Trojan.DownLoader45.7270

Technical Information

Modifies file system

Creates the following files

%TEMP%\autbe30.tmp
%TEMP%\autc16d.tmp
%WINDIR%\ncytserver\kefu.ico
%TEMP%\autc17e.tmp
%WINDIR%\ncytserver\wd001.ico
%TEMP%\autc17f.tmp
%WINDIR%\ncytserver\wd002.ico
%TEMP%\autc18f.tmp
%WINDIR%\ncytserver\au3kj.ico
%TEMP%\autc190.tmp
%WINDIR%\ncytserver\webkefu.jpg
%TEMP%\autc1b0.tmp
%WINDIR%\ncytserver\qrcode.jpg
%TEMP%\autc1c1.tmp
%WINDIR%\ncytserver\tootip.jpg
%TEMP%\autc1c2.tmp
%WINDIR%\ncytserver\background.jpg
%TEMP%\autc1d3.tmp
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\le32qb5a\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\a891bsuf\desktop.ini
D:\ncytserver\ncytdbs.mdb
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\rdmsgies\desktop.ini
%WINDIR%\ncytserver\version.dat
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\0tncl8c9\desktop.ini
%LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
%LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
%WINDIR%\ncytserver\network.ini
D:\ncytserver\pluglog\ncytserver - 2022.0728.log
%WINDIR%\ncytserver\ncytdbs.mdb.bak
%APPDATA%\microsoft\windows\cookies\low\index.dat
%WINDIR%\ncytserver\idr.ico
%TEMP%\autc15c.tmp
%WINDIR%\ncytserver\aigei_com.ico
%TEMP%\xynrmza
%TEMP%\autc0a1.tmp
%WINDIR%\ncytserver\wxserver1.ico
%TEMP%\autc0b1.tmp
%WINDIR%\ncytserver\uplog.jpg
%TEMP%\autc0b2.tmp
%WINDIR%\ncytserver\server-1.ico
%TEMP%\autc0c3.tmp
%WINDIR%\ncytserver\server-2.ico
%TEMP%\autc0c4.tmp
%WINDIR%\ncytserver\server-3.ico
%TEMP%\autc0d5.tmp
%WINDIR%\ncytserver\server-4.ico
%TEMP%\autc0d6.tmp
%WINDIR%\ncytserver\server-5.ico
%TEMP%\autc0e6.tmp
%WINDIR%\ncytserver\server-6.ico
%WINDIR%\ncytserver\wxt.ico
%TEMP%\autc14b.tmp
%WINDIR%\ncytserver\video_4.ico
%TEMP%\autc14a.tmp
%WINDIR%\ncytserver\aigei2_com.ico
%TEMP%\autc139.tmp
%TEMP%\autc129.tmp
%WINDIR%\ncytserver\server-10.ico
%WINDIR%\ncytserver\server-9.ico
%TEMP%\autc128.tmp
%WINDIR%\ncytserver\server-8.ico
%TEMP%\autc117.tmp
%WINDIR%\ncytserver\server-11.ico
%TEMP%\autc116.tmp
%TEMP%\autc15b.tmp
%LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\index.dat

Sets the 'hidden' attribute to the following files

%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\0tncl8c9\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\rdmsgies\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\a891bsuf\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\le32qb5a\desktop.ini
%LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini

Deletes the following files

%TEMP%\autbe30.tmp
%TEMP%\autc1c1.tmp
%TEMP%\autc1b0.tmp
%TEMP%\autc190.tmp
%TEMP%\autc18f.tmp
%TEMP%\autc17f.tmp
%TEMP%\autc17e.tmp
%TEMP%\autc16d.tmp
%TEMP%\autc15c.tmp
%TEMP%\autc15b.tmp
%TEMP%\autc14b.tmp
%TEMP%\autc14a.tmp
%TEMP%\autc139.tmp
%TEMP%\autc129.tmp
%TEMP%\autc128.tmp
%TEMP%\autc117.tmp
%TEMP%\autc116.tmp
%TEMP%\autc0e6.tmp
%TEMP%\autc0d6.tmp
%TEMP%\autc0d5.tmp
%TEMP%\autc0c4.tmp
%TEMP%\autc0c3.tmp
%TEMP%\autc0b2.tmp
%TEMP%\autc0b1.tmp
%TEMP%\autc0a1.tmp
%TEMP%\xynrmza
%TEMP%\autc1c2.tmp
%TEMP%\autc1d3.tmp

Network activity

Connects to

'jx#d.cc':80

TCP

HTTP GET requests

http://jx#d.cc/wxtools/Ver1/Version.dat

UDP

DNS ASK ba##u.com
DNS ASK jx#d.cc

Miscellaneous

Creates and executes the following

'%WINDIR%\syswow64\cmd.exe' /c ipconfig /all > %WINDIR%\NcytServer\NetWork.ini' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c ipconfig /all > %WINDIR%\NcytServer\NetWork.ini
'%WINDIR%\syswow64\ipconfig.exe' /all
'%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\syswow64\WININET.dll",DispatchAPICall 1