Trojan.DownLoader25.50855

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Lantern' = '"<Full path to file>" -startup'

Malicious functions:

Creates and executes the following:

'%APPDATA%\byteexec\sysproxy-cmd.exe' show
'%APPDATA%\byteexec\sysproxy-cmd.exe' wait-and-cleanup 127.0.0.1 1066
'%APPDATA%\byteexec\sysproxy-cmd.exe' on 127.0.0.1 1066

Executes the following:

'%ProgramFiles%\Internet Explorer\IEXPLORE.EXE' -nohome
'<SYSTEM32>\rundll32.exe' url.dll,FileProtocolHandler http://lo###########################################################################################################################
'<SYSTEM32>\cmd.exe' ver

Modifies settings of Windows Internet Explorer:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyOverride' = '<local>'
[<HKLM>\SYSTEM\ControlSet001\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings] 'ProxyEnable' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyEnable' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyServer' = '127.0.0.1:1066'

Modifies file system:

Creates the following files:

%APPDATA%\Lantern\settings.yaml
%TEMP%\notifu-notifier019710843\notifu.exe
%APPDATA%\Lantern\proxystats.csv.tmp
%APPDATA%\byteexec\certimporter.exe
%APPDATA%\systray\systray386.dll
%APPDATA%\byteexec\sysproxy-cmd.exe

Moves the following files:

from %APPDATA%\Lantern\proxystats.csv.tmp to %APPDATA%\Lantern\proxystats.csv

Substitutes the following files:

%APPDATA%\Lantern\proxystats.csv
%APPDATA%\Lantern\proxystats.csv.tmp

Network activity:

Connects to:

'13.#2.4.176':443
'52.##2.132.36':443
'13.#2.4.14':443
'54.##0.0.224':443
'20#.#51.212.9':443
'54.##2.20.235':443
'54.##0.0.218':443
'13.##.20.191':443
'52.##2.132.79':443
'13.#2.4.77':443
'52.#4.10.95':443
'54.##2.20.98':443
'52.#4.10.71':443
'52.##.10.112':443
'54.##0.15.73':443
'13.##.16.245':443
'13.#2.4.130':443
'13.#2.4.246':443
'13.#2.4.62':443
'54.##2.22.159':443
'13.#2.4.213':443
'54.##2.20.20':443
'13.#2.4.220':443
'13.#2.16.71':443
'52.#4.7.112':443
'52.##.10.238':443
'54.##0.0.143':443
'54.##0.0.178':443
'52.##2.132.131':443
'52.##.10.210':443
'54.##0.7.108':443
'54.##2.22.236':443
'13.##.16.190':443
'13.#2.16.73':443
'13.#2.4.86':443
'54.##0.7.106':443
'54.##2.20.219':443
'54.##0.15.160':443
'13.##.16.167':443
'54.##2.22.42':443
'54.##2.22.19':443
'52.#4.7.65':443
'54.##0.7.243':443
'13.##.20.154':443
'52.#4.7.69':443
'13.##.16.177':443
'52.##2.136.164':443
'54.#30.7.11':443
'13.#2.4.190':443
'52.##2.132.253':443
'52.##2.136.153':443
'52.#4.7.21':443
'13.##.16.209':443
'52.##2.136.82':443
'54.##0.7.189':443
'52.##2.132.117':443
'54.##0.0.229':443
'52.##2.132.154':443
'52.##2.136.34':443
'13.#2.20.61':443
'54.##2.2.237':443
'52.##2.136.72':443
'13.#2.4.59':443
'52.##2.136.69':443
'13.#2.4.92':443
'13.##.16.214':443
'13.#2.4.46':443
'54.##0.15.193':443
'13.#2.16.42':443
'52.##2.136.59':443
'54.##2.2.116':443
'52.##2.132.174':443
'54.##0.15.234':443
'54.##0.7.222':443
'54.##2.2.163':443
'52.##.10.109':443
'13.##.16.203':443
'13.##.16.227':443
'52.##2.132.23':443
'54.##0.15.173':443
'13.#2.4.161':443
'13.##.20.235':443
'54.##0.15.189':443
'52.##2.136.145':443
'52.##.10.161':443
'13.#2.4.42':443
'52.#4.10.48':443
'13.#2.4.132':443
'13.##.16.101':443
'13.##.20.107':443
'13.#2.4.29':443
'54.##2.2.129':443
'52.#4.7.85':443
'13.#2.4.54':443
'54.##2.20.155':443
'13.##.20.105':443
'54.#82.2.39':443
'13.#2.20.95':443
'52.#4.10.62':443
'54.##0.15.142':443
'54.##2.22.45':443
'54.##2.22.61':443
'52.#4.10.58':443
'52.##2.136.128':443
'13.#2.16.59':443
'54.##2.20.99':443
'13.#2.4.219':443
'54.##2.2.196':443
'52.##2.136.123':443
'52.##2.136.183':443
'54.##2.22.228':443
'52.##2.136.135':443
'13.##.16.128':443
'54.##2.2.155':443
'54.#30.0.37':443
'13.##.16.250':443
'52.##.10.163':443
'52.##2.136.252':443
'54.##2.20.101':443
'52.#4.10.5':443
'54.##0.0.100':443
'52.#4.10.8':443
'54.#92.22.5':443
'52.#4.7.136':443
'52.##2.132.118':443
'52.##.10.187':443
'13.##.16.246':443
'52.##.10.177':443
'54.##0.0.163':443
'52.##2.132.38':443
'13.#2.4.245':443
'54.##2.20.61':443
'54.##0.0.122':443
'54.##2.22.142':443
'52.##2.132.55':443
'13.#2.16.39':443
'13.##.20.114':443
'54.##0.7.237':443
'54.##0.0.111':443
'13.#2.4.122':443
'52.#4.7.237':443
'13.#2.4.202':443
'13.#2.20.25':443
'54.##2.22.243':443
'54.##0.15.243':443
'54.#92.22.7':443
'52.##.10.151':443
'13.##.16.156':443
'13.##.20.174':443
'54.##0.0.202':443
'54.##2.22.49':443
'52.##2.132.94':443
'54.#82.2.47':443
'52.##.10.121':443
'52.#4.7.91':443
'54.##2.22.101':443
'13.##.20.183':443
'13.#2.4.119':443
'54.##2.2.153':443
'13.#2.20.20':443
'13.#2.4.225':443
'52.#4.7.215':443
'54.##2.22.148':443
'52.##2.136.193':443
'13.#2.20.39':443
'54.##2.20.232':443
'54.##0.15.154':443
'54.##2.22.183':443
'52.##2.136.7':443
'54.##0.7.251':443
'54.##2.20.149':443
'52.##2.136.116':443
'54.##2.5.199':443
'54.##2.20.136':443
'52.##.10.196':443
'54.##2.20.81':443
'54.##2.22.253':443
'52.##2.132.250':443
'54.##0.0.215':443
'13.##.20.168':443
'13.#2.4.102':443
'54.##2.20.92':443
'13.#2.16.7':443
'52.##.10.223':443
'54.##2.2.151':443
'52.##2.132.106':443
'54.##2.2.109':443
'54.#30.7.66':443
'54.##2.2.193':443
'52.##2.136.58':443
'54.##2.2.197':443
'13.#2.4.222':443
'52.#4.7.225':443
'localhost':1051
'52.##.10.144':443
'54.##2.20.144':443
'13.##.20.119':443
'localhost':1610
'13.#2.4.25':443
'54.##0.15.90':443
'52.##.10.123':443
'13.#2.4.48':443
'52.##2.132.230':443
'52.#4.7.250':443
'54.#30.0.20':443
'52.##2.132.237':443
'52.#4.10.66':443
'54.##2.2.210':443
'52.##2.136.139':443
'52.##.10.242':443
'52.##.10.218':443
'21#.#37.36.129':443
'54.##2.22.210':443
'52.#4.7.29':443
'52.##2.136.50':443
'54.##0.0.235':443
'52.#4.7.247':443
'52.##2.136.159':443
'52.##2.132.247':443
'52.##2.132.12':443
'54.#30.7.75':443
'54.#30.0.30':443
'52.##2.132.37':443
'54.##2.22.113':443
'54.##2.2.218':443
'13.#2.4.28':443
'54.##0.0.187':443
'52.##2.136.117':443
'54.##0.15.110':443
'54.##2.20.178':443
'52.#4.7.41':443
'52.##.10.114':443
'52.##.10.197':443
'54.##0.15.102':443
'13.##.20.124':443
'13.#2.4.196':443
'52.##2.132.73':443
'13.#2.20.17':443
'20#.#51.212.186':443
'13.##.20.145':443
'54.##2.22.139':443
'52.##2.136.105':443
'54.##0.15.61':443
'13.#2.4.96':443
'54.##0.15.253':443
'54.##2.20.126':443
'52.#4.10.67':443
'54.#82.2.82':443
'52.##.10.142':443
'52.##.10.224':443
'54.##2.20.91':443
'54.##0.0.231':443
'54.##0.0.177':443
'54.#82.2.44':443
'52.##2.132.40':443
'13.#2.16.79':443
'54.##2.2.203':443
'52.##.10.222':443
'13.##.16.111':443
'54.#82.2.72':443
'13.#2.16.44':443
'52.#4.7.115':443
'54.##0.0.249':443
'45.##.44.161':10489
'52.##2.132.48':443
'54.##0.15.175':443
'54.##2.22.23':443
'54.##0.7.129':443
'52.#4.7.190':443
'52.##2.132.72':443
'52.##.10.214':443
'13.##.20.151':443
'52.##2.136.161':443
'52.#4.7.201':443
'13.##.16.217':443
'10#.#1.223.217':13730
'ra#.####ubusercontent.com':443
'54.##0.15.143':443
'54.#82.2.17':443
'54.#30.7.26':443
'54.##0.7.176':443
'54.##2.20.94':443
'13.##.20.207':443
'54.#82.2.30':443
'54.##0.15.111':443
'13.#2.4.144':443
'54.##2.22.184':443
'54.##0.15.23':443
'13.##.20.251':443
'54.#82.2.41':443
'54.##2.2.227':443
'54.#30.0.7':443
'54.##0.0.195':443
'54.##2.22.190':443
'54.#92.20.9':443
'54.##0.15.29':443
'52.##2.132.149':443
'13.#2.16.96':443
'54.#30.7.25':443
'54.##2.22.161':443
'54.#30.7.68':443
'54.##2.2.121':443
'54.##2.20.54':443
'52.##.10.169':443
'52.##2.132.155':443
'54.##0.15.130':443
'54.#30.0.39':443
'52.##2.136.199':443
'52.#4.7.78':443
'13.#2.20.7':443
'54.##0.7.109':443
'54.##2.2.130':443
'54.##2.20.44':443
'54.##2.2.248':443
'54.##2.2.145':443
'52.#4.7.33':443
'52.##.10.206':443
'54.##0.0.253':443
'52.##.10.141':443
'54.##0.7.238':443
'52.##2.132.134':443
'13.#2.4.116':443
'54.##0.0.204':443
'54.#30.0.41':443
'52.#4.10.13':443
'54.##2.20.117':443
'54.##2.20.230':443
'54.##0.15.30':443
'45.##.155.211':12983
'54.#30.0.91':443
'54.##2.20.59':443
'ea########ownloads.adblockplus.org':443
'52.##2.136.55':443
'54.##2.2.250':443
'52.##2.132.236':443
'52.##2.132.95':443
'52.##2.132.142':443
'localhost':1066
'13.##.16.117':443
'54.#30.0.26':443
'20#.#51.251.180':443
'13.#2.20.46':443
'52.##2.132.161':443
'45.##.201.147':443
'54.##2.22.115':443
'54.##2.22.90':443
'13.##.16.201':443
'13.##.16.210':443
'13.#2.16.16':443
'52.#4.7.19':443
'52.##2.132.66':443
'52.##2.136.208':443
'52.##2.132.199':443
'52.#4.10.65':443
'13.##.16.119':443
'52.##2.136.215':443
'45.##.178.100':13332
'52.#4.7.254':443
'52.##2.136.87':443
'54.##2.2.208':443
'54.##2.22.252':443
'52.##2.132.108':443
'13.#2.4.9':443
'54.#30.7.65':443
'54.##2.20.60':443
'54.##2.2.177':443
'54.##2.20.192':443
'54.##2.22.82':443
'13.#2.4.104':443
'52.##2.136.236':443
'54.#82.2.93':443
'20#.#51.207.63':443
'52.#4.7.16':443
'54.##0.15.76':443
'54.##2.22.213':443
'52.##2.136.92':443
'54.##2.20.12':443
'13.#2.20.49':443
'13.#2.20.96':443
'54.##2.20.212':443
'13.##.20.171':443
'54.##2.22.39':443
'54.##0.0.149':443
'45.#7.133.5':443
'52.##.10.157':443
's3.###zonaws.com':443
'54.##2.20.122':443
'52.#4.7.17':443
'54.##0.7.136':443
'52.##2.132.138':443
'54.##2.20.153':443
'54.##2.20.58':443
'13.#2.20.91':443
'54.##2.22.114':443
'13.##.16.200':443
'52.##2.132.141':443
'54.##2.20.75':443
'13.#2.4.146':443
'54.##0.15.195':443
'52.##2.132.210':443
'13.##.20.215':443
'13.#2.4.110':443
'54.##0.15.64':443
'13.#2.4.237':443
'52.#4.7.75':443
'13.#2.20.22':443
'54.##2.20.162':443
'54.##2.2.132':443
'52.##2.132.137':443
'13.##.20.250':443
'54.##0.7.185':443
'13.#2.4.250':443
'54.##2.22.157':443
'54.##0.0.222':443
'13.##.16.244':443
'52.##2.132.10':443
'13.##.20.202':443
'54.##0.15.200':443
'54.##2.2.204':443
'13.#2.16.48':443
'54.##0.7.168':443
'13.#2.20.23':443
'52.##.10.195':443
'13.#2.8.42':443
'52.##2.132.6':443
'13.##.16.222':443
'13.#2.4.248':443
'13.##.20.243':443
'13.##.20.132':443
'52.##2.132.145':443
'52.##.10.165':443
'54.##0.15.168':443
'54.##2.22.41':443
'54.##0.15.22':443
'54.##0.7.150':443
'52.#4.10.69':443
'52.#4.7.134':443
'54.##0.15.169':443
'52.##2.136.107':443
'13.#2.20.54':443
'13.##.20.143':443
'54.##0.0.239':443
'54.##2.20.140':443
'54.##2.20.64':443
'54.##0.7.164':443
'54.##2.20.41':443
'54.##2.22.242':443
'52.#4.7.45':443
'54.##2.2.179':443
'52.##.10.205':443
'54.##2.22.104':443
'54.##0.15.81':443
'13.#2.20.99':443
'54.#30.0.45':443
'52.#4.10.30':443
'13.##.16.197':443
'52.##2.132.160':443
'52.#4.7.89':443
'54.##0.15.71':443
'13.##.20.228':443
'54.##0.15.121':443
'52.#4.10.50':443
'52.##2.136.176':443
'54.##0.15.182':443
'54.##2.2.185':443
'52.##.10.120':443
'52.#4.10.27':443
'54.##0.0.221':443
'54.##2.20.193':443
'54.#82.2.36':443
'54.##0.7.152':443
'54.##0.0.193':443
'54.##0.0.152':443
'54.##2.20.105':443
'54.#82.2.96':443
'52.##2.132.221':443
'54.##2.20.150':443
'52.##2.132.201':443
'54.##2.20.69':443
'54.#30.0.67':443
'54.##0.0.128':443
'54.##2.2.228':443
'13.##.16.140':443
'54.#30.0.89':443
'13.##.16.157':443
'54.##2.2.195':443
'54.##2.2.189':443
'52.##2.132.132':443
'54.#82.2.19':443
'54.##0.15.240':443
'54.##2.20.134':443
'13.##.20.247':443
'54.##2.2.244':443
'13.##.20.193':443
'13.#2.16.99':443
'54.##0.15.124':443
'52.##2.132.98':443
'54.##0.7.138':443
'13.#2.4.30':443
'13.##.20.229':443
'52.##.10.101':443
'13.##.16.196':443
'54.##0.0.251':443
'54.##2.22.118':443
'54.##0.15.80':443
'13.#2.4.212':443
'52.##2.136.249':443
'13.#2.16.93':443
'54.#82.2.13':443
'54.##0.0.164':443
'54.##2.22.11':443
'54.##0.15.145':443
'54.##0.15.201':443
'52.#4.7.98':443
'54.##2.20.204':443

TCP:

HTTP GET requests:

http://lo###host:1051/?to############################################################################################################ via localhost
http://lo###host:1051/main.6d4ec7c493966eb589dc77efe6b49c07.css via localhost
http://co####.getiantem.org/proxies.yaml.gz via localhost
http://ge#.##tiantem.org/lookup/ via localhost

UDP:

DNS ASK ra#.####ubusercontent.com
DNS ASK s3.###zonaws.com
DNS ASK ea########ownloads.adblockplus.org

Miscellaneous:

Searches for the following windows:

ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebcheckMonitor' WindowName: ''
ClassName: '' WindowName: ''
ClassName: 'IEFrame' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней