Trojan.DownLoader46.59504

Technical Information

Malicious functions

To complicate detection of its presence in the operating system,

blocks execution of the following system utilities:

Windows Defender

Searches for windows to

detect analytical utilities:

ClassName: 'SmartSniff', WindowName: ''
ClassName: 'PROCEXPL', WindowName: ''

Modifies file system

Creates the following files

%TEMP%\etilqs_5xaz3bgqwmpiihd
%TEMP%\etilqs_planhgigqbd1qlu
%TEMP%\etilqs_knblpkz5ir2c4dv
%TEMP%\etilqs_5de6nu84sk9joo4
%TEMP%\etilqs_i5cubyv6bqmdhih
%TEMP%\etilqs_oirp8ymnky3geqm
%TEMP%\etilqs_btwnxjofolqmxuv
%TEMP%\etilqs_sbg7ofjgmg9mnci
%TEMP%\etilqs_edcx6d4ifmgryw1
%TEMP%\etilqs_grinc95h81ofuij

Network activity

Connects to

'au######te.geo.opera.com':80
'fa###ook.com':80
'si#####ck2.opera.com':443
're###.opera.com':80
'ya###.opera.com':80
'si#####ck2.opera.com':80
'en.###ipedia.org':443
'en.###ipedia.org':80
'am##on.com':443
'se####.yahoo.com':443
'bing.com':80
'am##on.com':80
'du###uckgo.com':443
'se####.yahoo.com':80
'google.com':80
'au######te.geo.opera.com':443
'fa###ook.com':443
'ar###ore.xyz':443

TCP

HTTP GET requests

http://au######te.geo.opera.com/geolocation/
http://www.google.com/favicon.ico
http://se####.yahoo.com/favicon.ico
http://www.am##on.com/favicon.ico
http://www.bing.com/s/a/bing_p.ico
http://en.###ipedia.org/favicon.ico
http://si#####ck2.opera.com/?ho###################################################
http://ya###.opera.com/favicon.ico
http://re###.opera.com/favicon.ico
http://re###.opera.com/www.opera.com/firstrun/
http://re###.opera.com/speeddials/partner/facebook
http://www.fa###ook.com/campaign/landing.php?ca#########################

Other

'au######te.geo.opera.com':443
'du###uckgo.com':443
'se####.yahoo.com':443
'am##on.com':443
'en.###ipedia.org':443
'ya###.opera.com':443
'si#####ck2.opera.com':443
'fa###ook.com':443
'ar###ore.xyz':443

UDP

DNS ASK google.com
DNS ASK au######te.geo.opera.com
DNS ASK se####.yahoo.com
DNS ASK du###uckgo.com
DNS ASK am##on.com
DNS ASK bing.com
DNS ASK bi##.#ikimedia.org
DNS ASK en.###ipedia.org
DNS ASK si#####ck2.opera.com
DNS ASK ya###.opera.com
DNS ASK op##a.com
DNS ASK re###.opera.com
DNS ASK fa###ook.com
DNS ASK ar###ore.xyz

Miscellaneous

Searches for the following windows

ClassName: 'dbgviewClass' WindowName: ''
ClassName: 'SocketSniff' WindowName: ''
ClassName: 'TStdHttpAnalyzerForm' WindowName: ''
ClassName: 'XTPMainFrame' WindowName: ''
ClassName: 'Window' WindowName: ''
ClassName: 'ProcessHacker' WindowName: ''
ClassName: 'Qt5QWindowIcon' WindowName: 'x64dbg'
ClassName: 'Opera_MessageWindow' WindowName: '%APPDATA%\Opera Software\Opera Stable'

Executes the following

'<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "<Full path to file>"
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2744.11.1787765271\278278904" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2744.10.2140879280\1361540549" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' --type=utility --channel="2744.4.1422786400\73246084" --lang=en-US --no-sandbox --enable-proprietary-media-types-playback /prefetch:-645351001 /crash-reporter-parent-id=1464
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2744.9.1478339679\1264692228" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2744.8.1966774548\1145888804" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2744.7.528773036\800325581" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2744.6.341704083\7979886" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2744.5.604856810\1963698744" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2744.4.1422786400\73246084" --lang=en-US --no-sandbox --enable-proprietary-media-types-playback /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=renderer --alt-high-dpi-setting=96 --disable-direct-npapi-requests --enable-deferred-image-decoding --lang=en-US --enable-proprietary-media-types-playback --extension-process --enable-we...
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=renderer --alt-high-dpi-setting=96 --disable-direct-npapi-requests --enable-deferred-image-decoding --lang=en-US --enable-proprietary-media-types-playback --disable-client-side-phishing-...
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=gpu-process --channel="2744.0.1593431204\1590621227" --enable-proprietary-media-types-playback --supports-dual-gpus=false --gpu-driver-bug-workarounds=1,19,42 --gpu-vendor-id=0x0000 --gp...
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' -noautoupdate --ran-launcher -- https://artecore.xyz/ /crash-reporter-parent-id=2744
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' -noautoupdate --ran-launcher -- https://artecore.xyz/
'%ProgramFiles(x86)%\opera\launcher.exe' -noautoupdate -- "https://artecore.xyz/"
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2744.12.1118268275\2006106460" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2744.15.731272241\1689061068" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001