎГ°В±Г.bmp
<Current directory>\tp\Г±ВЎГґГ±Г±ГµГ©В«.bmp
<Current directory>\tp\ГГ«ВіГ¶ВµГ§ГўВј.bmp
<Current directory>\tp\ВЅГёГВјГҐГҐВ¶Гі.bmp
<Current directory>\tp\ВїГ§ГВјВ±ГџВЅГ§.ini
<Current directory>\tp\ВїГ®Г¬Гў.bmp
<Current directory>\tp\Г§Г«Г§ГіГ¶В§ГґВ®.bmp
<Current directory>\tp\ВѕВЇВёГ¦.bmp
<Current directory>\tp\ГІГўВ·Гѕ.bmp
<Current directory>\tp\ВѕВ«ГЎГ©.bmp
<Current directory>\tp\Г«Г©ГЎГ±ВµГ¤Г°Г¤1.bmp
<Current directory>\tp\Г«Г©ГЎГ±ВµГ¤Г°Г¤.bmp
<Current directory>\tp\ВµГґГЇГџВµГ§ГўВј1.bmp
<Current directory>\tp\ГЁВ·ГЁГЇ.bmp
<Current directory>\tp\ВµГґГЇГџВµГ§ГўВј.bmp
<Current directory>\tp\Г§Г°В»В»ВЅГ§Г©В«.bmp
<Current directory>\tp\Г¦Г¤Г«Г»ГµГ«ВєГҐ.bmp
<Current directory>\tp\ГҐГҐВґГ·.bmp
<Current directory>\tp\Г¬ГҐГ¶ГЄВЅГ§ГЈГ¦.bmp
<Current directory>\tp\ВґВ«Г«Г.bmp
<Current directory>\tp\Г®В°ГІВµ.bmp
<Current directory>\tp\ГЁГ®Г®Г±.ini
<Current directory>\tp\ВЅВ»ГІГ—Г«Г№.bmp
<Current directory>\tp\ГІВ»ВјГјГЎГ¬ГЁВЎ.bmp
<Current directory>\tp\wemix.bmp
<Current directory>\tp\googl.bmp
<Current directory>\tp\confirm.bmp
<Current directory>\tp.zip
<DRIVERS>\4e4e.sys
%WINDIR%\msh.tmpt
%WINDIR%\mmtpi.dll
<Current directory>\tp\Г¤ГєВ№В¦ВЅГ§ГЈГ¦.bmp
<Current directory>\tp\ВґВґВЅВЁГЈГҐГҐГ©.bmp
<Current directory>\tp\ВїГ¬Г«Г№Г°ВГ¶Гє.bmp
<Current directory>\tp\Г¶Г¦ГґГ¬.bmp
<Current directory>\tp\Г§ВїВ»ВЇ.bmp
<Current directory>\tp\ВїВЄГЄВјГіГ®ГЇВ·.bmp
<Current directory>\tp\ВїВЄГЄВјГ¶В§ГґВ®.bmp
<Current directory>\tp\ВїВЄГЄВјГ°ВГ¶Гє.bmp
<Current directory>\tp\В·ГўГіВЎ.bmp
<Current directory>\tp\В¶ГґВ»В°ВЅГёВ¶ГЁ.bmp
<Current directory>\tp\Г—Г¶ВїГў1.txt
<Current directory>\tp\Г¦Г¦ГґВµГГЄВіГ©.bmp
<Current directory>\tp\Г¦Г¦ГґВµ.bmp
<Current directory>\tp\ГЁВЎГЇГ»Г¦ГЇВіГ«.bmp
<Current directory>\tp\ГЁВЎГЇГ»ГҐГҐВ¶Гі.bmp
<Current directory>\tp\Г°В¶ВіГЅ.bmp
<Current directory>\tp\Г©ГЅВЅГ—.bmp
<Current directory>\tp\ВјГіГЁГ«ГЎГ°В±Г.bmp
<Current directory>\tp\ВѕГ§Г§Г©Г¶Г°.bmp
<Current directory>\tp\ВіГ©ВѕГ.bmp
<Current directory>\Г—ВўВІГЎГўГ«.ini

Deletes the following files

%WINDIR%\msh.tmpt
<DRIVERS>\4e4e.sys
<Current directory>\tp.zip

Network activity

Connects to

'28.#533.net':7000

TCP

HTTP GET requests

http://12#.#7.165.131/m.asp?co###################################################################################################################################################################...

UDP

DNS ASK 21.#533.net
DNS ASK 22.#533.net
DNS ASK 23.#533.net
DNS ASK 24.#533.net
DNS ASK 25.#533.net
DNS ASK 26.#533.net
DNS ASK 27.#533.net
DNS ASK 28.#533.net
DNS ASK 29.#533.net

Демо бесплатно на 14 дней

Выдаётся при установке

Скачать с сайта

Скачать с Google Play

Поздравляем! Обменяйте их на скидку до 50% на покупку Dr.Web.

Получить скидку

Скачайте
Dr.Web для Android

Бесплатно на 3 месяца
Все компоненты защиты
Продление демо через
AppGallery/Google Pay

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней