Trojan.DownLoader40.46794

Technical Information

Malicious functions

Executes the following

'%WINDIR%\syswow64\taskkill.exe' /F /IM eBH.exe

Modifies file system

Creates the following files

<Current directory>\ebhstart.exe
<Current directory>\update\sql\ecus_acc_67.sql
<Current directory>\update\sql\ecus_acc_68.sql
<Current directory>\update\sql\ecus_acc_69.sql
<Current directory>\update\sql\ecus_acc_7.sql
<Current directory>\update\sql\ecus_acc_8.sql
<Current directory>\update\sql\ecus_acc_9.sql
<Current directory>\update\sql\ecus_acc_53.sql
<Current directory>\update\sql\ecus_sql_1000.sql
<Current directory>\update\sql\ecus_sql_22.sql
<Current directory>\update\sql\ecus_sql_23.sql
<Current directory>\update\sql\ecus_sql_24.sql
<Current directory>\update\sql\ecus_sql_25.sql
<Current directory>\update\sql\ecus_sql_26.sql
<Current directory>\update\sql\ecus_sql_27.sql
<Current directory>\update\sql\ecus_sql_28.sql
<Current directory>\update\sql\ecus_acc_64.sql
<Current directory>\update\sql\ecus_sql_21.sql
<Current directory>\update\sql\ecus_acc_66.sql
<Current directory>\update\sql\ecus_acc_65.sql
<Current directory>\update\sql\ecus_acc_63.sql
<Current directory>\update\sql\ecus_acc_62.sql
<Current directory>\update\sql\ecus_acc_47.sql
<Current directory>\update\sql\ecus_acc_48.sql
<Current directory>\update\sql\ecus_acc_49.sql
<Current directory>\update\sql\ecus_acc_5.sql
<Current directory>\update\sql\ecus_acc_50.sql
<Current directory>\update\sql\ecus_acc_51.sql
<Current directory>\update\sql\ecus_sql_29.sql
<Current directory>\update\sql\ecus_acc_52.sql
<Current directory>\update\sql\ecus_acc_44.sql
<Current directory>\update\sql\ecus_acc_54.sql
<Current directory>\update\sql\ecus_acc_56.sql
<Current directory>\update\sql\ecus_acc_57.sql
<Current directory>\update\sql\ecus_acc_58.sql
<Current directory>\update\sql\ecus_acc_59.sql
<Current directory>\update\sql\ecus_acc_6.sql
<Current directory>\update\sql\ecus_acc_60.sql
<Current directory>\update\sql\ecus_acc_45.sql
<Current directory>\update\sql\ecus_acc_61.sql
<Current directory>\update\sql\ecus_acc_55.sql
<Current directory>\update\sql\ecus_acc_46.sql
<Current directory>\update\sql\ecus_sql_31.sql
<Current directory>\update\sql\ecus_sql_35.sql
<Current directory>\update\sql\ecus_sql_57.sql
<Current directory>\update\sql\ecus_sql_58.sql
<Current directory>\update\sql\ecus_sql_59.sql
<Current directory>\update\sql\ecus_sql_60.sql
<Current directory>\update\sql\ecus_sql_61.sql
<Current directory>\update\sql\ecus_sql_62.sql
<Current directory>\update\sql\ecus_sql_63.sql
<Current directory>\update\sql\ecus_sql_53.sql
<Current directory>\update\sql\ecus_sql_64.sql
<Current directory>\update\sql\ecus_sql_66.sql
<Current directory>\update\sql\ecus_sql_67.sql
<Current directory>\update\sql\ecus_sql_68.sql
<Current directory>\update\sql\ecus_sql_69.sql
<Current directory>\update\sql\osql.exe
<Current directory>\ebh.exe
<Current directory>\ebh.exe.config
<Current directory>\update\sql\ecus_sql_55.sql
<Current directory>\update\sql\ecus_sql_56.sql
<Current directory>\update\sql\ecus_sql_54.sql
<Current directory>\update\sql\ecus_sql_52.sql
<Current directory>\update\sql\ecus_acc_13.sql
<Current directory>\update\sql\ecus_sql_36.sql
<Current directory>\update\sql\ecus_sql_37.sql
<Current directory>\update\sql\ecus_sql_38.sql
<Current directory>\update\sql\ecus_sql_39.sql
<Current directory>\update\sql\ecus_sql_40.sql
<Current directory>\update\sql\ecus_sql_41.sql
<Current directory>\update\sql\ecus_sql_32.sql
<Current directory>\update\sql\ecus_sql_34.sql
<Current directory>\update\sql\ecus_sql_33.sql
<Current directory>\update\sql\ecus_sql_42.sql
<Current directory>\update\sql\ecus_sql_46.sql
<Current directory>\update\sql\ecus_sql_47.sql
<Current directory>\update\sql\ecus_sql_48.sql
<Current directory>\update\sql\ecus_sql_49.sql
<Current directory>\update\sql\ecus_sql_50.sql
<Current directory>\update\sql\ecus_sql_51.sql
<Current directory>\update\sql\ecus_sql_43.sql
<Current directory>\update\sql\ecus_sql_44.sql
<Current directory>\update\sql\ecus_sql_45.sql
<Current directory>\update\sql\ecus_acc_43.sql
<Current directory>\update\sql\ecus_acc_42.sql
<Current directory>\update\sql\ecus_acc_41.sql
<Current directory>\bin\stdole.dll
<Current directory>\bin\taikhoanivan.dll
<Current directory>\bin\taikhoanivan.pdb
<Current directory>\bin\tsdlogcenterclass.dll
<Current directory>\bin\tsdlogcenterclass.dll.config
<Current directory>\bin\tsdlogcenterclass.pdb
<Current directory>\bin\tsdutil.dll
<Current directory>\bin\x86\sqlite.interop.dll
<Current directory>\bin\tsdutil.dll.config
<Current directory>\bin\tsdutil.xml
<Current directory>\bin\userskin.dll
<Current directory>\bin\vbideapi.dll
<Current directory>\bin\waitwindow.dll
<Current directory>\bin\wordapi.dll
<Current directory>\bin\x64\sqlite.interop.dll
<Current directory>\bin\newtonsoft.json.dll
<Current directory>\bin\microsoft.office.interop.access.dao.dll
<Current directory>\bin\officeapi.dll
<Current directory>\bin\interop.tbarcode5lib.dll
<Current directory>\bin\interop.adodb.dll
<Current directory>\ebhstart.exe.config
<Current directory>\ionic.zip.dll
<Current directory>\microsoft.office.interop.access.dao.dll
<Current directory>\tsdcompactaccessdb.exe
<Current directory>\tsdcompactaccessdb.pdb
<Current directory>\bin\devexpress.charts.v12.2.core.dll
<Current directory>\bin\devexpress.xtrabars.v12.2.dll
<Current directory>\bin\x64\vssver2.scc
<Current directory>\bin\devexpress.xtracharts.v12.2.dll
<Current directory>\bin\tsdutil.pdb
<Current directory>\bin\devexpress.xtracharts.v12.2.wizard.dll
<Current directory>\bin\envdte.dll
<Current directory>\bin\esignlibrary.dll
<Current directory>\bin\esignlibrary.pdb
<Current directory>\bin\excelapi.dll
<Current directory>\bin\gembox.document.dll
<Current directory>\bin\gembox.spreadsheet.dll
<Current directory>\bin\devexpress.xtracharts.v12.2.ui.dll
<Current directory>\ebhstart.pdb
<Current directory>\bin\downloadfilewithprocessbar.dll
<Current directory>\bin\office.dll
<Current directory>\bin\x86\vssver2.scc
<Current directory>\update\sql\ecus_acc_25.sql
<Current directory>\update\sql\ecus_acc_27.sql
<Current directory>\update\sql\ecus_acc_28.sql
<Current directory>\update\sql\ecus_acc_29.sql
<Current directory>\update\sql\ecus_acc_3.sql
<Current directory>\update\sql\ecus_acc_30.sql
<Current directory>\update\sql\ecus_acc_31.sql
<Current directory>\update\sql\ecus_acc_24.sql
<Current directory>\update\ebh_db.bak
<Current directory>\update\sql\ecus_acc_26.sql
<Current directory>\update\sql\ecus_acc_32.sql
<Current directory>\update\sql\ecus_acc_36.sql
<Current directory>\update\sql\ecus_acc_37.sql
<Current directory>\update\sql\ecus_acc_38.sql
<Current directory>\update\sql\ecus_acc_39.sql
<Current directory>\update\sql\ecus_acc_4.sql
<Current directory>\update\sql\ecus_acc_40.sql
<Current directory>\update\sql\ecus_acc_33.sql
<Current directory>\update\sql\ecus_acc_34.sql
<Current directory>\update\sql\ecus_acc_35.sql
<Current directory>\update\sql\ecus_sql_65.sql
<Current directory>\ebh.ico
<Current directory>\update\sql\ecus_acc_21.sql
<Current directory>\update\huongdankhoitaocsdl.doc
<Current directory>\update\huongdanlap_01b-hsb.doc
<Current directory>\update\huongdanlap_c70a-hd.doc
<Current directory>\update\huong_dan_ma_so_bhxh.doc
<Current directory>\update\huong_dan_ma_so_bhxh_hssv.doc
<Current directory>\update\sql\ecus_acc_10.sql
<Current directory>\update\sql\ecus_acc_11.sql
<Current directory>\update\sql\ecus_acc_22.sql
<Current directory>\update\sql\ecus_acc_23.sql
<Current directory>\update\sql\ecus_acc_12.sql
<Current directory>\update\sql\ecus_acc_15.sql
<Current directory>\update\sql\ecus_acc_16.sql
<Current directory>\update\sql\ecus_acc_17.sql
<Current directory>\update\sql\ecus_acc_18.sql
<Current directory>\update\sql\ecus_acc_19.sql
<Current directory>\update\sql\ecus_acc_2.sql
<Current directory>\update\sql\ecus_acc_20.sql
<Current directory>\update\huongdancaidatsql.doc
<Current directory>\update\sql\ecus_acc_14.sql
<Current directory>\ebh.pdb

Sets the 'hidden' attribute to the following files

<Current directory>\bin\x64\vssver2.scc
<Current directory>\bin\x86\vssver2.scc

Network activity

Connects to

'ce######ates.godaddy.com':80
'cr#.#odaddy.com':80

UDP

DNS ASK ce######ates.godaddy.com
DNS ASK cr#.#odaddy.com

Miscellaneous

Searches for the following windows

ClassName: 'EDIT' WindowName: ''
ClassName: '' WindowName: ''

Creates and executes the following

'<Current directory>\ebh.exe'

Executes the following

'%WINDIR%\microsoft.net\framework\v2.0.50727\dw20.exe' -x -s 672

Technologies

Begriffe

Schulung und Training

Mythen

Technical Information

Curing recommendations

Free trial