Trojan.DownLoader40.52473

Technical Information

Modifies file system

Creates the following files

<Current directory>\tГ¬Г¬tГ¬Г¬tГЈГґtГЄВ§t\<File name>.exe
<Current directory>\tГ¬Г¬tГ¬Г¬tГЈГґtГЄВ§t\mishizw\map\f003.map
<Current directory>\tГ¬Г¬tГ¬Г¬tГЈГґtГЄВ§t\mishizw\map\h006.map
<Current directory>\tГ¬Г¬tГ¬Г¬tГЈГґtГЄВ§t\mishizw\map\h204.map
<Current directory>\tГ¬Г¬tГ¬Г¬tГЈГґtГЄВ§t\mishizw\map\m101.map
<Current directory>\tГ¬Г¬tГ¬Г¬tГЈГґtГЄВ§t\mishizw\map\q004.map
<Current directory>\tГ¬Г¬tГ¬Г¬tГЈГґtГЄВ§t\mishizw\map\xjcb1.map
<Current directory>\tГ¬Г¬tГ¬Г¬tГЈГґtГЄВ§t\mishizw\map\xjcb10.map
<Current directory>\tГ¬Г¬tГ¬Г¬tГЈГґtГЄВ§t\mishizw\map\xjcb3.map
<Current directory>\tГ¬Г¬tГ¬Г¬tГЈГґtГЄВ§t\wav\sound.lst
<Current directory>\tГ¬Г¬tГ¬Г¬tГЈГґtГЄВ§t\wav\˜++В¦1.wav
<Current directory>\tГ¬Г¬tГ¬Г¬tГЈГґtГЄВ§t\wav\˜++В¦2.wav
<Current directory>\tГ¬Г¬tГ¬Г¬tГЈГґtГЄВ§t\wav\˜++В¦3.wav
<Current directory>\tГ¬Г¬tГ¬Г¬tГЈГґtГЄВ§t\wav\˜++В¦4.wav
<Current directory>\tГ¬Г¬tГ¬Г¬tГЈГґtГЄВ§t\wav\˜++В¦5.wav
<Current directory>\tГ¬Г¬tГ¬Г¬tГЈГґtГЄВ§t\wav\˜++В¦6.wav
<Current directory>\tГ¬Г¬tГ¬Г¬tГЈГґtГЄВ§t\wav\˜++В¦7.wav
<Current directory>\tГ¬Г¬tГ¬Г¬tГЈГґtГЄВ§t\wav\˜++В¦8.wav
<Current directory>\tГ¬Г¬tГ¬Г¬tГЈГґtГЄВ§t\mishizw\map\d615.map
<Current directory>\tГ¬Г¬tГ¬Г¬tГЈГґtГЄВ§t\plugin\x-client.dll
<Current directory>\tГ¬Г¬tГ¬Г¬tГЈГґtГЄВ§t\mishizw\map\d613.map
<Current directory>\tГ¬Г¬tГ¬Г¬tГЈГґtГЄВ§t\mishizw\map\d5073.map
%HOMEPATH%\desktop\tГ¬Г¬tГ¬Г¬tГЈГґtГЄВ§t.lnk
<Current directory>\tГ¬Г¬tГ¬Г¬tГЈГґtГЄВ§t\xf0.patch
<Current directory>\tГ¬Г¬tГ¬Г¬tГЈГґtГЄВ§t\data\mapdesc2.dat
<Current directory>\tГ¬Г¬tГ¬Г¬tГЈГґtГЄВ§t\mishizw\data\52esp.pak
<Current directory>\tГ¬Г¬tГ¬Г¬tГЈГґtГЄВ§t\mishizw\data\espcd.pak
<Current directory>\tГ¬Г¬tГ¬Г¬tГЈГґtГЄВ§t\mishizw\data\espsc1.pak
<Current directory>\tГ¬Г¬tГ¬Г¬tГЈГґtГЄВ§t\mishizw\data\esp_ng.dat
<Current directory>\tГ¬Г¬tГ¬Г¬tГЈГґtГЄВ§t\mishizw\data\esp_sdgh.pak
<Current directory>\tГ¬Г¬tГ¬Г¬tГЈГґtГЄВ§t\mishizw\map\0.map
<Current directory>\tГ¬Г¬tГ¬Г¬tГЈГґtГЄВ§t\mishizw\map\0115.map
<Current directory>\tГ¬Г¬tГ¬Г¬tГЈГґtГЄВ§t\mishizw\map\0159.map
<Current directory>\tГ¬Г¬tГ¬Г¬tГЈГґtГЄВ§t\mishizw\map\11.map
<Current directory>\tГ¬Г¬tГ¬Г¬tГЈГґtГЄВ§t\mishizw\map\3.map
<Current directory>\tГ¬Г¬tГ¬Г¬tГЈГґtГЄВ§t\mishizw\map\4.map
<Current directory>\tГ¬Г¬tГ¬Г¬tГЈГґtГЄВ§t\mishizw\map\5.map
<Current directory>\tГ¬Г¬tГ¬Г¬tГЈГґtГЄВ§t\mishizw\map\6.map
<Current directory>\tГ¬Г¬tГ¬Г¬tГЈГґtГЄВ§t\mishizw\map\d5071.map
<Current directory>\tГ¬Г¬tГ¬Г¬tГЈГґtГЄВ§t\mishizw\map\d515.map
<Current directory>\tГ¬Г¬tГ¬Г¬tГЈГґtГЄВ§t\data\newopui.pak

Deletes the following files

<Current directory>\tГ¬Г¬tГ¬Г¬tГЈГґtГЄВ§t\xf0.patch

Modifies the following files

Deletes itself.

Network activity

Connects to

'aa#.##anfengbio.cn':89
'aa#.##anfengbio.cn':900
'tx##pt.cn':8402

TCP

HTTP GET requests

http://www.11###.cn:900/002link.htm
http://www.11###.cn:900/tt.js
http://www.11###.cn:900/link_files/bt2.jpg
http://www.11###.cn:900/link_files/1.gif
http://www.11###.cn:900/group.png
http://www.11###.cn:900/link_files/1111.jpg

UDP

DNS ASK aa#.##anfengbio.cn
DNS ASK 11##t.cn
DNS ASK tx##pt.cn

Miscellaneous

Searches for the following windows

ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebCheckMonitor' WindowName: ''

Creates and executes the following

'<Current directory>\tГ¬Г¬tГ¬Г¬tГЈГґtГЄВ§t\<File name>.exe'
'%WINDIR%\syswow64\cmd.exe' /c del /q <Full path to file>' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c del /q <Full path to file>

Демо бесплатно на 14 дней

Выдаётся при установке

Скачать с сайта

Скачать с Google Play

Скачайте
Dr.Web для Android

Бесплатно на 3 месяца
Все компоненты защиты
Продление демо через
AppGallery/Google Pay

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней