Trojan.DownLoader35.50297

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

<SYSTEM32>\tasks\be connector scheduler

Modifies file system

Creates the following files

<Current directory>\beialogs_3c7fd080-75b6-42b1-b7c6-3d3b5af4c566_11172020.log
<Current directory>\dotnetzip-npfduhgp.tmp
<Current directory>\beiwsapp.exe.zip
<Current directory>\dotnetzip-gstm4kyr.tmp
<Current directory>\taskschedulerwrapper.exe.zip
<Current directory>\integdb1.sqlite.zip
<Current directory>\winsvc_pull_job.exe.config.zip
<Current directory>\beintegration_admin_tool.exe.config.zip
<Current directory>\wpm29jpd.dtxkey.zip
<Current directory>\dotnetzip-rw5ikll5.tmp
<Current directory>\sqlite.interop.dll.zip
<Current directory>\dotnetzip-nisohrre.tmp
<Current directory>\uninstaller.exe.zip
<Current directory>\dotnetzip-u2x2h2qg.tmp
<Current directory>\beiwinpullpushapp.exe.config.zip
<Current directory>\winsvc_pull_job.exe.zip
<Current directory>\beiasystemtray.exe.zip
<Current directory>\dotnetzip-o01aoezd.tmp
<Current directory>\installutil.exe.zip
<Current directory>\dotnetzip-eoqg1mhl.tmp
<Current directory>\g6fixcert.exe.zip
<Current directory>\dotnetzip-vph22frh.tmp
<Current directory>\createuser_wpm29jpd.exe.zip
<Current directory>\dotnetzip-3pbabfq5.tmp
<Current directory>\beiwinpullpushapp.exe.zip
<Current directory>\dotnetzip-lfpqrg43.tmp
<Current directory>\beintegration_admin_tool.exe.zip
<Current directory>\dotnetzip-ysedbvnp.tmp
<Current directory>\beiaupdate.exe.zip
<Current directory>\dotnetzip-04fmnyan.tmp
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\beiasystemtray.lnk

Deletes the following files

<Current directory>\beiaupdate.exe.zip
<Current directory>\beintegration_admin_tool.exe.zip
<Current directory>\beiwinpullpushapp.exe.zip
<Current directory>\createuser_wpm29jpd.exe.zip
<Current directory>\g6fixcert.exe.zip
<Current directory>\installutil.exe.zip
<Current directory>\beiasystemtray.exe.zip
<Current directory>\winsvc_pull_job.exe.zip
<Current directory>\uninstaller.exe.zip
<Current directory>\sqlite.interop.dll.zip
<Current directory>\taskschedulerwrapper.exe.zip
<Current directory>\beiwsapp.exe.zip

Moves the following files

from <Current directory>\dotnetzip-ysedbvnp.tmp to <Current directory>\beiaupdate.exe
from <Current directory>\dotnetzip-gstm4kyr.tmp to <Current directory>\taskschedulerwrapper.exe
from <Current directory>\integdb1.sqlite.zip to <Current directory>\integdb1.sqlite
from <Current directory>\winsvc_pull_job.exe.config.zip to <Current directory>\winsvc_pull_job.exe.config
from <Current directory>\beintegration_admin_tool.exe.config.zip to <Current directory>\beintegration_admin_tool.exe.config
from <Current directory>\wpm29jpd.dtxkey.zip to <Current directory>\wpm29jpd.dtxkey
from <Current directory>\dotnetzip-rw5ikll5.tmp to <Current directory>\sqlite.interop.dll
from <Current directory>\dotnetzip-npfduhgp.tmp to <Current directory>\beiwsapp.exe
from <Current directory>\dotnetzip-nisohrre.tmp to <Current directory>\uninstaller.exe
from <Current directory>\dotnetzip-04fmnyan.tmp to <Current directory>\beiasystemtray.exe
from <Current directory>\dotnetzip-o01aoezd.tmp to <Current directory>\installutil.exe
from <Current directory>\dotnetzip-eoqg1mhl.tmp to <Current directory>\g6fixcert.exe
from <Current directory>\dotnetzip-vph22frh.tmp to <Current directory>\createuser_wpm29jpd.exe
from <Current directory>\dotnetzip-3pbabfq5.tmp to <Current directory>\beiwinpullpushapp.exe
from <Current directory>\dotnetzip-lfpqrg43.tmp to <Current directory>\beintegration_admin_tool.exe
from <Current directory>\dotnetzip-u2x2h2qg.tmp to <Current directory>\winsvc_pull_job.exe
from <Current directory>\beiwinpullpushapp.exe.config.zip to <Current directory>\beiwinpullpushapp.exe.config