Trojan.DownLoader24.3209

Техническая информация

Для обеспечения автозапуска и распространения

Устанавливает следующие настройки сервисов

[<HKLM>\System\CurrentControlSet\Services\ZAM_Guard] 'Start' = '00000001'
[<HKLM>\System\CurrentControlSet\Services\ZAM_Guard] 'ImagePath' = '<DRIVERS>\zamguard64.sys'
[<HKLM>\System\CurrentControlSet\Services\ZAM] 'Start' = '00000001'
[<HKLM>\System\CurrentControlSet\Services\ZAM] 'ImagePath' = '<DRIVERS>\zam64.sys'

Создает следующие сервисы

'ZAM_Guard' <DRIVERS>\zamguard64.sys
'ZAM' <DRIVERS>\zam64.sys

Изменения в файловой системе

Создает следующие файлы

%LOCALAPPDATA%\zemana\tracer\<Имя файла>.trace
%LOCALAPPDATA%\zemana\zemana antimalware\lang\portuguese.ini
%LOCALAPPDATA%\zemana\zemana antimalware\lang\romanian.ini
%LOCALAPPDATA%\zemana\zemana antimalware\lang\russian.ini
%LOCALAPPDATA%\zemana\zemana antimalware\lang\serbian.ini
%LOCALAPPDATA%\zemana\zemana antimalware\lang\spanish.ini
%LOCALAPPDATA%\zemana\zemana antimalware\lang\swedish.ini
%LOCALAPPDATA%\zemana\zemana antimalware\lang\telugu.ini
%LOCALAPPDATA%\zemana\zemana antimalware\lang\turkish.ini
%LOCALAPPDATA%\zemana\zemana antimalware\lang\ukrainian.ini
%LOCALAPPDATA%\zemana\zemana antimalware\lang\vietnamese.ini
%LOCALAPPDATA%\zemana\zemana antimalware\lang\persian.ini
%LOCALAPPDATA%\zemana\zemana antimalware\lang\polish.ini
%LOCALAPPDATA%\zemana\zemana antimalware\lang\norwegian.ini
%LOCALAPPDATA%\zemana\zemana antimalware\lang\slovak.ini
%LOCALAPPDATA%\zemana\zemana antimalware\lang\slovenian.ini
%LOCALAPPDATA%\zemana\zemana antimalware\lang\hebrew.ini
%WINDIR%\temp\uddbe7e.tmp
<DRIVERS>\zam64.sys
%LOCALAPPDATA%\zemana\zemana antimalware\settings.db
%WINDIR%\temp\uddc38e.tmp
%WINDIR%\zam_guard.krnl.trace
%WINDIR%\zam.krnl.trace
%LOCALAPPDATA%\zemana\zemana antimalware\update_{48cbf692-14c8-430b-b437-52ddf65ade2b}.exe
%LOCALAPPDATA%\zemana\zemana antimalware\lang\malaysian.ini
%LOCALAPPDATA%\zemana\zemana antimalware\lang\kurdish.ini
%LOCALAPPDATA%\zemana\zemana antimalware\lang\lithuanian.ini
%LOCALAPPDATA%\zemana\zemana antimalware\lang\latvian.ini
%LOCALAPPDATA%\zemana\zemana antimalware\lang\korean.ini
%LOCALAPPDATA%\zemana\zemana antimalware\nedb.zdb
%LOCALAPPDATA%\zemana\zemana antimalware\nedb.zdb_config.ini
<DRIVERS>\zamguard64.sys
%LOCALAPPDATA%\zemana\zemana antimalware\lang\albanian.ini
%LOCALAPPDATA%\zemana\zemana antimalware\lang\arabic.ini
%LOCALAPPDATA%\zemana\zemana antimalware\lang\bengali.ini
%LOCALAPPDATA%\zemana\zemana antimalware\lang\bosnian.ini
%LOCALAPPDATA%\zemana\zemana antimalware\lang\brazilianportuguese.ini
%LOCALAPPDATA%\zemana\zemana antimalware\lang\bulgarian.ini
%LOCALAPPDATA%\zemana\zemana antimalware\lang\byelorussian.ini
%LOCALAPPDATA%\zemana\zemana antimalware\lang\czech.ini
%TEMP%\{ae5e7683-9c0a-4d14-bab2-75913673170e}.cat
%LOCALAPPDATA%\zemana\zemana antimalware\lang\chinesesimplified.ini
%LOCALAPPDATA%\zemana\zemana antimalware\lang\croatian.ini
%LOCALAPPDATA%\zemana\zemana antimalware\lang\dutch.ini
%LOCALAPPDATA%\zemana\zemana antimalware\lang\english.ini
%LOCALAPPDATA%\zemana\zemana antimalware\lang\estonian.ini
%LOCALAPPDATA%\zemana\zemana antimalware\lang\finnish.ini
%LOCALAPPDATA%\zemana\zemana antimalware\lang\french.ini
%LOCALAPPDATA%\zemana\zemana antimalware\lang\german.ini
%LOCALAPPDATA%\zemana\zemana antimalware\lang\hindi.ini
%LOCALAPPDATA%\zemana\zemana antimalware\lang\hungarian.ini
%LOCALAPPDATA%\zemana\zemana antimalware\lang\indonesian.ini
%LOCALAPPDATA%\zemana\zemana antimalware\lang\italian.ini
%LOCALAPPDATA%\zemana\zemana antimalware\lang\chinesetraditional.ini
%TEMP%\is-rp0ak.tmp\update_{48cbf692-14c8-430b-b437-52ddf65ade2b}.tmp
%TEMP%\setup log 2020-10-08 #001.txt

Удаляет следующие файлы

%TEMP%\{ae5e7683-9c0a-4d14-bab2-75913673170e}.cat
%WINDIR%\temp\uddbe7e.tmp
%WINDIR%\temp\uddc38e.tmp

Сетевая активность

TCP

Запросы HTTP GET

http://dl##.zemana.com/CacheControl.bin
http://dl##.zemana.com/AntiMalware/3.1.450/AntiMalware_Setup.exe

Запросы HTTP POST

http://za####ud.zemana.com/api/client/settings/12A898A447F358E7C1C58B/2/74/2072176

UDP

DNS ASK dl##.zemana.com
DNS ASK za####ud.zemana.com

Другое

Ищет следующие окна

ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebCheckMonitor' WindowName: ''

Создает и запускает на исполнение

'%LOCALAPPDATA%\zemana\zemana antimalware\update_{48cbf692-14c8-430b-b437-52ddf65ade2b}.exe' /replace "<Полный путь к файлу>"
'%TEMP%\is-rp0ak.tmp\update_{48cbf692-14c8-430b-b437-52ddf65ade2b}.tmp' /SL5="$202E2,12111926,121344,%LOCALAPPDATA%\Zemana\Zemana AntiMalware\update_{48CBF692-14C8-430B-B437-52DDF65ADE2B}.exe" /replace "<Полный путь к файлу>"