Trojan.DownLoader30.36478

Technical Information

Malicious functions

Modifies settings of Windows Internet Explorer

[<HKCU>\Software\Microsoft\windows\CurrentVersion\Internet Settings] 'ProxyOverride' = '<Local>'

Modifies file system

Creates the following files

%TEMP%\tfrf8b0.tmp
%APPDATA%\video downloader(xmlbar)\appdata\xmlbarver.ini.part
%LOCALAPPDATA%\microsoft\internet explorer\domstore\p4p79gg0\www.xmlbar[1].xml
%LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\index.dat
%APPDATA%\microsoft\windows\cookies\low\index.dat
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\57z1owev\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\ok5sx2ra\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\4ygh7pwu\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\aibzc04n\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
%LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
%LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
%LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012019110720191108\index.dat
%APPDATA%\video downloader(xmlbar)\config\domain.ini.part
%APPDATA%\video downloader(xmlbar)\config\flvrules.initmp.part
%APPDATA%\video downloader(xmlbar)\config\flvrules.initmp1

Sets the 'hidden' attribute to the following files

%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\aibzc04n\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\4ygh7pwu\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\ok5sx2ra\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\57z1owev\desktop.ini
%LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini

Deletes the following files

%APPDATA%\video downloader(xmlbar)\config\flvrules.initmp

Moves the following files

from %APPDATA%\video downloader(xmlbar)\config\domain.ini.part to %APPDATA%\video downloader(xmlbar)\config\domain.ini
from %APPDATA%\video downloader(xmlbar)\appdata\xmlbarver.ini.part to %APPDATA%\video downloader(xmlbar)\appdata\xmlbarver.ini
from %APPDATA%\video downloader(xmlbar)\config\flvrules.initmp.part to %APPDATA%\video downloader(xmlbar)\config\flvrules.initmp
from %APPDATA%\video downloader(xmlbar)\config\flvrules.initmp1 to %APPDATA%\video downloader(xmlbar)\config\flvrules.ini

Network activity

TCP

HTTP GET requests

http://www.ac###rowser.com/xbdomain2.php?23##########################
http://13#.#24.238.147/favicon/tudou.png
http://13#.#24.238.147/favicon/sohu.png
http://13#.#24.238.147/favicon/cntv.png
http://13#.#24.238.147/favicon/qq.png
http://13#.#24.238.147/favicon/dailymotion.png
http://13#.#24.238.147/favicon/tumblr.png
http://13#.#24.238.147/favicon/facebook.png
http://13#.#24.238.147/images/oaqrcode.jpg
http://13#.#24.238.147/favicon/twitter.png
http://13#.#24.238.147/favicon/youtube.png
http://13#.#24.238.147/images/sniff.png
http://13#.#24.238.147/favicon/browser.png
http://13#.#24.238.147/images/facebook.png
http://13#.#24.238.147/images/twitter.png
http://13#.#24.238.147/api_rule14.php?la##########
http://13#.#24.238.147/favicon/youku.png
http://13#.#24.238.147/videover3.php?la#############################
http://13#.#24.238.147/js/jquery-1.9.1.min.js
http://pa#####.#ooglesyndication.com/pagead/js/adsbygoogle.js
http://www.xm##ar.net/qvideo2.php?la##########
http://www.yo##ube.com/
http://13#.#24.238.147/images/searchbox.png
http://13#.#24.238.147/images/wechatscan.jpg
http://13#.#24.238.147/favicon/instagram.png
http://13#.#24.238.147/images/logo09429.jpg
http://13#.#24.238.147/images/top.gif
http://13#.#24.238.147/images/initclose.gif
http://13#.#24.238.147/js/qrcode.min.js
http://13#.#24.238.147/include/script_common.js
http://13#.#24.238.147/api_histad.php?la##########
http://13#.#24.238.147/api_video67.php?ty##############################################################################
http://13#.#24.238.147/images/Google+.png
http://13#.#24.238.147/images/email.png