Trojan.DownLoader26.48853

Technical Information

To ensure autorun and distribution:

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\ComputerZ] 'ImagePath' = '%TEMP%\7ZipSfx.000\ComputerZ.sys'

Modifies file system:

Creates the following files:

%TEMP%\7ZipSfx.000\BenchmarkData\core.spk
%TEMP%\7ZipSfx.000\nBench\BenchmarkLauncher.exe
%TEMP%\7ZipSfx.000\MiniUI.dll
%TEMP%\7ZipSfx.000\LiveUpd360.dll
%TEMP%\7ZipSfx.000\LDSBenchmark.dll
%TEMP%\7ZipSfx.000\DrvMgr\oauthlogin.exe
%TEMP%\7ZipSfx.000\DrvMgr\dynlenv.dll
%TEMP%\7ZipSfx.000\DrvMgr\DrvMgrUI.dll
%TEMP%\7ZipSfx.000\DrvMgr\DrvmgrCore.dll
%TEMP%\7ZipSfx.000\DrvMgr\DrvMgr.exe
%TEMP%\7ZipSfx.000\nBench\BenchmarkLauncher_x64.exe
%TEMP%\7ZipSfx.000\DrvMgr\DrvInst64.exe
%TEMP%\7ZipSfx.000\DrvMgr\DIFxAPI_x86.dll
%TEMP%\7ZipSfx.000\DrvMgr\cloudcom2.dll
%TEMP%\7ZipSfx.000\DrvMgr\7za.dll
%TEMP%\7ZipSfx.000\DrvMgr\360NetUL.dll
%TEMP%\7ZipSfx.000\DrvMgr\360NetBase.dll
%TEMP%\7ZipSfx.000\DrvMgr\360Login.dll
%TEMP%\7ZipSfx.000\DrvMgr\360Common.dll
%TEMP%\7ZipSfx.000\DataMgr_x64.dll
%TEMP%\7ZipSfx.000\DataMgr.dll
%TEMP%\7ZipSfx.000\DrvMgr\DownloadMgr.dll
%TEMP%\7ZipSfx.000\Safelive.dll
%APPDATA%\Microsoft\Protect\CREDHIST
%TEMP%\7ZipSfx.000\nBench\ComputerZ_Bench.dll
%TEMP%\7ZipSfx.000\Log\ComputerZ_HardwareDll.log
%TEMP%\7ZipSfx.000\Utils\ComputerZ12_x64.dll
%TEMP%\7ZipSfx.000\sweeper\HardwareCleaner.dll
%TEMP%\7ZipSfx.000\sweeper\CleanPageEngine.dll
%TEMP%\7ZipSfx.000\sweeper\CleanPage.dll
%TEMP%\7ZipSfx.000\sqlite3.dll
%TEMP%\7ZipSfx.000\softmgr\SoftMgr.dll
%TEMP%\7ZipSfx.000\SiteUIHelper.dll
%TEMP%\7ZipSfx.000\sites.dll
%TEMP%\7ZipSfx.000\ComputerZ_x64.sys
%TEMP%\7ZipSfx.000\SignHelper.dll
%TEMP%\7ZipSfx.000\PowerSaveZ_x64.sys
%TEMP%\7ZipSfx.000\PowerSaveZ.sys
%TEMP%\7ZipSfx.000\PDown.dll
%TEMP%\7ZipSfx.000\nBench\OCLBenchmark.dll
%TEMP%\7ZipSfx.000\nBench\Display3DEx.exe
%TEMP%\7ZipSfx.000\nBench\D3DX9_43.dll
%TEMP%\7ZipSfx.000\nBench\d3dx11_43.dll
%TEMP%\7ZipSfx.000\nBench\D3DCompiler_43.dll
%TEMP%\7ZipSfx.000\nBench\ComputerZ_Bench_x64.dll
%TEMP%\7ZipSfx.000\nBench\BenchmarkPage.dll
%TEMP%\7ZipSfx.000\nBench\BenchmarkSuite.dll
%TEMP%\7ZipSfx.000\ComputerZ_PowerSaveDll.dll
%TEMP%\7ZipSfx.000\Themes\Default\GamePage\GamePage_Theme.ui
%TEMP%\7ZipSfx.000\Themes\Default\default_theme.ui
%TEMP%\7ZipSfx.000\Themes\Default\CleanPage\clean_page_theme.xml
%TEMP%\7ZipSfx.000\Themes\Default\CleanPage\CleanPage_Theme.ui
%TEMP%\7ZipSfx.000\Themes\Default\BenchmarkPage\BenchmarkPage_theme.xml
%TEMP%\7ZipSfx.000\Themes\Default\BenchmarkPage\BenchmarkPage_theme.ui
%TEMP%\7ZipSfx.000\sweeper\tracesweeper.dat
%TEMP%\7ZipSfx.000\sweeper\RubbishCleanEngine.dat
%TEMP%\7ZipSfx.000\SchemeLib.dat
%TEMP%\7ZipSfx.000\ProcSpecial.dat
%TEMP%\7ZipSfx.000\Themes\Default\DownMgr\DownMgr_theme.ui
%TEMP%\7ZipSfx.000\nBench\NNET.DAT
%TEMP%\7ZipSfx.000\HWParams.dat
%TEMP%\7ZipSfx.000\DrvMgr\normal.dat
%TEMP%\7ZipSfx.000\DrvMgr\config\defaultskin\MiniUI.xml
%TEMP%\7ZipSfx.000\DrvMgr\config\defaultskin\defaultskin.ui
%TEMP%\7ZipSfx.000\DrvMgr\config\config.xml
%TEMP%\7ZipSfx.000\deviceid.ini
%TEMP%\7ZipSfx.000\ComputerZ.set
%TEMP%\7ZipSfx.000\ComputerZ.dat
%TEMP%\7ZipSfx.000\BenchmarkData\lds.spk
%TEMP%\7ZipSfx.000\Monitors.dat
%TEMP%\7ZipSfx.000\ComputerZ10.dll
%TEMP%\7ZipSfx.000\ComputerZ_CN.exe
%TEMP%\7ZipSfx.000\Themes\Default\GamePage\GamePage_theme.xml
%TEMP%\7ZipSfx.000\ComputerZService.exe
%TEMP%\7ZipSfx.000\ComputerZLock_x64.sys
%TEMP%\7ZipSfx.000\ComputerZLock.sys
%TEMP%\7ZipSfx.000\ComputerZ7_x64.dll
%TEMP%\7ZipSfx.000\ComputerZ7.dll
%TEMP%\7ZipSfx.000\ComputerZ5.dll
%TEMP%\7ZipSfx.000\ComputerZ4_x64.dll
%TEMP%\7ZipSfx.000\ComputerZ4.dll
%TEMP%\7ZipSfx.000\ComputerZ2.dll
%TEMP%\7ZipSfx.000\ComputerZ_HardwareDll.dll
%TEMP%\7ZipSfx.000\ComputerZ11.dll
%TEMP%\7ZipSfx.000\ComputerZ1.dll
%TEMP%\7ZipSfx.000\ComputerZ.sys
%TEMP%\7ZipSfx.000\atiags32.dll
%TEMP%\7ZipSfx.000\360P2SP.dll
%TEMP%\7ZipSfx.000\360net.dll
%TEMP%\7ZipSfx.000\360Base64.dll
%TEMP%\7ZipSfx.000\360Base.dll
%TEMP%\7ZipSfx.000\Themes\Default\LdsLite\LdsLite_theme.xml
%TEMP%\7ZipSfx.000\Themes\Default\LdsLite\LdsLite_theme.ui
%TEMP%\7ZipSfx.000\Themes\Default\DownMgr\downmgr_theme.xml
%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\c6d010e82392216311e3dad96d6d8568_23ef5514-3059-436f-a4a7-4cefaab20eb1

Deletes the following files:

%TEMP%\7ZipSfx.000\HWParams.dat
%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\c6d010e82392216311e3dad96d6d8568_23ef5514-3059-436f-a4a7-4cefaab20eb1

Substitutes the following files:

%TEMP%\7ZipSfx.000\HWParams.dat

Network activity:

Connects to:

's.###ashi.com':80
's2.##dashi.com':80
'localhost':1045
'l.#####c.ludashi.com':80

TCP:

HTTP GET requests:

http://s.###ashi.com/url2?pi##################################################################################################
http://s.###ashi.com/url2?pi###################################################################################################
http://s2.##dashi.com/cab/list01.cab
http://s2.##dashi.com/cab/logo.cab

UDP: