Trojan.DownLoader45.60743

Technical Information

Malicious functions

To complicate detection of its presence in the operating system,

blocks the following features:

User Account Control (UAC)

Modifies file system

Creates the following files

C:\Г®Г—Г©Г±ВјГ_2023ГЁВ«Г°Гў\Г®Г—Г©Г±ВјГ_2023ГЁВ«Г°Гў.exe
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0y9o17dr\httperrorpagesscripts[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0y9o17dr\info_48[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bm8skz0v\bullet[1]
%ALLUSERSPROFILE%\playtomenu.jpg
C:\Г®Г—Г©Г±ВјГ_2023ГЁВ«Г°Гў\Г®Г—Г©Г±ВјГ_2023ГЁВ«Г°Гў.lnk
%TEMP%\09cc081a7cd9e19f7104b00b5f330e3c.ini
%TEMP%\ВІВ№В¶ВЎ.zip
C:\Г®Г—Г©Г±ВјГ_2023ГЁВ«Г°Гў\bwbj\data\mapdesc1.dat
C:\Г®Г—Г©Г±ВјГ_2023ГЁВ«Г°Гў\bwbj\data\ГЁГЅГЎГЈВґВ«Г¦Г¦.pak
C:\Г®Г—Г©Г±ВјГ_2023ГЁВ«Г°Гў\data\mapdesc1.dat
C:\Г®Г—Г©Г±ВјГ_2023ГЁВ«Г°Гў\wav\sellect-loop2.wav
C:\Г®Г—Г©Г±ВјГ_2023ГЁВ«Г°Гў\data\mapdesc2.dat
C:\Г®Г—Г©Г±ВјГ_2023ГЁВ«Г°Гў\data\newopui.pak
C:\Г®Г—Г©Г±ВјГ_2023ГЁВ«Г°Гў\wav\kb1.wav
C:\Г®Г—Г©Г±ВјГ_2023ГЁВ«Г°Гў\wav\kb2.wav
C:\Г®Г—Г©Г±ВјГ_2023ГЁВ«Г°Гў\wav\kb3.wav
C:\Г®Г—Г©Г±ВјГ_2023ГЁВ«Г°Гў\wav\kb4.wav
C:\Г®Г—Г©Г±ВјГ_2023ГЁВ«Г°Гў\wav\kb5.wav
C:\Г®Г—Г©Г±ВјГ_2023ГЁВ«Г°Гў\wav\kb6.wav
C:\Г®Г—Г©Г±ВјГ_2023ГЁВ«Г°Гў\wav\log-in-long2.wav
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\qkr46vql\errorpagetemplate[1]
C:\Г®Г—Г©Г±ВјГ_2023ГЁВ«Г°Гў\data\mapdesc1---.dat
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bm8skz0v\navcancl[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\ugsx1com\errorpagetemplate[1]
C:\Г®Г—Г©Г±ВјГ_2023ГЁВ«Г°Гў\1.ico
%TEMP%\ii.html
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0y9o17dr\dnserrordiagoff_weboc[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bm8skz0v\errorpagetemplate[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\ugsx1com\errorpagestrings[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\qkr46vql\navcancl[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0y9o17dr\dnserrordiagoff_weboc[2]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0y9o17dr\errorpagetemplate[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bm8skz0v\errorpagestrings[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0y9o17dr\errorpagestrings[1]
%LOCALAPPDATA%\microsoft\internet explorer\msimgsiz.dat
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bm8skz0v\httperrorpagesscripts[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bm8skz0v\httperrorpagesscripts[2]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bm8skz0v\background_gradient[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\ugsx1com\info_48[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\qkr46vql\bullet[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0y9o17dr\background_gradient[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bm8skz0v\info_48[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\ugsx1com\bullet[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\qkr46vql\down[1]
%ALLUSERSPROFILE%\rr.exe
C:\Г®Г—Г©Г±ВјГ_2023ГЁВ«Г°Гў\wav\xsc.wav

Deletes the following files

C:\Г®Г—Г©Г±ВјГ_2023ГЁВ«Г°Гў\1.ico
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bm8skz0v\info_48[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0y9o17dr\background_gradient[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bm8skz0v\httperrorpagesscripts[2]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0y9o17dr\errorpagestrings[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\ugsx1com\errorpagetemplate[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\qkr46vql\navcancl[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\qkr46vql\bullet[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\ugsx1com\info_48[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bm8skz0v\background_gradient[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bm8skz0v\httperrorpagesscripts[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bm8skz0v\errorpagestrings[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0y9o17dr\errorpagetemplate[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\ugsx1com\errorpagestrings[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bm8skz0v\errorpagetemplate[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0y9o17dr\dnserrordiagoff_weboc[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\ugsx1com\bullet[1]
%TEMP%\09cc081a7cd9e19f7104b00b5f330e3c.ini

Moves the following files

from C:\Г®Г—Г©Г±ВјГ_2023ГЁВ«Г°Гў\Г®Г—Г©Г±ВјГ_2023ГЁВ«Г°Гў.lnk to %HOMEPATH%\desktop\Г®Г—Г©Г±ВјГ_2023ГЁВ«Г°Гў.lnk

Substitutes the following files

%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\ugsx1com\errorpagestrings[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bm8skz0v\background_gradient[1]
%TEMP%\09cc081a7cd9e19f7104b00b5f330e3c.ini

Network activity

Connects to