Trojan.DownLoader35.4707

Technical Information

Modifies file system

Creates the following files

%TEMP%\nsrb30a.tmp\system.dll
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\9377Г·ГЁГіВ°ВґВ«Г«Вµ\9377Г·ГЁГіВ°ВґВ«Г«Вµ.lnk
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\9377Г·ГЁГіВ°ВґВ«Г«Вµ.lnk
%ProgramFiles(x86)%\9377Г·ГЁГіВ°ВґВ«Г«Вµ\9377Г·ГЁГіВ°ВґВ«Г«Вµ.lnk
C:\users\public\desktop\9377Г·ГЁГіВ°ВґВ«Г«Вµ.lnk
%TEMP%\nsrb30a.tmp\f1023_s_30974.exe
%TEMP%\nsr2991.tmp\inetc.dll
%ProgramFiles(x86)%\9377Г·ГЁГіВ°ВґВ«Г«Вµ\mylogger.ini
%ProgramFiles(x86)%\9377Г·ГЁГіВ°ВґВ«Г«Вµ\uninstall.exe
%ProgramFiles(x86)%\9377Г·ГЁГіВ°ВґВ«Г«Вµ\meiying.dll
%ProgramFiles(x86)%\9377Г·ГЁГіВ°ВґВ«Г«Вµ\mylogger.exe
%TEMP%\nsr2991.tmp\ip.dll
%TEMP%\nsr2991.tmp\system.dll
%HOMEPATH%\desktop\intrenet explorer.lnk
%TEMP%\nsw278d.tmp
%TEMP%\nsrb30a.tmp\9377mycs_y_mgaz2_01.exe
%TEMP%\nsrb30a.tmp\setup_3386.exe
%TEMP%\nsrb30a.tmp\inetc.dll
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\200334\uninst.lnk
%ProgramFiles(x86)%\200334\uninstall.exe
%TEMP%\nsrb30a.tmp\nsprocess.dll
%TEMP%\nsrb30a.tmp\1.ico
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\9377Г·ГЁГіВ°ВґВ«Г«Вµ\uninstall.lnk
%LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012020102120201022\index.dat

Deletes the following files

%TEMP%\nsr2991.tmp\inetc.dll
%TEMP%\nsr2991.tmp\ip.dll
%TEMP%\nsr2991.tmp\system.dll

Network activity

TCP

HTTP GET requests

http://sh##.#an1234.com/mmliao/MM-liao8398.exe
http://pi#.#ytcm.com/2019260055/960-60.gif
http://15#.#96.199.37/fafa-vip1/4.js
http://www.18##e.com/js/tj.js
http://15#.#96.199.37/fafa-vip1/duilian.js
http://15#.#96.199.37/fafa-vip1/3.js
http://15#.#96.199.74/fafa-xuanfu/xuanfu.js
http://www.19##tu.com/i/20201013185331rgn.gif
http://cl###t.9377.com/pc_game_my_new.php?lm################################
http://st####.9377s.com/style/my/pc_new.css?20############
http://st####.9377s.com/js/ajax.js?20############
http://st####.9377s.com/js/jquery.Slideshow.js?20############
http://st####.9377s.com/uploads/2016-03/03/dfd8e05c979b7ce1.jpg
http://st####.9377s.com/images/my/pc/login_before.jpg
http://st####.9377s.com/images/cms_style_2015/other_login_icos.png?20##########
http://st####.9377s.com/images/my/pc/start.gif
http://cb###.alicdn.com/img/ibank/2018/273/940/8576049372_872274545.jpg
http://up####.9377s.com/uploads/2016/10-22/6fd52cb6910c02c3.jpg
http://www.19##tu.com/i/20200814133730p2q.gif
http://15#.#96.199.37/fafa-vip1/2.js
http://do##.yinyue.fm/open/setup_3386.exe
http://xi###i.9377.com/20140928/9377mycs_Y_mgaz2_01.exe
http://sh###.baidu.com/index/fulldownload/30974
http://www.61###gling.com/ytleyaj.exe/40.html
http://www.61###gling.com/common.js
http://www.61###gling.com/tj.js
http://w.#.#aidu.com/go/full/1/70988
http://www.18##e.com/
http://dl###1.qq.com/invc/tt/QQBrowser_Setup_Hk_78653.exe
http://www.18##e.com/template/mb2020/css/ate.css
http://www.18##e.com/template/mb2020/css/zui.css
http://www.18##e.com/template/mb2020/css/loogo8.png
http://www.18##e.com/template/mb2020/fonts/iconfont.eot)%20format(%22embedded-opentype%22),%20url(../fonts/iconfont.woff)%20format(%22woff%22),%20url(../fonts/iconfont.ttf)%20format(%22truetype...
http://15#.#96.199.37/fafa-vip1/1.js
http://15#.#96.199.37/fafa-vip1/dh.js
http://www.19##tu.com/i/20200926214840qyn.gif
http://st####.9377s.com/images/my/pc/input_bg.jpg

HTTP POST requests

http://www.93##.com/api/client_data_receive.php?Na###############################################################################################################################################...

'ka###antu.com':443

'cb###.alicdn.com':443

'im#.#licdn.com':443

'im#.#ownk.cc':443

'pi#.##inaclip.net':443

'js.##ers.51.la':443

UDP

DNS ASK xn#######ik91bknc.xn--fiqs8s
DNS ASK cl###t.9377.com
DNS ASK js.##ers.51.la
DNS ASK pi#.##inaclip.net
DNS ASK im#.#licdn.com
DNS ASK cb###.alicdn.com
DNS ASK im#.#ownk.cc
DNS ASK pi#.#ytcm.com
DNS ASK 19##tu.com
DNS ASK ka###antu.com
DNS ASK st####.9377s.com
DNS ASK dl.###p.baidu.com
DNS ASK 18##e.com
DNS ASK w.#.#aidu.com
DNS ASK 61###gling.com
DNS ASK 93##.com
DNS ASK sh###.baidu.com
DNS ASK xi###i.9377.com
DNS ASK do##.yinyue.fm
DNS ASK ma##234.com
DNS ASK sh##.#an1234.com
DNS ASK dl###1.qq.com
DNS ASK up####.9377s.com

Miscellaneous

Searches for the following windows

ClassName: 'DDEMLMom' WindowName: ''
ClassName: 'IEFrame' WindowName: ''
ClassName: 'Static' WindowName: ''
ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebCheckMonitor' WindowName: ''
ClassName: 'WorkerW' WindowName: ''
ClassName: 'SHELLDLL_DefView' WindowName: ''
ClassName: 'SysListView32' WindowName: ''

Creates and executes the following

'%TEMP%\nsrb30a.tmp\9377mycs_y_mgaz2_01.exe'
'%ProgramFiles(x86)%\9377Г·ГЁГіВ°ВґВ«Г«Вµ\mylogger.exe' "%ProgramFiles(x86)%\9377Г·Г€Г“В°ВґВ«Г‹Вµ\MeiYing.dll" 2
'%ProgramFiles(x86)%\9377Г·ГЁГіВ°ВґВ«Г«Вµ\mylogger.exe' "%ProgramFiles(x86)%\9377Г·Г€Г“В°ВґВ«Г‹Вµ\MeiYing.dll" 1

Демо бесплатно на 14 дней

Выдаётся при установке

Скачать с сайта

Скачать с Google Play

Скачайте
Dr.Web для Android

Бесплатно на 3 месяца
Все компоненты защиты
Продление демо через
AppGallery/Google Pay

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней