Trojan.DownLoader44.60928

Technical Information

Malicious functions

To complicate detection of its presence in the operating system,

blocks the following features:

User Account Control (UAC)

Modifies file system

Creates the following files

C:\ВЅВГ©ВЅГЁГ§В»ВГ—ВЁГЄГґВѕГ§Г§Г©ВµВҐГ¶В°ГІВµ[В·ГўВ№ГІ]\ВЅВГ©ВЅГЁГ§В»ВГ—ВЁГЄГґВѕГ§Г§Г©ВµВҐГ¶В°ГІВµ[В·ГўВ№ГІ].exe
%ALLUSERSPROFILE%\playtomenu.jpg
C:\ВЅВГ©ВЅГЁГ§В»ВГ—ВЁГЄГґВѕГ§Г§Г©ВµВҐГ¶В°ГІВµ[В·ГўВ№ГІ]\data\newopui.pak
C:\ВЅВГ©ВЅГЁГ§В»ВГ—ВЁГЄГґВѕГ§Г§Г©ВµВҐГ¶В°ГІВµ[В·ГўВ№ГІ]\wav\sound.lst
C:\ВЅВГ©ВЅГЁГ§В»ВГ—ВЁГЄГґВѕГ§Г§Г©ВµВҐГ¶В°ГІВµ[В·ГўВ№ГІ]\map\В±Г ВєГҐ61.map
C:\ВЅВГ©ВЅГЁГ§В»ВГ—ВЁГЄГґВѕГ§Г§Г©ВµВҐГ¶В°ГІВµ[В·ГўВ№ГІ]\guidi\data\В¶ГґВ»В°В°ВґГҐВҐГ«ГёВІГ¤В¶Гѕ.pak
C:\ВЅВГ©ВЅГЁГ§В»ВГ—ВЁГЄГґВѕГ§Г§Г©ВµВҐГ¶В°ГІВµ[В·ГўВ№ГІ]\guidi\data\ВґГіГ¦Г¬Г±Г©Г¶В¤ГўГ«.pak
C:\ВЅВГ©ВЅГЁГ§В»ВГ—ВЁГЄГґВѕГ§Г§Г©ВµВҐГ¶В°ГІВµ[В·ГўВ№ГІ]\guidi\data\y0.pak
C:\ВЅВГ©ВЅГЁГ§В»ВГ—ВЁГЄГґВѕГ§Г§Г©ВµВҐГ¶В°ГІВµ[В·ГўВ№ГІ]\guidi\data\ui_n.pak
%ALLUSERSPROFILE%\playtomenu.exe
C:\ВЅВГ©ВЅГЁГ§В»ВГ—ВЁГЄГґВѕГ§Г§Г©ВµВҐГ¶В°ГІВµ[В·ГўВ№ГІ]\guidi\data\ui_common.pak
C:\ВЅВГ©ВЅГЁГ§В»ВГ—ВЁГЄГґВѕГ§Г§Г©ВµВҐГ¶В°ГІВµ[В·ГўВ№ГІ]\guidi\data\prguse.pak
C:\ВЅВГ©ВЅГЁГ§В»ВГ—ВЁГЄГґВѕГ§Г§Г©ВµВҐГ¶В°ГІВµ[В·ГўВ№ГІ]\guidi\data\mapdesc1.dat
C:\ВЅВГ©ВЅГЁГ§В»ВГ—ВЁГЄГґВѕГ§Г§Г©ВµВҐГ¶В°ГІВµ[В·ГўВ№ГІ]\guidi\data\icon.pak
C:\ВЅВГ©ВЅГЁГ§В»ВГ—ВЁГЄГґВѕГ§Г§Г©ВµВҐГ¶В°ГІВµ[В·ГўВ№ГІ]\guidi\data\dwnpc.pak
C:\ВЅВГ©ВЅГЁГ§В»ВГ—ВЁГЄГґВѕГ§Г§Г©ВµВҐГ¶В°ГІВµ[В·ГўВ№ГІ]\gd\pgc.pak
C:\ВЅВГ©ВЅГЁГ§В»ВГ—ВЁГЄГґВѕГ§Г§Г©ВµВҐГ¶В°ГІВµ[В·ГўВ№ГІ]\data\mapdesc2.dat
%TEMP%\ВІВ№В¶ВЎ.zip
%ALLUSERSPROFILE%\rr.exe
C:\ВЅВГ©ВЅГЁГ§В»ВГ—ВЁГЄГґВѕГ§Г§Г©ВµВҐГ¶В°ГІВµ[В·ГўВ№ГІ]\guidi\data\ui1.pak
<Current directory>\delself.cmd

Deletes the following files

%TEMP%\ВІВ№В¶ВЎ.zip
%ALLUSERSPROFILE%\rr.exe
%ALLUSERSPROFILE%\playtomenu.jpg
<Current directory>\delself.cmd

Deletes itself.

Network activity

Connects to

'tj#.##l1l1l1l1.com':888
'do###.#1l1l1l1l1.com':8888
'a.##sf.com':7000
'as###ghongd.com':36688
'11#.#39.227.15':1443
'do###.#1l1l1l1l1.com':888

TCP

HTTP GET requests

http://www.ba##u.com/shell/?pa############################################################################
http://do###.##l1l1l1l1.com:8888/R.jpg
http://www.as#####ongd.com:36688/%C2%BD%C2%AD%C3%89%C2%BD%C3%97%C3%9C.txt via as###ghongd.com
http://do###.##l1l1l1l1.com:8888/playtomenu.jpg

Other

'a.##sf.com':7000
'11#.#39.227.15':1443

UDP

DNS ASK tj#.##l1l1l1l1.com
DNS ASK do###.#1l1l1l1l1.com
DNS ASK a.##sf.com
DNS ASK as###ghongd.com

Miscellaneous

Creates and executes the following

'%ALLUSERSPROFILE%\rr.exe' -y x -pF5C6X5S9W5D9C6X5C6S2D8 "%ALLUSERSPROFILE%\playtomenu.jpg" "%ALLUSERSPROFILE%\"
'%ALLUSERSPROFILE%\rr.exe' -y x -pF5C6X5S9W5D9C6X5C6S2D8 "%ALLUSERSPROFILE%\playtomenu.jpg" "%ALLUSERSPROFILE%\"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c delself.cmd' (with hidden window)

Executes the following