Trojan.DownLoader35.906

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'IEService' = '<Полный путь к файлу>'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] '{050d4fc8-5d48-4b8f-8972-47c82c46020f}' = '"%ALLUSERSPROFILE%\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredi...
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] '{2af972c7-13b0-4978-92a8-fee26a4fb4e9}' = '"%ALLUSERSPROFILE%\Package Cache\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\vcredi...
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] '{51adbf11-493f-431c-a862-967a0fae2944}' = '"%ALLUSERSPROFILE%\Package Cache\{51adbf11-493f-431c-a862-967a0fae2944}\vcredi...
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] '{ce085a78-074e-4823-8dc1-8a721b94b76d}' = '"%ALLUSERSPROFILE%\Package Cache\{ce085a78-074e-4823-8dc1-8a721b94b76d}\vcredi...

Изменения в файловой системе

Создает следующие файлы

%TEMP%\j0jkxqjm.koz\vcredist_x64.exe
%TEMP%\{ce085a78-074e-4823-8dc1-8a721b94b76d}\.ba1\license.rtf
%TEMP%\{ce085a78-074e-4823-8dc1-8a721b94b76d}\.ba1\logo.png
%TEMP%\{ce085a78-074e-4823-8dc1-8a721b94b76d}\.ba1\thm.wxl
%TEMP%\{ce085a78-074e-4823-8dc1-8a721b94b76d}\.ba1\thm.xml
%TEMP%\{ce085a78-074e-4823-8dc1-8a721b94b76d}\.ba1\wixstdba.dll
%TEMP%\dd_vcredist_amd64_20201015200829.log
%TEMP%\{51adbf11-493f-431c-a862-967a0fae2944}\.ba1\bootstrapperapplicationdata.xml
%TEMP%\{51adbf11-493f-431c-a862-967a0fae2944}\.ba1\license.rtf
%TEMP%\{51adbf11-493f-431c-a862-967a0fae2944}\.ba1\logo.png
%TEMP%\{51adbf11-493f-431c-a862-967a0fae2944}\.ba1\thm.wxl
%TEMP%\{51adbf11-493f-431c-a862-967a0fae2944}\.ba1\thm.xml
%TEMP%\{51adbf11-493f-431c-a862-967a0fae2944}\.ba1\wixstdba.dll
%TEMP%\dd_vcredist_x86_20201015200822.log
%TEMP%\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\.ba1\bootstrapperapplicationdata.xml
%TEMP%\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\.ba1\license.rtf
%TEMP%\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\.ba1\logo.png
%TEMP%\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\.ba1\thm.wxl
%TEMP%\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\.ba1\thm.xml
%TEMP%\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\.ba1\wixstdba.dll
%ALLUSERSPROFILE%\package cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\state.rsm
%ALLUSERSPROFILE%\package cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe
%TEMP%\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\.be\vcredist_x64.exe
%TEMP%\dd_vcredist_amd64_20201015200814.log
%TEMP%\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\.ba1\bootstrapperapplicationdata.xml
%TEMP%\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\.ba1\license.rtf
%TEMP%\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\.ba1\logo.png
%TEMP%\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\.ba1\thm.wxl
%TEMP%\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\.ba1\thm.xml
%TEMP%\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\.ba1\wixstdba.dll
%TEMP%\{ce085a78-074e-4823-8dc1-8a721b94b76d}\.ba1\bootstrapperapplicationdata.xml
%TEMP%\dd_vcredist_x86_20201015200837.log

Удаляет следующие файлы

%TEMP%\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\.ba1\bootstrapperapplicationdata.xml
%TEMP%\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\.ba1\wixstdba.dll
%TEMP%\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\.ba1\thm.xml
%TEMP%\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\.ba1\thm.wxl
%TEMP%\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\.ba1\logo.png
%TEMP%\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\.ba1\license.rtf
%TEMP%\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\.ba1\bootstrapperapplicationdata.xml
%TEMP%\{ce085a78-074e-4823-8dc1-8a721b94b76d}\.ba1\wixstdba.dll
%TEMP%\{ce085a78-074e-4823-8dc1-8a721b94b76d}\.ba1\thm.xml
%TEMP%\{ce085a78-074e-4823-8dc1-8a721b94b76d}\.ba1\thm.wxl
%TEMP%\{ce085a78-074e-4823-8dc1-8a721b94b76d}\.ba1\logo.png
%TEMP%\{ce085a78-074e-4823-8dc1-8a721b94b76d}\.ba1\license.rtf
%TEMP%\{ce085a78-074e-4823-8dc1-8a721b94b76d}\.ba1\bootstrapperapplicationdata.xml
%TEMP%\{51adbf11-493f-431c-a862-967a0fae2944}\.ba1\wixstdba.dll
%TEMP%\{51adbf11-493f-431c-a862-967a0fae2944}\.ba1\thm.xml
%TEMP%\{51adbf11-493f-431c-a862-967a0fae2944}\.ba1\thm.wxl
%TEMP%\{51adbf11-493f-431c-a862-967a0fae2944}\.ba1\logo.png
%TEMP%\{51adbf11-493f-431c-a862-967a0fae2944}\.ba1\license.rtf
%TEMP%\{51adbf11-493f-431c-a862-967a0fae2944}\.ba1\bootstrapperapplicationdata.xml
%TEMP%\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\.ba1\wixstdba.dll
%TEMP%\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\.ba1\thm.xml
%TEMP%\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\.ba1\thm.wxl
%TEMP%\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\.ba1\logo.png
%TEMP%\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\.ba1\license.rtf
%TEMP%\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\.be\vcredist_x64.exe
%TEMP%\j0jkxqjm.koz\vcredist_x64.exe

Сетевая активность

TCP

Запросы HTTP GET

http://pa###bin.com/raw/GxMrtP5S

'pa###bin.com':443

'download.microsoft.com':443

UDP

DNS ASK pa###bin.com
DNS ASK download.microsoft.com

Другое

Создает и запускает на исполнение

'%TEMP%\j0jkxqjm.koz\vcredist_x64.exe' /install /quiet /norestart
'%TEMP%\j0jkxqjm.koz\vcredist_x64.exe' /install /quiet /norestart -burn.unelevated BurnPipe.{BD403685-AE37-4C60-AFB1-28BEE1B491C4} {3B8A4C14-434A-4F67-9F33-1BC926C2093F} 1412