Trojan.DownLoader33.40007

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'XyWall Anti-Malware' = '<Current directory>\XyStartRun.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'XyWall Secure Boot' = '<Current directory>\XySecureBoot.exe'
[<HKCU>\SOFTWARE\Classes\exefile\shell\open\command] '' = '"%1" %*'
[<HKLM>\Software\Classes\.exe] '' = 'exefile'
[<HKLM>\Software\Classes\.exe] 'Content Type' = 'application/x-msdownload'
[<HKLM>\Software\Classes\.bat] '' = 'batfile'
[<HKLM>\Software\Classes\batfile\shell\open\command] '' = '"%1" %*'

Modifies file system

Creates the following files

<Current directory>\settings.ini.tmp
<Current directory>\reg_fix\netbt_7.reg
<Current directory>\reg_fix\msiserver_10.reg
<Current directory>\reg_fix\msiserver_v.reg
<Current directory>\reg_fix\ndisuio_7.reg
<Current directory>\reg_fix\ndisuio_8.reg
<Current directory>\reg_fix\ndisuio_10.reg
<Current directory>\reg_fix\ndisuio_v.reg
<Current directory>\reg_fix\netbt_8.reg
<Current directory>\reg_fix\ikeext_10.reg
<Current directory>\reg_fix\netbt_10.reg
<Current directory>\reg_fix\netbt_v.reg
<Current directory>\reg_fix\pcasvc_7.reg
<Current directory>\reg_fix\pcasvc_8.reg
<Current directory>\reg_fix\pcasvc_10.reg
<Current directory>\reg_fix\pcasvc_v.reg
<Current directory>\reg_fix\msiserver_8.reg
<Current directory>\reg_fix\msiserver_7.reg
<Current directory>\reg_fix\mpssvc_8.reg
<Current directory>\reg_fix\mpssvc_7.reg
<Current directory>\reg_fix\iphlpsvc_v.reg
<Current directory>\reg_fix\iphlpsvc_7.reg
<Current directory>\reg_fix\ikeext_v.reg
<Current directory>\reg_fix\ikeext_8.reg
<Current directory>\reg_fix\browser_10.reg
<Current directory>\reg_fix\policyagent_7.reg
<Current directory>\reg_fix\cryptsvc_v.reg
<Current directory>\reg_fix\cryptsvc_10.reg
<Current directory>\reg_fix\cryptsvc_8.reg
<Current directory>\reg_fix\cryptsvc_7.reg
<Current directory>\reg_fix\browser_v.reg
<Current directory>\reg_fix\mpssvc_v.reg
<Current directory>\reg_fix\ikeext_7.reg
<Current directory>\reg_fix\mpssvc_10.reg
<Current directory>\reg_fix\policyagent_8.reg
<Current directory>\reg_fix\remoteaccess_8.reg
<Current directory>\reg_fix\windefend_7.reg
<Current directory>\reg_fix\windefend_8.reg
<Current directory>\reg_fix\windefend_10.reg
<Current directory>\reg_fix\windefend_v.reg
<Current directory>\reg_fix\winmgmt_7.reg
<Current directory>\reg_fix\winmgmt_8.reg
<Current directory>\reg_fix\winmgmt_v.reg
<Current directory>\reg_fix\vss_10.reg
<Current directory>\reg_fix\wscsvc_7.reg
<Current directory>\reg_fix\wscsvc_8.reg
<Current directory>\reg_fix\wscsvc_10.reg
<Current directory>\reg_fix\wscsvc_v.reg
<Current directory>\reg_fix\wuauserv_7.reg
<Current directory>\reg_fix\wuauserv_8.reg
<Current directory>\reg_fix\vss_v.reg
<Current directory>\reg_fix\vss_8.reg
<Current directory>\reg_fix\ico_file_fix.reg
<Current directory>\reg_fix\remoteaccess_10.reg
<Current directory>\reg_fix\remoteaccess_v.reg
<Current directory>\reg_fix\sharedaccess_7.reg
<Current directory>\reg_fix\sharedaccess_8.reg
<Current directory>\reg_fix\policyagent_10.reg
<Current directory>\reg_fix\remoteaccess_7.reg
<Current directory>\reg_fix\policyagent_v.reg
<Current directory>\reg_fix\sharedaccess_10.reg
<Current directory>\reg_fix\swprv_8.reg
<Current directory>\reg_fix\swprv_10.reg
<Current directory>\reg_fix\swprv_v.reg
<Current directory>\reg_fix\vss_7.reg
<Current directory>\reg_fix\sharedaccess_v.reg
<Current directory>\reg_fix\slsvc_v.reg
<Current directory>\reg_fix\swprv_7.reg
<Current directory>\reg_fix\browser_8.reg
<Current directory>\reg_fix\browser_7.reg
<Current directory>\reg_fix\bits_v.reg
<Current directory>\microsoft.powershell.management.activities.dll
<Current directory>\microsoft.powershell.scheduledjob.dll
<Current directory>\microsoft.powershell.security.dll
<Current directory>\microsoft.powershell.security.activities.dll
<Current directory>\microsoft.powershell.utility.activities.dll
<Current directory>\microsoft.powershell.workflow.servicecore.dll
<Current directory>\viewmode.xw
<Current directory>\reg_fix\directory_file_fix.reg
<Current directory>\testvtcloud.bin
<Current directory>\xystartrun.exe
<Current directory>\xyunin.exe
<Current directory>\reg_fix\bat_file_fix.reg
<Current directory>\reg_fix\cab_file_fix.reg
<Current directory>\reg_fix\chm_file_fix.reg
<Current directory>\microsoft.powershell.diagnostics.activities.dll
<Current directory>\microsoft.powershell.core.activities.dll
<Current directory>\settings.ini
<Current directory>\certmgr.exe
<Current directory>\microsoft.powershell.consolehost.dll
<Current directory>\microsoft.powershell.commands.utility.dll
<Current directory>\microsoft.powershell.commands.management.dll
<Current directory>\microsoft.powershell.activities.dll
<Current directory>\turn_off_windows_defender.reg
<Current directory>\microsoft.wsman.management.activities.dll
<Current directory>\roxasdev.crt
<Current directory>\reg_fix\cpl_file_fix.reg
<Current directory>\whitelist.xw
<Current directory>\xysvc.exe
<Current directory>\shellfolder.exe
<Current directory>\langint.xy
<Current directory>\shellfile.exe
<Current directory>\xyautoupdate.exe
<Current directory>\reg_fix\com_file_fix.reg
<Current directory>\reg_fix\drive_file_fix.reg
<Current directory>\reg_fix\scf_file_fix.reg
<Current directory>\reg_fix\tif_file_fix.reg
<Current directory>\reg_fix\txt_file_fix.reg
<Current directory>\reg_fix\url_file_fix.reg
<Current directory>\reg_fix\vbs_file_fix.reg
<Current directory>\reg_fix\reg_file_fix.reg
<Current directory>\reg_fix\eml_file_fix.reg
<Current directory>\reg_fix\scr_file_fix.reg
<Current directory>\reg_fix\zip_file_fix.reg
<Current directory>\reg_fix\bfe_v.reg
<Current directory>\reg_fix\bits_7.reg
<Current directory>\reg_fix\bits_8.reg
<Current directory>\reg_fix\bits_10.reg
<Current directory>\reg_fix\bfe_7.reg
<Current directory>\reg_fix\bfe_8.reg
<Current directory>\reg_fix\bfe_10.reg
<Current directory>\reg_fix\winmgmt_10.reg
<Current directory>\reg_fix\wuauserv_10.reg
<Current directory>\reg_fix\msc_file_fix.reg
<Current directory>\reg_fix\mpeg_file_fix.reg
<Current directory>\reg_fix\lnk_file_fix.reg
<Current directory>\reg_fix\jpg_file_fix.reg
<Current directory>\reg_fix\inf_file_fix.reg
<Current directory>\reg_fix\img_file_fix.reg
<Current directory>\reg_fix\ie_file_fix.reg
<Current directory>\reg_fix\msi_file_fix.reg
<Current directory>\reg_fix\html_file_fix.reg
<Current directory>\reg_fix\hta_file_fix.reg
<Current directory>\reg_fix\hlp_file_fix.reg
<Current directory>\reg_fix\gif_file_fix.reg
<Current directory>\reg_fix\folder_file_fix.reg
<Current directory>\reg_fix\exe_file_fix_win8.reg
<Current directory>\reg_fix\exe_file_fix_win7.reg
<Current directory>\reg_fix\msp_file_fix.reg
<Current directory>\reg_fix\wuauserv_v.reg

Deletes the following files

<Current directory>\settings.ini.tmp
<Current directory>\testvtcloud.bin
<Current directory>\certmgr.exe
<Current directory>\roxasdev.crt

Network activity

TCP

HTTP GET requests

http://rx###ud.fr.nf/xywall_beta/XySvc.xw
http://rx###ud.fr.nf/xywall_beta/whitelist.xw
http://rx###ud.fr.nf/xywall_beta/XyAutoUpdate.xw
http://rx###ud.fr.nf/cloudtest/TestCloud.bin
http://rx###ud.fr.nf/xywall_beta/XyStartRun.xw
http://rx###ud.fr.nf/xywall_beta/XyUnin.xw

UDP

DNS ASK rx###ud.fr.nf

Miscellaneous

Adds a root certificate

Searches for the following windows

ClassName: 'Shell_traywnd' WindowName: ''
ClassName: 'RegEdit_RegEdit' WindowName: ''

Creates and executes the following

'<Current directory>\certmgr.exe' -add RoxasDev.crt -s -r localMachine root -all
'<Current directory>\certmgr.exe' -add RoxasDev.crt -s -r currentUser root -all
'<Current directory>\certmgr.exe' -add RoxasDev.crt -s -r localMachine trustedpublisher -all
'<Current directory>\certmgr.exe' -add RoxasDev.crt -s -r currentUser trustedpublisher -all
'<Current directory>\xysvc.exe'
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "%programfiles%\XyWallAntiMalware"' (with hidden window)
'<Current directory>\xysvc.exe' ' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath <Current directory>' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -DisableRealtimeMonitoring $true' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' New-ItemProperty -Path "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender" -Name DisableAntiSpyware -Value 1 -PropertyType DWORD -Force' (with hidden window)

Executes the following

'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "%programfiles%\XyWallAntiMalware"
'%WINDIR%\regedit.exe' /s <Current directory>\reg_fix\inf_file_fix.reg
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' New-ItemProperty -Path "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender" -Name DisableAntiSpyware -Value 1 -PropertyType DWORD -Force
'%WINDIR%\regedit.exe' /s <Current directory>\reg_fix\img_file_fix.reg
'%WINDIR%\regedit.exe' /s <Current directory>\reg_fix\ie_file_fix.reg
'%WINDIR%\regedit.exe' /s <Current directory>\reg_fix\ico_file_fix.reg
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -DisableRealtimeMonitoring $true
'%WINDIR%\regedit.exe' /s <Current directory>\reg_fix\html_file_fix.reg
'%WINDIR%\regedit.exe' /s <Current directory>\reg_fix\hta_file_fix.reg
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath <Current directory>
'%WINDIR%\regedit.exe' /s <Current directory>\reg_fix\hlp_file_fix.reg
'%WINDIR%\regedit.exe' /s <Current directory>\reg_fix\gif_file_fix.reg
'%WINDIR%\regedit.exe' /s <Current directory>\reg_fix\folder_file_fix.reg
'%WINDIR%\regedit.exe' /s <Current directory>\reg_fix\eml_file_fix.reg
'%WINDIR%\regedit.exe' /s <Current directory>\reg_fix\drive_file_fix.reg
'%WINDIR%\regedit.exe' /s <Current directory>\reg_fix\directory_file_fix.reg
'%WINDIR%\regedit.exe' /s <Current directory>\reg_fix\cpl_file_fix.reg
'%WINDIR%\regedit.exe' /s <Current directory>\reg_fix\com_file_fix.reg
'%WINDIR%\regedit.exe' /s <Current directory>\reg_fix\chm_file_fix.reg
'%WINDIR%\regedit.exe' /s <Current directory>\reg_fix\cab_file_fix.reg
'%WINDIR%\regedit.exe' /s <Current directory>\reg_fix\bat_file_fix.reg
'%WINDIR%\regedit.exe' /s <Current directory>\reg_fix\exe_file_fix_win7.reg
'%WINDIR%\regedit.exe' /s <Current directory>\reg_fix\jpg_file_fix.reg
'%WINDIR%\regedit.exe' /s <Current directory>\reg_fix\lnk_file_fix.reg

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней