Trojan.DownLoader33.46199

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'CertificateRegistration' = 'aetcrss1.exe'

Modifies file system

Creates the following files

%TEMP%\rarsfx0\safesign 64-bits.msi
%PROGRAMDATA%\a.e.t. europe b.v\safesign\java card\aetjass2-gempr4.jcf
%PROGRAMDATA%\a.e.t. europe b.v\safesign\java card\aetjass2-gdtigr.jcf
%PROGRAMDATA%\a.e.t. europe b.v\safesign\java card\aetjass2-gdtigr-odd.jcf
%PROGRAMDATA%\a.e.t. europe b.v\safesign\java card\aetjass2-gdsc30.jcf
%PROGRAMDATA%\a.e.t. europe b.v\safesign\java card\aetjass2-cosm64.jcf
%PROGRAMDATA%\a.e.t. europe b.v\safesign\java card\aetjass2-axlctr.jcf
%PROGRAMDATA%\a.e.t. europe b.v\safesign\java card\aetjass1-slbd32.jcf
%PROGRAMDATA%\a.e.t. europe b.v\safesign\java card\aetjass1-gdsfse.jcf
%PROGRAMDATA%\a.e.t. europe b.v\safesign\java card\aetjass1-rnxmob.jcf
%PROGRAMDATA%\a.e.t. europe b.v\safesign\java card\aetjass1-mrtsft.jcf
%PROGRAMDATA%\a.e.t. europe b.v\safesign\java card\aetjass1-ibmj30.jcf
%PROGRAMDATA%\a.e.t. europe b.v\safesign\java card\aetjass1-ibmj20.jcf
%PROGRAMDATA%\a.e.t. europe b.v\safesign\java card\aetjass1-ibmj20-jid.jcf
%PROGRAMDATA%\a.e.t. europe b.v\safesign\java card\aetjass1-gempr3b.jcf
%PROGRAMDATA%\a.e.t. europe b.v\safesign\java card\aetjass1-gempr3.jcf
%PROGRAMDATA%\a.e.t. europe b.v\safesign\java card\aetjass1-gem211.jcf
%PROGRAMDATA%\a.e.t. europe b.v\safesign\java card\aetjass1-obtcos.jcf
%PROGRAMDATA%\a.e.t. europe b.v\safesign\java card\aetjass1-gdssim.jcf
%PROGRAMDATA%\a.e.t. europe b.v\safesign\java card\aetjass2-ibmsmx.jcf
<SYSTEM32>\aetcsss1.dll
%WINDIR%\installer\{2df407d3-a8ad-4acf-bfd5-5f7d42ec62fd}\newshortcut1_1e3c93e123214d73a61e24891c81d278.exe
%WINDIR%\installer\{2df407d3-a8ad-4acf-bfd5-5f7d42ec62fd}\arpproducticon.exe
<SYSTEM32>\aettask.dll
<SYSTEM32>\aetcrss1.exe
%ProgramFiles%\a.e.t. europe b.v\safesign\firefoxinstaller.exe
%ProgramFiles%\a.e.t. europe b.v\safesign\tokenadmin.exe
<SYSTEM32>\aetcngss.dll
%WINDIR%\syswow64\aetpkss1.dll
%PROGRAMDATA%\a.e.t. europe b.v\safesign\java card\aetjass2-kbtsmx.jcf
<SYSTEM32>\aetpkssw.dll
<SYSTEM32>\aetpksse.dll
<SYSTEM32>\aetjcss1.dll
<SYSTEM32>\aetpkss1.dll
%WINDIR%\syswow64\aetpkssw.dll
%WINDIR%\syswow64\aetpksse.dll
%WINDIR%\syswow64\scard.ico
<SYSTEM32>\aetdlss1.dll
%PROGRAMDATA%\a.e.t. europe b.v\safesign\java card\aetjass1-aegate.jcf
%WINDIR%\syswow64\aetjcss1.dll
%PROGRAMDATA%\a.e.t. europe b.v\safesign\java card\jcdata.kit
%PROGRAMDATA%\a.e.t. europe b.v\safesign\locales\es\tokenutils.mo
%PROGRAMDATA%\a.e.t. europe b.v\safesign\locales\en\tokenutils.mo
%PROGRAMDATA%\a.e.t. europe b.v\safesign\locales\el\tokenutils.mo
%PROGRAMDATA%\a.e.t. europe b.v\safesign\locales\de\tokenutils.mo
%PROGRAMDATA%\a.e.t. europe b.v\safesign\locales\cs\tokenutils.mo
%PROGRAMDATA%\a.e.t. europe b.v\safesign\locales\ca\tokenutils.mo
%PROGRAMDATA%\a.e.t. europe b.v\safesign\locales\fi\tokenutils.mo
%WINDIR%\syswow64\aetcngss.dll
%PROGRAMDATA%\a.e.t. europe b.v\safesign\documentation\safesign license agreement pt_br.pdf
%PROGRAMDATA%\a.e.t. europe b.v\safesign\documentation\safesign license agreement.pdf
%WINDIR%\syswow64\aetdlss1.dll
%WINDIR%\syswow64\aetcsss1.dll
%TEMP%\~52e4.tmp
%TEMP%\wac5334.tmp
%TEMP%\rarsfx0\output.log
%PROGRAMDATA%\a.e.t. europe b.v\safesign\documentation\3rdparty\openssl\license.txt
%PROGRAMDATA%\a.e.t. europe b.v\safesign\locales\fr\tokenutils.mo
%PROGRAMDATA%\a.e.t. europe b.v\safesign\locales\eu\tokenutils.mo
%PROGRAMDATA%\a.e.t. europe b.v\safesign\locales\hr\tokenutils.mo
%PROGRAMDATA%\a.e.t. europe b.v\safesign\locales\zh_tw\tokenutils.mo
%PROGRAMDATA%\a.e.t. europe b.v\safesign\locales\ru\tokenutils.mo
%PROGRAMDATA%\a.e.t. europe b.v\safesign\locales\zh_hk\tokenutils.mo
%PROGRAMDATA%\a.e.t. europe b.v\safesign\locales\zh\tokenutils.mo
%PROGRAMDATA%\a.e.t. europe b.v\safesign\locales\uk\tokenutils.mo
%PROGRAMDATA%\a.e.t. europe b.v\safesign\locales\tr\tokenutils.mo
%PROGRAMDATA%\a.e.t. europe b.v\safesign\locales\th\tokenutils.mo
%PROGRAMDATA%\a.e.t. europe b.v\safesign\locales\sr_rs@latin\tokenutils.mo
%PROGRAMDATA%\a.e.t. europe b.v\safesign\locales\sr_rs\tokenutils.mo
%PROGRAMDATA%\a.e.t. europe b.v\safesign\locales\pt_br\tokenutils.mo
%PROGRAMDATA%\a.e.t. europe b.v\safesign\locales\hu\tokenutils.mo
%PROGRAMDATA%\a.e.t. europe b.v\safesign\locales\pt\tokenutils.mo
%PROGRAMDATA%\a.e.t. europe b.v\safesign\locales\nl\tokenutils.mo
%PROGRAMDATA%\a.e.t. europe b.v\safesign\locales\lt\tokenutils.mo
%PROGRAMDATA%\a.e.t. europe b.v\safesign\locales\ko\tokenutils.mo
%PROGRAMDATA%\a.e.t. europe b.v\safesign\locales\ja\tokenutils.mo
%PROGRAMDATA%\a.e.t. europe b.v\safesign\locales\it_ch\tokenutils.mo
%PROGRAMDATA%\a.e.t. europe b.v\safesign\locales\it\tokenutils.mo
%PROGRAMDATA%\microsoft\windows\start menu\programs\safesign standard\token administration.lnk
%PROGRAMDATA%\microsoft\windows\start menu\programs\safesign standard\documentation\license agreement.lnk

Network activity

Connects to

'public-trust.com':80

UDP

DNS ASK public-trust.com

Miscellaneous

Searches for the following windows

ClassName: 'EDIT' WindowName: ''

Creates and executes the following

'%TEMP%\wac5334.tmp' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{61DE8CA1-F1D9-4C36-AEA3-90A0B2016596}
'%WINDIR%\installer\msia8dd.tmp' "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Calais\SmartCards" /registry /grant S-1-1-0 /full /sid /i:cont_inh /r:cont /silent
'%TEMP%\wac5334.tmp' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E0B5F1ED-0F1A-4820-AF15-CC3CFC105E6C}
'%ProgramFiles%\a.e.t. europe b.v\safesign\tokenadmin.exe' -netscapeinstaller

Executes the following