Trojan.DownLoader32.51241

Technical Information

Modifies file system

Creates the following files

<Current directory>\d.cab
<Current directory>\$dpx$.tmp\616e9daae8900d488b68df0c5ad4d346.tmp
<Current directory>\$dpx$.tmp\270b3e3f671a49498dfcec9139ff1747.tmp
<Current directory>\$dpx$.tmp\4353c802711ac04fb5de6b4b8003c11e.tmp
<Current directory>\$dpx$.tmp\7c4886360711fa4c891e93f748df81e2.tmp
<Current directory>\$dpx$.tmp\ef515e1154cd0d428345e7c9380c939b.tmp
<Current directory>\$dpx$.tmp\6a06f8d01ee5824fa08874afc72cc050.tmp
<Current directory>\$dpx$.tmp\9f1c55b3e4d39640972fe00b55a46ac5.tmp
<Current directory>\$dpx$.tmp\a062fc048ebd2c4a972d431214664f52.tmp
<Current directory>\$dpx$.tmp\c809eb3ff9ce1a48918e940c4a63ffac.tmp
<Current directory>\$dpx$.tmp\35dbf77336c9024a937d100551a0cba6.tmp
<Current directory>\$dpx$.tmp\8fef6fd0eee1294d940451f7a5670ca3.tmp
<Current directory>\$dpx$.tmp\c3e14ed5ac4b13469c06423e31be635b.tmp
<Current directory>\$dpx$.tmp\6bbe31e26e6cb74a954647bdf69d1429.tmp
<Current directory>\$dpx$.tmp\4b7b323812baa94db024e115700c31e0.tmp
<Current directory>\$dpx$.tmp\7187022dae511043ba5a58072068a17d.tmp
<Current directory>\$dpx$.tmp\acfbe196ca70904db54c82bb29115b1a.tmp
<Current directory>\$dpx$.tmp\8cf44c2c45104b4c9aa37f38b6c3cb52.tmp
<Current directory>\$dpx$.tmp\4111769b6fa29949a1082801f04582a9.tmp
<Current directory>\$dpx$.tmp\ebdaa77a6beee545a2a218ab614143c9.tmp
<Current directory>\$dpx$.tmp\ff3aac9d9219f34e9171236ebad00ed4.tmp
<Current directory>\$dpx$.tmp\ffc5ca50d4687b4aad4262c52df861a9.tmp
<Current directory>\$dpx$.tmp\8cf36708d65fcf43bc84bb757064db99.tmp
<Current directory>\$dpx$.tmp\dcccd5761f348d41b59c1b209a9038d9.tmp
<Current directory>\$dpx$.tmp\38dd09fd42089f41a006175421be36df.tmp
<Current directory>\$dpx$.tmp\4fa94d1ffa6b2b448d980bc2dfe118af.tmp
<Current directory>\$dpx$.tmp\3146d52c2e8e0f4e9c87514a6926e311.tmp
<Current directory>\$dpx$.tmp\570f784df654704c90a9a2bd215e687c.tmp
<Current directory>\$dpx$.tmp\839fe2de6f3d734db5a4f747a207663a.tmp
<Current directory>\$dpx$.tmp\3a9df95ea499634dbdbf84fae4e4b898.tmp
<Current directory>\$dpx$.tmp\9a1ba38da2fae34c925e2fa2960e7082.tmp
<Current directory>\$dpx$.tmp\8e02bc02807a324d8507c5e46b559060.tmp
<Current directory>\$dpx$.tmp\b7d311c3532ca247a9844cd871fb7def.tmp
<Current directory>\$dpx$.tmp\fb26387e55044549a9727d1fc6c70aef.tmp
<Current directory>\$dpx$.tmp\174e37e2b639cb419291d53b1fa01479.tmp
<Current directory>\$dpx$.tmp\5d67a1ed9a71cd4cbd3153fe9d1d4cab.tmp
<Current directory>\$dpx$.tmp\307b28040d6db04c99f490b57778cd38.tmp
<Current directory>\$dpx$.tmp\6a60014480e9e942aed62753ae8a02ce.tmp
<Current directory>\$dpx$.tmp\54bd05ba0814ca4b81c4cc43e5f3d38e.tmp
<Current directory>\$dpx$.tmp\f2f7e478eee1944984f2cccd6d786b9b.tmp
<Current directory>\$dpx$.tmp\71e2a6b9f7257e46ad3808e1c4730a5a.tmp
<Current directory>\$dpx$.tmp\0669f663dc14824a98bd180704712c2f.tmp
<Current directory>\$dpx$.tmp\bf1d3d71567974419adbe6b297212ddf.tmp
<Current directory>\$dpx$.tmp\52970df634347a4aa9bca93312fb8508.tmp
<Current directory>\$dpx$.tmp\5953ab851c12364eb74e1d1e58e11b9e.tmp

Sets the 'hidden' attribute to the following files

<Current directory>\api-ms-win-core-console-l1-1-0.dll
<Current directory>\api-ms-win-crt-conio-l1-1-0.dll
<Current directory>\api-ms-win-crt-convert-l1-1-0.dll
<Current directory>\api-ms-win-crt-environment-l1-1-0.dll
<Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
<Current directory>\api-ms-win-crt-heap-l1-1-0.dll
<Current directory>\api-ms-win-crt-locale-l1-1-0.dll
<Current directory>\api-ms-win-crt-math-l1-1-0.dll
<Current directory>\api-ms-win-core-timezone-l1-1-0.dll
<Current directory>\api-ms-win-core-util-l1-1-0.dll
<Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
<Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
<Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
<Current directory>\api-ms-win-crt-string-l1-1-0.dll
<Current directory>\api-ms-win-crt-time-l1-1-0.dll
<Current directory>\api-ms-win-crt-utility-l1-1-0.dll
<Current directory>\msvcp140.dll
<Current directory>\opencl.dll
<Current directory>\api-ms-win-crt-private-l1-1-0.dll
<Current directory>\api-ms-win-crt-process-l1-1-0.dll
<Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
<Current directory>\api-ms-win-core-synch-l1-2-0.dll
<Current directory>\api-ms-win-core-synch-l1-1-0.dll
<Current directory>\api-ms-win-core-debug-l1-1-0.dll
<Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-2-0.dll
<Current directory>\api-ms-win-core-file-l2-1-0.dll
<Current directory>\api-ms-win-core-handle-l1-1-0.dll
<Current directory>\api-ms-win-core-heap-l1-1-0.dll
<Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
<Current directory>\api-ms-win-core-datetime-l1-1-0.dll
<Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
<Current directory>\api-ms-win-core-memory-l1-1-0.dll
<Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
<Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
<Current directory>\api-ms-win-core-profile-l1-1-0.dll
<Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
<Current directory>\api-ms-win-core-string-l1-1-0.dll
<Current directory>\api-ms-win-core-localization-l1-2-0.dll
<Current directory>\ucrtbase.dll
<Current directory>\vcruntime140.dll

Deletes the following files

<Current directory>\d.cab

Moves the following files

from <Current directory>\$dpx$.tmp\38dd09fd42089f41a006175421be36df.tmp to <Current directory>\api-ms-win-core-console-l1-1-0.dll
from <Current directory>\$dpx$.tmp\4353c802711ac04fb5de6b4b8003c11e.tmp to <Current directory>\api-ms-win-crt-conio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\7c4886360711fa4c891e93f748df81e2.tmp to <Current directory>\api-ms-win-crt-convert-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ef515e1154cd0d428345e7c9380c939b.tmp to <Current directory>\api-ms-win-crt-environment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\6a06f8d01ee5824fa08874afc72cc050.tmp to <Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
from <Current directory>\$dpx$.tmp\9f1c55b3e4d39640972fe00b55a46ac5.tmp to <Current directory>\api-ms-win-crt-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a062fc048ebd2c4a972d431214664f52.tmp to <Current directory>\api-ms-win-crt-locale-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c809eb3ff9ce1a48918e940c4a63ffac.tmp to <Current directory>\api-ms-win-crt-math-l1-1-0.dll
from <Current directory>\$dpx$.tmp\616e9daae8900d488b68df0c5ad4d346.tmp to <Current directory>\api-ms-win-core-timezone-l1-1-0.dll
from <Current directory>\$dpx$.tmp\270b3e3f671a49498dfcec9139ff1747.tmp to <Current directory>\api-ms-win-core-util-l1-1-0.dll
from <Current directory>\$dpx$.tmp\35dbf77336c9024a937d100551a0cba6.tmp to <Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
from <Current directory>\$dpx$.tmp\6bbe31e26e6cb74a954647bdf69d1429.tmp to <Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\4b7b323812baa94db024e115700c31e0.tmp to <Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\7187022dae511043ba5a58072068a17d.tmp to <Current directory>\api-ms-win-crt-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\acfbe196ca70904db54c82bb29115b1a.tmp to <Current directory>\api-ms-win-crt-time-l1-1-0.dll
from <Current directory>\$dpx$.tmp\8cf44c2c45104b4c9aa37f38b6c3cb52.tmp to <Current directory>\api-ms-win-crt-utility-l1-1-0.dll
from <Current directory>\$dpx$.tmp\4111769b6fa29949a1082801f04582a9.tmp to <Current directory>\msvcp140.dll
from <Current directory>\$dpx$.tmp\ebdaa77a6beee545a2a218ab614143c9.tmp to <Current directory>\opencl.dll
from <Current directory>\$dpx$.tmp\8fef6fd0eee1294d940451f7a5670ca3.tmp to <Current directory>\api-ms-win-crt-private-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c3e14ed5ac4b13469c06423e31be635b.tmp to <Current directory>\api-ms-win-crt-process-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ff3aac9d9219f34e9171236ebad00ed4.tmp to <Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
from <Current directory>\$dpx$.tmp\8cf36708d65fcf43bc84bb757064db99.tmp to <Current directory>\api-ms-win-core-synch-l1-2-0.dll
from <Current directory>\$dpx$.tmp\52970df634347a4aa9bca93312fb8508.tmp to <Current directory>\api-ms-win-core-synch-l1-1-0.dll
from <Current directory>\$dpx$.tmp\3146d52c2e8e0f4e9c87514a6926e311.tmp to <Current directory>\api-ms-win-core-debug-l1-1-0.dll
from <Current directory>\$dpx$.tmp\570f784df654704c90a9a2bd215e687c.tmp to <Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
from <Current directory>\$dpx$.tmp\839fe2de6f3d734db5a4f747a207663a.tmp to <Current directory>\api-ms-win-core-file-l1-1-0.dll
from <Current directory>\$dpx$.tmp\3a9df95ea499634dbdbf84fae4e4b898.tmp to <Current directory>\api-ms-win-core-file-l1-2-0.dll
from <Current directory>\$dpx$.tmp\9a1ba38da2fae34c925e2fa2960e7082.tmp to <Current directory>\api-ms-win-core-file-l2-1-0.dll
from <Current directory>\$dpx$.tmp\8e02bc02807a324d8507c5e46b559060.tmp to <Current directory>\api-ms-win-core-handle-l1-1-0.dll
from <Current directory>\$dpx$.tmp\b7d311c3532ca247a9844cd871fb7def.tmp to <Current directory>\api-ms-win-core-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\fb26387e55044549a9727d1fc6c70aef.tmp to <Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
from <Current directory>\$dpx$.tmp\4fa94d1ffa6b2b448d980bc2dfe118af.tmp to <Current directory>\api-ms-win-core-datetime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\174e37e2b639cb419291d53b1fa01479.tmp to <Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
from <Current directory>\$dpx$.tmp\307b28040d6db04c99f490b57778cd38.tmp to <Current directory>\api-ms-win-core-memory-l1-1-0.dll
from <Current directory>\$dpx$.tmp\6a60014480e9e942aed62753ae8a02ce.tmp to <Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
from <Current directory>\$dpx$.tmp\54bd05ba0814ca4b81c4cc43e5f3d38e.tmp to <Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f2f7e478eee1944984f2cccd6d786b9b.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
from <Current directory>\$dpx$.tmp\71e2a6b9f7257e46ad3808e1c4730a5a.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
from <Current directory>\$dpx$.tmp\0669f663dc14824a98bd180704712c2f.tmp to <Current directory>\api-ms-win-core-profile-l1-1-0.dll
from <Current directory>\$dpx$.tmp\bf1d3d71567974419adbe6b297212ddf.tmp to <Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
from <Current directory>\$dpx$.tmp\dcccd5761f348d41b59c1b209a9038d9.tmp to <Current directory>\api-ms-win-core-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\5d67a1ed9a71cd4cbd3153fe9d1d4cab.tmp to <Current directory>\api-ms-win-core-localization-l1-2-0.dll
from <Current directory>\$dpx$.tmp\ffc5ca50d4687b4aad4262c52df861a9.tmp to <Current directory>\ucrtbase.dll
from <Current directory>\$dpx$.tmp\5953ab851c12364eb74e1d1e58e11b9e.tmp to <Current directory>\vcruntime140.dll

Network activity

TCP

'lp##.abbny.com':443
'lp##.haqo.net':443

UDP

DNS ASK lp##.beahh.com
DNS ASK lp##.abbny.com
DNS ASK lp##.haqo.net

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a
'<SYSTEM32>\expand.exe' d.cab -f:* .

技术

术语

教育培训

误区

Technical Information

Curing recommendations

Free trial