Trojan.DownLoader30.38393

Technical Information

Modifies file system

Creates the following files

<Current directory>\d.cab
<Current directory>\$dpx$.tmp\74a9d84fe3ec01479f6f6e82768e9dd7.tmp
<Current directory>\$dpx$.tmp\2869a9be1d5b9e438981d51e0b9fbaeb.tmp
<Current directory>\$dpx$.tmp\e6bf527318b05341957e2bac71227c62.tmp
<Current directory>\$dpx$.tmp\5f5246fc9b110540b3c0f2dbc4a4a909.tmp
<Current directory>\$dpx$.tmp\d184b987a6b9784787978fcb11aade5e.tmp
<Current directory>\$dpx$.tmp\718a2345d1edb84581dcd2b082b42ba3.tmp
<Current directory>\$dpx$.tmp\800a08c6befe5c44810b5175e62fd7f8.tmp
<Current directory>\$dpx$.tmp\b4180f6eeb0a2749a6baad22d222085c.tmp
<Current directory>\$dpx$.tmp\dfddbe542a6a0d47ad343cf15d3ab1bb.tmp
<Current directory>\$dpx$.tmp\505cb658fb51114b9618109da206eb94.tmp
<Current directory>\$dpx$.tmp\873bd0f64fc10546a87cb8e1c8de5eaf.tmp
<Current directory>\$dpx$.tmp\261b950dd6fbc54fb1d9870c4a7ad82f.tmp
<Current directory>\$dpx$.tmp\373d21c2928f2d4a85fb6b4bcb626a84.tmp
<Current directory>\$dpx$.tmp\9a281d1fad0186479a938183091e66ab.tmp
<Current directory>\$dpx$.tmp\ba5f0d21a1e85149bfd1dd8536ea3127.tmp
<Current directory>\$dpx$.tmp\be260e36c0c29f48873af6b6ccfe1537.tmp
<Current directory>\$dpx$.tmp\546ccaed9827834db028f731c7523066.tmp
<Current directory>\$dpx$.tmp\3d5abe9a59f97f408e926ab45245d686.tmp
<Current directory>\$dpx$.tmp\c9406cbf6824184985b871d9a830e8a5.tmp
<Current directory>\$dpx$.tmp\9ede6a5a3ef14c42a1d6242d2c219c18.tmp
<Current directory>\$dpx$.tmp\61dd3ddd2c1052488c48b138e5bb5ced.tmp
<Current directory>\$dpx$.tmp\6cef3611b9a49545b3f4cefed8d4cff6.tmp
<Current directory>\$dpx$.tmp\1b939e466483d94db49b5da1dfe1060a.tmp
<Current directory>\$dpx$.tmp\820eda74fd11b442a8396d08b77cb423.tmp
<Current directory>\$dpx$.tmp\7002bfe92d75ab47a50cafaee6bde6bf.tmp
<Current directory>\$dpx$.tmp\c9e082e149294845b9d454c989d2c882.tmp
<Current directory>\$dpx$.tmp\cca3800266307540be4432e5e6680e4a.tmp
<Current directory>\$dpx$.tmp\e827416398696849a377adb8e580d3ca.tmp
<Current directory>\$dpx$.tmp\57740d89c65520458ebda63e171ecaec.tmp
<Current directory>\$dpx$.tmp\f54c1a29c6bbf6449fa5e3ca7470be99.tmp
<Current directory>\$dpx$.tmp\bf220c3e36a50343a90167f5f4783b6c.tmp
<Current directory>\$dpx$.tmp\a9a4da4c81e30647ad4bd177722da535.tmp
<Current directory>\$dpx$.tmp\7c652a513351b448bd983bd4a6462843.tmp
<Current directory>\$dpx$.tmp\edadf8dccbaac24fa84822e423fa4f42.tmp
<Current directory>\$dpx$.tmp\a400a3d9ae962448af7dba41252dd1f4.tmp
<Current directory>\$dpx$.tmp\0053001f1494f44eb6a65bbbe5a9702d.tmp
<Current directory>\$dpx$.tmp\ca55e9537b75b34081d122a8725f0b24.tmp
<Current directory>\$dpx$.tmp\7ec9ea15b8e3eb41a6d7c2cf8a890efc.tmp
<Current directory>\$dpx$.tmp\4e1fe01fd11a434fa6a1a19b2d622d4c.tmp
<Current directory>\$dpx$.tmp\b438faef859f994e97e0cb7b3d2cdb67.tmp
<Current directory>\$dpx$.tmp\eb29bdbc4825e5418b1f672c171320ed.tmp
<Current directory>\$dpx$.tmp\076382239698db47a5b5059126883782.tmp
<Current directory>\$dpx$.tmp\ed783f7650c6924dba2e7c97d70cd49c.tmp
<Current directory>\$dpx$.tmp\b5c9260f218c334dbf7692ec986db8da.tmp

Sets the 'hidden' attribute to the following files

<Current directory>\api-ms-win-core-console-l1-1-0.dll
<Current directory>\api-ms-win-crt-conio-l1-1-0.dll
<Current directory>\api-ms-win-crt-convert-l1-1-0.dll
<Current directory>\api-ms-win-crt-environment-l1-1-0.dll
<Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
<Current directory>\api-ms-win-crt-heap-l1-1-0.dll
<Current directory>\api-ms-win-crt-locale-l1-1-0.dll
<Current directory>\api-ms-win-crt-math-l1-1-0.dll
<Current directory>\api-ms-win-core-timezone-l1-1-0.dll
<Current directory>\api-ms-win-core-util-l1-1-0.dll
<Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
<Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
<Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
<Current directory>\api-ms-win-crt-string-l1-1-0.dll
<Current directory>\api-ms-win-crt-time-l1-1-0.dll
<Current directory>\api-ms-win-crt-utility-l1-1-0.dll
<Current directory>\msvcp140.dll
<Current directory>\opencl.dll
<Current directory>\api-ms-win-crt-private-l1-1-0.dll
<Current directory>\api-ms-win-crt-process-l1-1-0.dll
<Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
<Current directory>\api-ms-win-core-synch-l1-2-0.dll
<Current directory>\api-ms-win-core-synch-l1-1-0.dll
<Current directory>\api-ms-win-core-debug-l1-1-0.dll
<Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-2-0.dll
<Current directory>\api-ms-win-core-file-l2-1-0.dll
<Current directory>\api-ms-win-core-handle-l1-1-0.dll
<Current directory>\api-ms-win-core-heap-l1-1-0.dll
<Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
<Current directory>\api-ms-win-core-datetime-l1-1-0.dll
<Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
<Current directory>\api-ms-win-core-memory-l1-1-0.dll
<Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
<Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
<Current directory>\api-ms-win-core-profile-l1-1-0.dll
<Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
<Current directory>\api-ms-win-core-string-l1-1-0.dll
<Current directory>\api-ms-win-core-localization-l1-2-0.dll
<Current directory>\ucrtbase.dll
<Current directory>\vcruntime140.dll

Deletes the following files

<Current directory>\d.cab

Moves the following files

from <Current directory>\$dpx$.tmp\820eda74fd11b442a8396d08b77cb423.tmp to <Current directory>\api-ms-win-core-console-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e6bf527318b05341957e2bac71227c62.tmp to <Current directory>\api-ms-win-crt-conio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\5f5246fc9b110540b3c0f2dbc4a4a909.tmp to <Current directory>\api-ms-win-crt-convert-l1-1-0.dll
from <Current directory>\$dpx$.tmp\d184b987a6b9784787978fcb11aade5e.tmp to <Current directory>\api-ms-win-crt-environment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\718a2345d1edb84581dcd2b082b42ba3.tmp to <Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
from <Current directory>\$dpx$.tmp\800a08c6befe5c44810b5175e62fd7f8.tmp to <Current directory>\api-ms-win-crt-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\b4180f6eeb0a2749a6baad22d222085c.tmp to <Current directory>\api-ms-win-crt-locale-l1-1-0.dll
from <Current directory>\$dpx$.tmp\dfddbe542a6a0d47ad343cf15d3ab1bb.tmp to <Current directory>\api-ms-win-crt-math-l1-1-0.dll
from <Current directory>\$dpx$.tmp\74a9d84fe3ec01479f6f6e82768e9dd7.tmp to <Current directory>\api-ms-win-core-timezone-l1-1-0.dll
from <Current directory>\$dpx$.tmp\2869a9be1d5b9e438981d51e0b9fbaeb.tmp to <Current directory>\api-ms-win-core-util-l1-1-0.dll
from <Current directory>\$dpx$.tmp\505cb658fb51114b9618109da206eb94.tmp to <Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
from <Current directory>\$dpx$.tmp\373d21c2928f2d4a85fb6b4bcb626a84.tmp to <Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\9a281d1fad0186479a938183091e66ab.tmp to <Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ba5f0d21a1e85149bfd1dd8536ea3127.tmp to <Current directory>\api-ms-win-crt-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\be260e36c0c29f48873af6b6ccfe1537.tmp to <Current directory>\api-ms-win-crt-time-l1-1-0.dll
from <Current directory>\$dpx$.tmp\546ccaed9827834db028f731c7523066.tmp to <Current directory>\api-ms-win-crt-utility-l1-1-0.dll
from <Current directory>\$dpx$.tmp\3d5abe9a59f97f408e926ab45245d686.tmp to <Current directory>\msvcp140.dll
from <Current directory>\$dpx$.tmp\c9406cbf6824184985b871d9a830e8a5.tmp to <Current directory>\opencl.dll
from <Current directory>\$dpx$.tmp\873bd0f64fc10546a87cb8e1c8de5eaf.tmp to <Current directory>\api-ms-win-crt-private-l1-1-0.dll
from <Current directory>\$dpx$.tmp\261b950dd6fbc54fb1d9870c4a7ad82f.tmp to <Current directory>\api-ms-win-crt-process-l1-1-0.dll
from <Current directory>\$dpx$.tmp\9ede6a5a3ef14c42a1d6242d2c219c18.tmp to <Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
from <Current directory>\$dpx$.tmp\6cef3611b9a49545b3f4cefed8d4cff6.tmp to <Current directory>\api-ms-win-core-synch-l1-2-0.dll
from <Current directory>\$dpx$.tmp\ed783f7650c6924dba2e7c97d70cd49c.tmp to <Current directory>\api-ms-win-core-synch-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c9e082e149294845b9d454c989d2c882.tmp to <Current directory>\api-ms-win-core-debug-l1-1-0.dll
from <Current directory>\$dpx$.tmp\cca3800266307540be4432e5e6680e4a.tmp to <Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e827416398696849a377adb8e580d3ca.tmp to <Current directory>\api-ms-win-core-file-l1-1-0.dll
from <Current directory>\$dpx$.tmp\57740d89c65520458ebda63e171ecaec.tmp to <Current directory>\api-ms-win-core-file-l1-2-0.dll
from <Current directory>\$dpx$.tmp\f54c1a29c6bbf6449fa5e3ca7470be99.tmp to <Current directory>\api-ms-win-core-file-l2-1-0.dll
from <Current directory>\$dpx$.tmp\bf220c3e36a50343a90167f5f4783b6c.tmp to <Current directory>\api-ms-win-core-handle-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a9a4da4c81e30647ad4bd177722da535.tmp to <Current directory>\api-ms-win-core-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\7c652a513351b448bd983bd4a6462843.tmp to <Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
from <Current directory>\$dpx$.tmp\7002bfe92d75ab47a50cafaee6bde6bf.tmp to <Current directory>\api-ms-win-core-datetime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\edadf8dccbaac24fa84822e423fa4f42.tmp to <Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
from <Current directory>\$dpx$.tmp\0053001f1494f44eb6a65bbbe5a9702d.tmp to <Current directory>\api-ms-win-core-memory-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ca55e9537b75b34081d122a8725f0b24.tmp to <Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
from <Current directory>\$dpx$.tmp\7ec9ea15b8e3eb41a6d7c2cf8a890efc.tmp to <Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\4e1fe01fd11a434fa6a1a19b2d622d4c.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
from <Current directory>\$dpx$.tmp\b438faef859f994e97e0cb7b3d2cdb67.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
from <Current directory>\$dpx$.tmp\eb29bdbc4825e5418b1f672c171320ed.tmp to <Current directory>\api-ms-win-core-profile-l1-1-0.dll
from <Current directory>\$dpx$.tmp\076382239698db47a5b5059126883782.tmp to <Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
from <Current directory>\$dpx$.tmp\1b939e466483d94db49b5da1dfe1060a.tmp to <Current directory>\api-ms-win-core-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a400a3d9ae962448af7dba41252dd1f4.tmp to <Current directory>\api-ms-win-core-localization-l1-2-0.dll
from <Current directory>\$dpx$.tmp\61dd3ddd2c1052488c48b138e5bb5ced.tmp to <Current directory>\ucrtbase.dll
from <Current directory>\$dpx$.tmp\b5c9260f218c334dbf7692ec986db8da.tmp to <Current directory>\vcruntime140.dll

Network activity

Connects to

'localhost':443

UDP

DNS ASK lp##.beahh.com
DNS ASK lp##.abbny.com
DNS ASK lp##.haqo.net

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a
'<SYSTEM32>\expand.exe' d.cab -f:* .

Technologies

Begriffe

Schulung und Training

Mythen

Technical Information

Curing recommendations

Free trial