Trojan.DownLoader46.50063

Техническая информация

Вредоносные функции

Запускает на исполнение

'<SYSTEM32>\taskkill.exe' /F /IM HTTPDebuggerSvc.exe
'<SYSTEM32>\taskkill.exe' /F /IM KsDumperClient.exe
'<SYSTEM32>\taskkill.exe' /F /IM HTTPDebuggerUI.exe
'<SYSTEM32>\taskkill.exe' /F /IM FolderChangesView.exe
'<SYSTEM32>\taskkill.exe' /F /IM ProcessHacker.exe
'<SYSTEM32>\taskkill.exe' /F /IM procmon.exe
'<SYSTEM32>\taskkill.exe' /F /IM idaq.exe
'<SYSTEM32>\taskkill.exe' /F /IM idaq64.exe
'<SYSTEM32>\taskkill.exe' /F /IM Wireshark.exe
'<SYSTEM32>\taskkill.exe' /F /IM Fiddler.exe
'<SYSTEM32>\taskkill.exe' /F /IM Xenos64.exe
'<SYSTEM32>\taskkill.exe' /F /IM Cheat Engine.exe
'<SYSTEM32>\taskkill.exe' /F /IM HTTP Debugger Windows Service (32 bit).exe
'<SYSTEM32>\taskkill.exe' /F /IM KsDumper.exe
'<SYSTEM32>\taskkill.exe' /F /IM x64dbg.exe
'<SYSTEM32>\taskkill.exe' /F /IM dnSpy.exe

Изменения в файловой системе

Создает следующие файлы

<Текущая директория>\debugger
%WINDIR%\temp\tar70e7.tmp
%WINDIR%\temp\cab70e6.tmp
%WINDIR%\temp\tar5aa7.tmp
%WINDIR%\temp\cab5aa6.tmp
%WINDIR%\temp\tar5a28.tmp
%WINDIR%\temp\cab5a27.tmp
%WINDIR%\temp\tar4445.tmp
%WINDIR%\temp\cab4444.tmp
%WINDIR%\temp\tar43c7.tmp
%WINDIR%\temp\cab43b6.tmp
%WINDIR%\temp\tar2e22.tmp
%WINDIR%\temp\cab2e21.tmp
%WINDIR%\temp\tar2dd2.tmp
%WINDIR%\temp\cabb4f9.tmp
%WINDIR%\temp\cab2dd1.tmp
%WINDIR%\temp\cab183d.tmp
%WINDIR%\temp\tar17fe.tmp
%WINDIR%\temp\cab17fd.tmp
%WINDIR%\temp\tar17bd.tmp
%WINDIR%\temp\cab17ad.tmp
%WINDIR%\temp\tar16f0.tmp
%WINDIR%\temp\cab16ef.tmp
%WINDIR%\temp\tar13d.tmp
%WINDIR%\temp\cab13c.tmp
%WINDIR%\temp\tardd.tmp
%WINDIR%\temp\cabdc.tmp
%WINDIR%\temp\tarea4f.tmp
%WINDIR%\temp\cabea4e.tmp
%WINDIR%\temp\tar184e.tmp
%WINDIR%\temp\tarb4fa.tmp

Удаляет следующие файлы

%WINDIR%\temp\cabea4e.tmp
%WINDIR%\temp\tar70e7.tmp
%WINDIR%\temp\cab70e6.tmp
%WINDIR%\temp\tar5aa7.tmp
%WINDIR%\temp\cab5aa6.tmp
%WINDIR%\temp\tar5a28.tmp
%WINDIR%\temp\cab5a27.tmp
%WINDIR%\temp\tar4445.tmp
%WINDIR%\temp\cab4444.tmp
%WINDIR%\temp\tar43c7.tmp
%WINDIR%\temp\cab43b6.tmp
%WINDIR%\temp\tar2e22.tmp
%WINDIR%\temp\cab2e21.tmp
%WINDIR%\temp\tar2dd2.tmp
%WINDIR%\temp\cab2dd1.tmp
%WINDIR%\temp\tar184e.tmp
%WINDIR%\temp\cab183d.tmp
%WINDIR%\temp\tar17fe.tmp
%WINDIR%\temp\cab17fd.tmp
%WINDIR%\temp\tar17bd.tmp
%WINDIR%\temp\cab17ad.tmp
%WINDIR%\temp\tar16f0.tmp
%WINDIR%\temp\cab16ef.tmp
%WINDIR%\temp\tar13d.tmp
%WINDIR%\temp\cab13c.tmp
%WINDIR%\temp\tardd.tmp
%WINDIR%\temp\cabdc.tmp
%WINDIR%\temp\tarea4f.tmp
%WINDIR%\temp\cabb4f9.tmp
%WINDIR%\temp\tarb4fa.tmp

Сетевая активность

Подключается к

'localhost':49188
'localhost':49190
'ke##uth.win':443
'x1.#.lencr.org':80
'x2.#.lencr.org':80

TCP

Запросы HTTP GET

http://x1.#.lencr.org/
http://x2.#.lencr.org/

Другие

'localhost':49188
'localhost':49190
'localhost':49191
'ke##uth.win':443

UDP

DNS ASK ke##uth.win
DNS ASK x1.#.lencr.org
DNS ASK x2.#.lencr.org

Другое

Ищет следующие окна

ClassName: '' WindowName: ''

Запускает на исполнение

'<SYSTEM32>\cmd.exe' /c TASKKILL /F /IM HTTPDebuggerSvc.exe >NUL 2> Debugger
'<SYSTEM32>\cmd.exe' /c start cmd /C "color b && title Error && echo SSL connect error && timeout /t 5"
'<SYSTEM32>\find.exe' /i /v "certutil"
'<SYSTEM32>\find.exe' /i /v "md5"
'<SYSTEM32>\certutil.exe' -hashfile "<Полный путь к файлу>" MD5
'<SYSTEM32>\cmd.exe' /c certutil -hashfile "<Полный путь к файлу>" MD5 | find /i /v "md5" | find /i /v "certutil"
'<SYSTEM32>\cmd.exe' /c TASKKILL /F /IM dnSpy.exe >NUL 2> Debugger
'<SYSTEM32>\cmd.exe' /c TASKKILL /F /IM x64dbg.exe >NUL 2> Debugger
'<SYSTEM32>\cmd.exe' /c TASKKILL /F /IM KsDumper.exe >NUL 2> Debugger
'<SYSTEM32>\cmd.exe' /c TASKKILL /F /IM HTTP Debugger Windows Service (32 bit).exe >NUL 2> Debugger
'<SYSTEM32>\cmd.exe' /C "color b && title Error && echo SSL connect error && timeout /t 5"
'<SYSTEM32>\cmd.exe' /c TASKKILL /F /IM Cheat Engine.exe >NUL 2> Debugger
'<SYSTEM32>\cmd.exe' /c TASKKILL /F /IM Fiddler.exe >NUL 2> Debugger
'<SYSTEM32>\cmd.exe' /c TASKKILL /F /IM Wireshark.exe >NUL 2> Debugger
'<SYSTEM32>\cmd.exe' /c TASKKILL /F /IM idaq64.exe >NUL 2> Debugger
'<SYSTEM32>\cmd.exe' /c TASKKILL /F /IM idaq.exe >NUL 2> Debugger
'<SYSTEM32>\cmd.exe' /c TASKKILL /F /IM procmon.exe >NUL 2> Debugger
'<SYSTEM32>\cmd.exe' /c TASKKILL /F /IM ProcessHacker.exe >NUL 2> Debugger
'<SYSTEM32>\cmd.exe' /c TASKKILL /F /IM FolderChangesView.exe >NUL 2> Debugger
'<SYSTEM32>\cmd.exe' /c TASKKILL /F /IM HTTPDebuggerUI.exe >NUL 2> Debugger
'<SYSTEM32>\cmd.exe' /c TASKKILL /F /IM KsDumperClient.exe >NUL 2> Debugger
'<SYSTEM32>\cmd.exe' /c TASKKILL /F /IM Xenos64.exe >NUL 2> Debugger
'<SYSTEM32>\timeout.exe' /t 5