Trojan.DownLoader44.50675

To ensure autorun and distribution

Creates or modifies the following files

Creates the following files on removable media

Malicious functions

Reads files which store third party applications passwords

Modifies file system

Creates the following files

Deletes the following files

Moves the following files

from C:\rcx43b6.tmp to %HOMEPATH%\desktop\adhd_and_obesity.exe
from C:\rcx4414.tmp to %HOMEPATH%\desktop\adhd_and_obesity.exe
from %HOMEPATH%\desktop\adhd_and_obesity.exe to %HOMEPATH%\desktop\adhd_and_obesity-dav‮xcod.scr
from C:\rcx457e.tmp to %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.exe
from C:\rcx45dd.tmp to %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.exe
from %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.exe to %HOMEPATH%\desktop\aoc_saq_d_v3_merchant-qvv‮xcod.scr
from C:\rcx4aa0.tmp to %HOMEPATH%\desktop\glidescope_review_rev_010.exe
from C:\rcx4b4d.tmp to %HOMEPATH%\desktop\glidescope_review_rev_010.exe
from %HOMEPATH%\desktop\glidescope_review_rev_010.exe to %HOMEPATH%\desktop\glidescope_review_rev_010-rku‮xcod.scr
from C:\rcx505f.tmp to %HOMEPATH%\desktop\issi2013_template_for_posters.exe
from C:\rcx512b.tmp to %HOMEPATH%\desktop\issi2013_template_for_posters.exe
from %HOMEPATH%\desktop\issi2013_template_for_posters.exe to %HOMEPATH%\desktop\issi2013_template_for_posters-bhf‮xcod.scr
from C:\rcx54d6.tmp to %HOMEPATH%\desktop\thlps_keeper_mayer_1965.exe
from C:\rcx55c1.tmp to %HOMEPATH%\desktop\thlps_keeper_mayer_1965.exe
from %HOMEPATH%\desktop\thlps_keeper_mayer_1965.exe to %HOMEPATH%\desktop\thlps_keeper_mayer_1965-vwd‮xcod.scr

Substitutes the following files

Network activity

Connects to

TCP

HTTP GET requests

UDP

Miscellaneous

Creates and executes the following

'%TEMP%\aoc_saq_d_v3_merchant.exe'
'%LOCALAPPDATA%\servicehub\aoc_saq_d_v3_merchant.exe'
'%TEMP%\c.exe'
'%LOCALAPPDATA%\servicehub\c.exe'
'%WINDIR%\syswow64\cmd.exe' /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "aoc_saq_d_v3_merchant" /sc MINUTE /tr "%LOCALAPPDATA%\ServiceHub\aoc_saq_d_v3_merchant.exe" /rl HIGHEST /f && DEL /F /S /Q /A "%TEMP%\ao...' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "c" /sc MINUTE /tr "%LOCALAPPDATA%\ServiceHub\c.exe" /rl HIGHEST /f && DEL /F /S /Q /A "%TEMP%\c.exe" &&START "" "%LOCALAPPDATA%\ServiceH...' (with hidden window)
'%LOCALAPPDATA%\servicehub\c.exe' ' (with hidden window)
'%LOCALAPPDATA%\servicehub\aoc_saq_d_v3_merchant.exe' ' (with hidden window)

Executes the following

'%ProgramFiles%\microsoft office\office14\winword.exe' /n "%TEMP%\aoc_saq_d_v3_merchant.docx"
'%WINDIR%\syswow64\cmd.exe' /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "aoc_saq_d_v3_merchant" /sc MINUTE /tr "%LOCALAPPDATA%\ServiceHub\aoc_saq_d_v3_merchant.exe" /rl HIGHEST /f && DEL /F /S /Q /A "%TEMP%\ao...
'%WINDIR%\syswow64\chcp.com' 65001
'%WINDIR%\syswow64\ping.exe' 127.0.0.1
'%WINDIR%\syswow64\schtasks.exe' /create /tn "aoc_saq_d_v3_merchant" /sc MINUTE /tr "%LOCALAPPDATA%\ServiceHub\aoc_saq_d_v3_merchant.exe" /rl HIGHEST /f
'%WINDIR%\syswow64\cmd.exe' /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "c" /sc MINUTE /tr "%LOCALAPPDATA%\ServiceHub\c.exe" /rl HIGHEST /f && DEL /F /S /Q /A "%TEMP%\c.exe" &&START "" "%LOCALAPPDATA%\ServiceH...
'%WINDIR%\syswow64\schtasks.exe' /create /tn "c" /sc MINUTE /tr "%LOCALAPPDATA%\ServiceHub\c.exe" /rl HIGHEST /f
'<SYSTEM32>\taskeng.exe' {9BF6C3CC-5953-4080-847B-1D8B5A25C8B6} S-1-5-21-1960123792-2022915161-3775307078-1001:pdlriwig\user:Interactive:[1]