Trojan.DownLoader33.30247

Technical Information

Malicious functions

Injects code into

the following user processes:

cmd.exe

Modifies file system

Creates the following files

%TEMP%\test.txt
<Current directory>\cont\dmp\lzg\lazagne\softwares\sysadmin\apachedirectorystudio.py
<Current directory>\cont\dmp\lzg\lazagne\softwares\sysadmin\apachedirectorystudio.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\sysadmin\coreftp.py
<Current directory>\cont\dmp\lzg\lazagne\softwares\sysadmin\coreftp.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\sysadmin\cyberduck.py
<Current directory>\cont\dmp\lzg\lazagne\softwares\sysadmin\cyberduck.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\sysadmin\d3des.py
<Current directory>\cont\dmp\lzg\lazagne\softwares\sysadmin\d3des.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\sysadmin\filezilla.py
<Current directory>\cont\dmp\lzg\lazagne\softwares\sysadmin\filezilla.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\sysadmin\filezillaserver.py
<Current directory>\cont\dmp\lzg\lazagne\softwares\memory\libkeepass\hbio.py
<Current directory>\cont\dmp\lzg\lazagne\softwares\sysadmin\filezillaserver.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\sysadmin\ftpnavigator.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\sysadmin\iisapppool.py
<Current directory>\cont\dmp\lzg\lazagne\softwares\sysadmin\iisapppool.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\sysadmin\iiscentralcertp.py
<Current directory>\cont\dmp\lzg\lazagne\softwares\sysadmin\iiscentralcertp.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\sysadmin\keepassconfig.py
<Current directory>\cont\dmp\lzg\lazagne\softwares\sysadmin\keepassconfig.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\sysadmin\opensshforwindows.py
<Current directory>\cont\dmp\lzg\lazagne\softwares\sysadmin\opensshforwindows.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\sysadmin\openvpn.py
<Current directory>\cont\dmp\lzg\lazagne\softwares\sysadmin\openvpn.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\sysadmin\puttycm.py
<Current directory>\cont\dmp\lzg\lazagne\softwares\svn\tortoise.py
<Current directory>\cont\dmp\lzg\lazagne\softwares\sysadmin\ftpnavigator.py
<Current directory>\cont\dmp\lzg\lazagne\softwares\svn\__init__.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\svn\tortoise.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\php\__init__.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\php\composer.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\mails\__init__.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\maven\mavenrepositories.py
<Current directory>\cont\dmp\lzg\lazagne\softwares\maven\mavenrepositories.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\maven\__init__.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\memory\keepass.py
<Current directory>\cont\dmp\lzg\lazagne\softwares\memory\keepass.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\memory\keethief.py
<Current directory>\cont\dmp\lzg\lazagne\softwares\memory\keethief.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\memory\libkeepass\common.py
<Current directory>\cont\dmp\lzg\lazagne\softwares\memory\libkeepass\common.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\memory\libkeepass\crypto.py
<Current directory>\cont\dmp\lzg\lazagne\softwares\sysadmin\puttycm.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\memory\libkeepass\crypto.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\mails\outlook.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\memory\libkeepass\hbio.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\memory\libkeepass\kdb4.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\memory\libkeepass\puresalsa20.py
<Current directory>\cont\dmp\lzg\lazagne\softwares\memory\libkeepass\puresalsa20.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\memory\libkeepass\__init__.py
<Current directory>\cont\dmp\lzg\lazagne\softwares\memory\libkeepass\__init__.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\memory\memorydump.py
<Current directory>\cont\dmp\lzg\lazagne\softwares\memory\memorydump.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\memory\__init__.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\multimedia\eyecon.py
<Current directory>\cont\dmp\lzg\lazagne\softwares\multimedia\eyecon.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\multimedia\__init__.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\mails\thunderbird.py
<Current directory>\cont\dmp\lzg\lazagne\softwares\php\composer.py
<Current directory>\cont\dmp\lzg\lazagne\softwares\memory\libkeepass\kdb4.py
<Current directory>\cont\dmp\lzg\lazagne\softwares\mails\thunderbird.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\sysadmin\rdpmanager.py
<Current directory>\cont\dmp\lzg\lazagne\softwares\sysadmin\vnc.py
<Current directory>\cont\dmp\lzg\lazagne\softwares\windows\credfiles.py
<Current directory>\cont\dmp\lzg\lazagne\softwares\windows\credfiles.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\windows\credman.py
<Current directory>\cont\dmp\lzg\lazagne\softwares\windows\credman.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\windows\hashdump.py
<Current directory>\cont\dmp\lzg\lazagne\softwares\windows\hashdump.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\windows\lsa_secrets.py
<Current directory>\cont\dmp\lzg\lazagne\softwares\windows\lsa_secrets.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\windows\ppypykatz.py
<Current directory>\cont\dmp\lzg\lazagne\softwares\windows\ppypykatz.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\windows\vault.py
<Current directory>\cont\dmp\lzg\lazagne\softwares\windows\vault.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\windows\creddump7\win32\rawreg.py
<Current directory>\cont\dmp\lzg\lazagne\softwares\windows\vaultfiles.py
<Current directory>\cont\dmp\lzg\lazagne\softwares\windows\windows.py
<Current directory>\cont\dmp\lzg\lazagne\softwares\windows\windows.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\windows\__init__.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\__init__.pyc
<Current directory>\cont\dmp\lzg\lazagne\__init__.pyc
<Current directory>\cont\dmp\lzg\lazagne.py
<Current directory>\cont\dmp\lzg\lazagne.spec
<Current directory>\cont\dmp\lzg\requirements.txt
<Current directory>\cont\ele1.py
<Current directory>\port.dat
<Current directory>\ip.dat
<Current directory>\id.dat
<Current directory>\cont\dmp\lzg\lazagne\softwares\windows\creddump7\win32\__init__.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\windows\creddump7\__init__.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\windows\creddump7\win32\rawreg.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\windows\creddump7\win32\lsasecrets.pyc
<Current directory>\cont\dmp\lzg\lazagne\config\run.py
<Current directory>\cont\dmp\lzg\lazagne\softwares\sysadmin\vnc.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\sysadmin\winscp.py
<Current directory>\cont\dmp\lzg\lazagne\softwares\sysadmin\winscp.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\sysadmin\wsl.py
<Current directory>\cont\dmp\lzg\lazagne\softwares\sysadmin\wsl.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\sysadmin\__init__.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\wifi\wifi.py
<Current directory>\cont\dmp\lzg\lazagne\softwares\wifi\wifi.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\wifi\__init__.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\windows\autologon.py
<Current directory>\cont\dmp\lzg\lazagne\softwares\windows\autologon.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\sysadmin\rdpmanager.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\sysadmin\unattended.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\sysadmin\unattended.py
<Current directory>\cont\dmp\lzg\lazagne\softwares\windows\cachedump.py
<Current directory>\cont\dmp\lzg\lazagne\softwares\windows\creddump7\newobj.py
<Current directory>\cont\dmp\lzg\lazagne\softwares\windows\creddump7\newobj.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\windows\creddump7\object.py
<Current directory>\cont\dmp\lzg\lazagne\softwares\windows\creddump7\object.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\windows\creddump7\types.py
<Current directory>\cont\dmp\lzg\lazagne\softwares\windows\creddump7\types.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\windows\creddump7\win32\domcachedump.py
<Current directory>\cont\dmp\lzg\lazagne\softwares\windows\creddump7\win32\domcachedump.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\windows\creddump7\win32\hashdump.py
<Current directory>\cont\dmp\lzg\lazagne\softwares\windows\creddump7\win32\hashdump.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\windows\creddump7\win32\lsasecrets.py
<Current directory>\cont\dmp\lzg\lazagne\softwares\windows\cachedump.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\windows\creddump7\addrspace.py
<Current directory>\cont\dmp\lzg\lazagne\softwares\windows\creddump7\addrspace.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\mails\outlook.py
<Current directory>\cont\dmp\lzg\lazagne\softwares\git\__init__.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\git\gitforwindows.pyc
<Current directory>\cont\dmp\lzg\lazagne\config\dpapi\masterkey.py
<Current directory>\cont\dmp\lzg\lazagne\config\dpapi\masterkey.pyc
<Current directory>\cont\dmp\lzg\lazagne\config\dpapi\system.py
<Current directory>\cont\dmp\lzg\lazagne\config\dpapi\system.pyc
<Current directory>\cont\dmp\lzg\lazagne\config\dpapi\vault.py
<Current directory>\cont\dmp\lzg\lazagne\config\dpapi\vault.pyc
<Current directory>\cont\dmp\lzg\lazagne\config\dpapi\__init__.py
<Current directory>\cont\dmp\lzg\lazagne\config\dpapi\__init__.pyc
<Current directory>\cont\dmp\lzg\lazagne\config\dpapi_structure.py
<Current directory>\cont\dmp\lzg\lazagne\config\dpapi_structure.pyc
<Current directory>\cont\dmp\lzg\lazagne\config\execute_cmd.py
<Current directory>\cont\dmp\lzg\lazagne\config\execute_cmd.pyc
<Current directory>\cont\dmp\lzg\lazagne\config\lib\memorpy\structures.pyc
<Current directory>\cont\dmp\lzg\lazagne\config\lib\memorpy\address.py
<Current directory>\cont\dmp\lzg\lazagne\config\lib\memorpy\baseprocess.py
<Current directory>\cont\dmp\lzg\lazagne\config\lib\memorpy\baseprocess.pyc
<Current directory>\cont\dmp\lzg\lazagne\config\lib\memorpy\linprocess.py
<Current directory>\cont\dmp\lzg\lazagne\config\lib\memorpy\linstructures.py
<Current directory>\cont\dmp\lzg\lazagne\config\lib\memorpy\locator.py
<Current directory>\cont\dmp\lzg\lazagne\config\lib\memorpy\locator.pyc
<Current directory>\cont\dmp\lzg\lazagne\config\lib\memorpy\memworker.py
<Current directory>\cont\dmp\lzg\lazagne\config\lib\memorpy\memworker.pyc
<Current directory>\cont\dmp\lzg\lazagne\config\lib\memorpy\osxprocess.py
<Current directory>\cont\dmp\lzg\lazagne\config\lib\memorpy\process.py
<Current directory>\cont\dmp\lzg\lazagne\config\lib\memorpy\process.pyc
<Current directory>\cont\dmp\lzg\lazagne\config\dpapi\crypto.pyc
<Current directory>\cont\dmp\lzg\lazagne\config\dpapi\crypto.py
<Current directory>\cont\dmp\lzg\lazagne\config\dpapi\eater.pyc
<Current directory>\cont\dmp\lzg\lazagne\config\dpapi\credhist.pyc
<Current directory>\cont\dmp\lzg\lazagne\config\dpapi\credhist.py
%TEMP%\obf.usc
%TEMP%\~jylwahj.zip
<Current directory>\cont\dmp\chr\main.py
<Current directory>\cont\dmp\ff\firepwd.py
<Current directory>\cont\dmp\lzg\lazagne\config\change_privileges.py
<Current directory>\cont\dmp\lzg\lazagne\config\change_privileges.pyc
<Current directory>\cont\dmp\lzg\lazagne\config\constant.py
<Current directory>\cont\dmp\lzg\lazagne\config\constant.pyc
<Current directory>\cont\dmp\lzg\lazagne\config\crypto\pyaes\aes.py
<Current directory>\cont\dmp\lzg\lazagne\config\crypto\pyaes\aes.pyc
<Current directory>\cont\dmp\lzg\lazagne\config\crypto\pyaes\blockfeeder.py
<Current directory>\cont\dmp\lzg\lazagne\config\crypto\pyaes\blockfeeder.pyc
<Current directory>\cont\dmp\lzg\lazagne\config\lib\memorpy\structures.py
<Current directory>\cont\dmp\lzg\lazagne\config\crypto\pyaes\util.py
<Current directory>\cont\dmp\lzg\lazagne\config\lib\memorpy\address.pyc
<Current directory>\cont\dmp\lzg\lazagne\config\crypto\pyaes\__init__.py
<Current directory>\cont\dmp\lzg\lazagne\config\crypto\pydes.py
<Current directory>\cont\dmp\lzg\lazagne\config\crypto\pydes.pyc
<Current directory>\cont\dmp\lzg\lazagne\config\crypto\rc4.py
<Current directory>\cont\dmp\lzg\lazagne\config\crypto\rc4.pyc
<Current directory>\cont\dmp\lzg\lazagne\config\crypto\__init__.pyc
<Current directory>\cont\dmp\lzg\lazagne\config\dico.py
<Current directory>\cont\dmp\lzg\lazagne\config\dico.pyc
<Current directory>\cont\dmp\lzg\lazagne\config\dpapi\blob.py
<Current directory>\cont\dmp\lzg\lazagne\config\dpapi\blob.pyc
<Current directory>\cont\dmp\lzg\lazagne\config\dpapi\credfile.py
<Current directory>\cont\dmp\lzg\lazagne\config\dpapi\credfile.pyc
<Current directory>\cont\dmp\lzg\lazagne\config\crypto\pyaes\util.pyc
%TEMP%\~ghgnqlc.exe
<Current directory>\cont\dmp\lzg\lazagne\config\crypto\pyaes\__init__.pyc
<Current directory>\cont\dmp\lzg\lazagne\config\dpapi\eater.py
<Current directory>\cont\dmp\lzg\lazagne\config\lib\memorpy\sunprocess.py
<Current directory>\cont\dmp\lzg\lazagne\softwares\chats\pidgin.py
<Current directory>\cont\dmp\lzg\lazagne\softwares\chats\psi.py
<Current directory>\cont\dmp\lzg\lazagne\softwares\chats\psi.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\chats\skype.py
<Current directory>\cont\dmp\lzg\lazagne\softwares\chats\skype.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\chats\__init__.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\databases\dbvis.py
<Current directory>\cont\dmp\lzg\lazagne\softwares\databases\dbvis.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\databases\postgresql.py
<Current directory>\cont\dmp\lzg\lazagne\softwares\databases\postgresql.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\databases\robomongo.py
<Current directory>\cont\dmp\lzg\lazagne\softwares\databases\robomongo.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\browsers\__init__.pyc
<Current directory>\cont\dmp\lzg\lazagne\config\lib\memorpy\utils.py
<Current directory>\cont\dmp\lzg\lazagne\softwares\chats\pidgin.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\databases\sqldeveloper.py
<Current directory>\cont\dmp\lzg\lazagne\softwares\databases\__init__.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\games\galconfusion.py
<Current directory>\cont\dmp\lzg\lazagne\softwares\games\galconfusion.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\games\kalypsomedia.py
<Current directory>\cont\dmp\lzg\lazagne\softwares\games\kalypsomedia.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\games\roguestale.py
<Current directory>\cont\dmp\lzg\lazagne\softwares\games\roguestale.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\games\turba.py
<Current directory>\cont\dmp\lzg\lazagne\softwares\games\turba.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\games\__init__.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\git\gitforwindows.py
<Current directory>\cont\dmp\lzg\lazagne\softwares\databases\sqldeveloper.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\databases\squirrel.py
<Current directory>\cont\dmp\lzg\lazagne\softwares\databases\squirrel.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\windows\vaultfiles.pyc
<Current directory>\compiled.dat
<Current directory>\cont\dmp\lzg\lazagne\softwares\browsers\mozilla.pyc
<Current directory>\cont\dmp\lzg\lazagne\config\lib\memorpy\version.py
<Current directory>\cont\dmp\lzg\lazagne\config\lib\memorpy\winprocess.py
<Current directory>\cont\dmp\lzg\lazagne\config\lib\memorpy\winprocess.pyc
<Current directory>\cont\dmp\lzg\lazagne\config\lib\memorpy\winstructures.py
<Current directory>\cont\dmp\lzg\lazagne\config\lib\memorpy\winstructures.pyc
<Current directory>\cont\dmp\lzg\lazagne\config\lib\memorpy\wintools.py
<Current directory>\cont\dmp\lzg\lazagne\config\lib\memorpy\__init__.py
<Current directory>\cont\dmp\lzg\lazagne\config\lib\memorpy\__init__.pyc
<Current directory>\cont\dmp\lzg\lazagne\config\lib\__init__.pyc
<Current directory>\cont\dmp\lzg\lazagne\config\manage_modules.py
<Current directory>\cont\dmp\lzg\lazagne\config\manage_modules.pyc
<Current directory>\cont\dmp\lzg\lazagne\config\module_info.py
<Current directory>\cont\dmp\lzg\lazagne\softwares\browsers\ucbrowser.py
<Current directory>\cont\dmp\lzg\lazagne\softwares\browsers\ucbrowser.pyc
<Current directory>\cont\dmp\lzg\lazagne\config\module_info.pyc
<Current directory>\cont\dmp\lzg\lazagne\config\users.py
<Current directory>\cont\dmp\lzg\lazagne\config\users.pyc
<Current directory>\cont\dmp\lzg\lazagne\config\winstructure.py
<Current directory>\cont\dmp\lzg\lazagne\config\winstructure.pyc
<Current directory>\cont\dmp\lzg\lazagne\config\write_output.py
<Current directory>\cont\dmp\lzg\lazagne\config\write_output.pyc
<Current directory>\cont\dmp\lzg\lazagne\config\__init__.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\browsers\chromium_based.py
<Current directory>\cont\dmp\lzg\lazagne\softwares\browsers\chromium_based.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\browsers\ie.py
<Current directory>\cont\dmp\lzg\lazagne\softwares\browsers\ie.pyc
<Current directory>\cont\dmp\lzg\lazagne\softwares\browsers\mozilla.py
<Current directory>\cont\dmp\lzg\lazagne\config\lib\memorpy\utils.pyc
<Current directory>\cont\dmp\lzg\lazagne\config\run.pyc
<Current directory>\cmd.exe

Deletes the following files

%TEMP%\test.txt
%TEMP%\obf.usc
<Current directory>\cont.zip

Moves the following files

from %TEMP%\~ghgnqlc.exe to <Current directory>\unzip.exe
from %TEMP%\~jylwahj.zip to <Current directory>\cont.zip
from <Current directory>\unzip.exe to <Current directory>\data\unzip.exe

Substitutes the following files

%TEMP%\test.txt
%TEMP%\obf.usc

Network activity

TCP

'ap#.##legram.org':443

UDP

DNS ASK ap#.##legram.org

Miscellaneous

Creates and executes the following

'<Current directory>\unzip.exe' cont.zip
'<Current directory>\cmd.exe'
'<Current directory>\unzip.exe' cont.zip' (with hidden window)

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней