Trojan.DownLoader26.54305

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%WINDIR%\Tasks\ZB20DCImbe4Yvtz.job

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\EBC8360psDNVz] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\EBC8360psDNVz] 'ImagePath' = '<Current directory>\EBC8360psDN.exe .PleaseDoNotReportMe'

Malicious functions:

Executes the following:

'<SYSTEM32>\net.exe' stop sqlbrowsers
'<SYSTEM32>\net.exe' stop WinRDPSvc
'<SYSTEM32>\net.exe' stop RpcEptManger
'<SYSTEM32>\net.exe' stop Samserver
'<SYSTEM32>\net.exe' stop eccm
'<SYSTEM32>\net.exe' stop WSService
'<SYSTEM32>\net.exe' stop Googler
'<SYSTEM32>\net.exe' stop MsUpdateServiceD
'<SYSTEM32>\net.exe' stop TaskNetHost
'<SYSTEM32>\net.exe' stop reg
'<SYSTEM32>\net.exe' stop Service4
'<SYSTEM32>\net.exe' stop sqlservrd
'<SYSTEM32>\net.exe' stop LocalConnectXdc
'<SYSTEM32>\net.exe' stop WindowsDefender
'<SYSTEM32>\net.exe' stop AdobeFlashPlayerHash
'<SYSTEM32>\net.exe' stop RegGroom
'<SYSTEM32>\net.exe' stop LanmanServersetes

Injects code into

the following system processes:

%WINDIR%\XXInstall\ps.exe

Modifies file system:

Creates the following files:

<Current directory>\EBC8360psDN.exe

Sets the 'hidden' attribute to the following files:

<Current directory>\EBC8360psDN.exe

Deletes the following files:

<Full path to file>

Network activity:

Connects to:

'21#.#3.190.122':888
'po##.#upportxmr.com':3333
'po##.#upportxmr.com':5555
'po##.#upportxmr.com':80
'po##.#upportxmr.com':8080
'21#.#32.25.156':3333
'21#.#32.25.156':5555
'21#.#32.25.156':80
'21#.#32.25.156':8080

UDP:

DNS ASK po##.#upportxmr.com

Miscellaneous:

Creates and executes the following:

'<Current directory>\EBC8360psDN.exe' .PleaseDoNotReportMe

Executes the following:

'<SYSTEM32>\cmd.exe' /c <SYSTEM32>\schtasks.exe /Delete /TN * /F >nul 2>&1
'<SYSTEM32>\net1.exe' stop RpcEptManger
'<SYSTEM32>\cmd.exe' /c net stop RpcEptManger
'<SYSTEM32>\cmd.exe' /c %comspec% /c net stop RpcEptManger >nul 2>&1
'<SYSTEM32>\sc.exe' config Samserver start= Disabled
'<SYSTEM32>\cmd.exe' /c sc config Samserver start= Disabled
'<SYSTEM32>\cmd.exe' /c %comspec% /c sc config Samserver start= Disabled >nul 2>&1
'<SYSTEM32>\net1.exe' stop Samserver
'<SYSTEM32>\cmd.exe' /c net stop Samserver
'<SYSTEM32>\cmd.exe' /c %comspec% /c net stop Samserver >nul 2>&1
'<SYSTEM32>\sc.exe' config eccm start= Disabled
'<SYSTEM32>\cmd.exe' /c sc config eccm start= Disabled
'<SYSTEM32>\cmd.exe' /c %comspec% /c sc config eccm start= Disabled >nul 2>&1
'<SYSTEM32>\net1.exe' stop eccm
'<SYSTEM32>\cmd.exe' /c %comspec% /c sc config TaskNetHost start= Disabled >nul 2>&1
'<SYSTEM32>\cmd.exe' /c net stop eccm
'<SYSTEM32>\sc.exe' config WSService start= Disabled
'<SYSTEM32>\cmd.exe' /c sc config WSService start= Disabled
'<SYSTEM32>\cmd.exe' /c %comspec% /c sc config WSService start= Disabled >nul 2>&1
'<SYSTEM32>\net1.exe' stop WSService
'<SYSTEM32>\cmd.exe' /c net stop WSService
'<SYSTEM32>\cmd.exe' /c %comspec% /c net stop WSService >nul 2>&1
'<SYSTEM32>\sc.exe' config Googler start= Disabled
'<SYSTEM32>\cmd.exe' /c sc config Googler start= Disabled
'<SYSTEM32>\cmd.exe' /c %comspec% /c sc config Googler start= Disabled >nul 2>&1
'<SYSTEM32>\net1.exe' stop Googler
'<SYSTEM32>\cmd.exe' /c net stop Googler
'<SYSTEM32>\cmd.exe' /c %comspec% /c net stop Googler >nul 2>&1
'<SYSTEM32>\sc.exe' config TaskNetHost start= Disabled
'<SYSTEM32>\cmd.exe' /c %comspec% /c net stop eccm >nul 2>&1
'<SYSTEM32>\cmd.exe' /c sc config TaskNetHost start= Disabled
'<SYSTEM32>\cmd.exe' /c %comspec% /c sc config RpcEptManger start= Disabled >nul 2>&1
'<SYSTEM32>\cmd.exe' /c sc config WinDefend start= disabled
'<SYSTEM32>\cmd.exe' /c %comspec% /c sc config WMIUpdateService start= Disabled >nul 2>&1
'<SYSTEM32>\net1.exe' stop WMIUpdateService
'%WINDIR%\XXInstall\ps.exe' stop WMIUpdateService
'<SYSTEM32>\cmd.exe' /c net stop WMIUpdateService
'<SYSTEM32>\sc.exe' config LanmanServersetes start= Disabled
'<SYSTEM32>\cmd.exe' /c sc config LanmanServersetes start= Disabled
'<SYSTEM32>\cmd.exe' /c %comspec% /c sc config LanmanServersetes start= Disabled >nul 2>&1
'<SYSTEM32>\net1.exe' stop LanmanServersetes
'<SYSTEM32>\cmd.exe' /c net stop LanmanServersetes
'<SYSTEM32>\cmd.exe' /c %comspec% /c net stop LanmanServersetes >nul 2>&1
'<SYSTEM32>\sc.exe' stop WinDefend
'<SYSTEM32>\cmd.exe' /c sc stop WinDefend
'<SYSTEM32>\cmd.exe' /c %comspec% /c sc stop WinDefend >nul 2>&1
'<SYSTEM32>\sc.exe' config RpcEptManger start= Disabled
'<SYSTEM32>\cmd.exe' /c sc config RpcEptManger start= Disabled
'<SYSTEM32>\cmd.exe' /c %comspec% /c sc config WinDefend start= disabled >nul 2>&1
'<SYSTEM32>\sc.exe' config MsUpdateServiceD start= Disabled
'<SYSTEM32>\cmd.exe' /c sc config MsUpdateServiceD start= Disabled
'<SYSTEM32>\cmd.exe' /c %comspec% /c sc config MsUpdateServiceD start= Disabled >nul 2>&1
'<SYSTEM32>\net1.exe' stop MsUpdateServiceD
'<SYSTEM32>\cmd.exe' /c net stop MsUpdateServiceD
'<SYSTEM32>\cmd.exe' /c %comspec% /c net stop MsUpdateServiceD >nul 2>&1
'<SYSTEM32>\sc.exe' config WinRDPSvc start= Disabled
'<SYSTEM32>\cmd.exe' /c sc config WinRDPSvc start= Disabled
'<SYSTEM32>\cmd.exe' /c %comspec% /c sc config WinRDPSvc start= Disabled >nul 2>&1
'<SYSTEM32>\net1.exe' stop WinRDPSvc
'<SYSTEM32>\cmd.exe' /c net stop WinRDPSvc
'<SYSTEM32>\cmd.exe' /c %comspec% /c net stop WinRDPSvc >nul 2>&1
'<SYSTEM32>\sc.exe' config WinDefend start= disabled
'<SYSTEM32>\net1.exe' stop TaskNetHost
'<SYSTEM32>\cmd.exe' /c net stop TaskNetHost
'<SYSTEM32>\cmd.exe' /c %comspec% /c net stop TaskNetHost >nul 2>&1
'<SYSTEM32>\cmd.exe' /c sc config WindowsDefender start= Disabled
'<SYSTEM32>\cmd.exe' /c %comspec% /c sc config WindowsDefender start= Disabled >nul 2>&1
'<SYSTEM32>\net1.exe' stop WindowsDefender
'<SYSTEM32>\cmd.exe' /c net stop WindowsDefender
'<SYSTEM32>\cmd.exe' /c %comspec% /c net stop WindowsDefender >nul 2>&1
'<SYSTEM32>\sc.exe' config AdobeFlashPlayerHash start= Disabled
'<SYSTEM32>\cmd.exe' /c sc config AdobeFlashPlayerHash start= Disabled
'<SYSTEM32>\cmd.exe' /c %comspec% /c sc config AdobeFlashPlayerHash start= Disabled >nul 2>&1
'<SYSTEM32>\net1.exe' stop AdobeFlashPlayerHash
'<SYSTEM32>\cmd.exe' /c net stop AdobeFlashPlayerHash
'<SYSTEM32>\cmd.exe' /c %comspec% /c net stop AdobeFlashPlayerHash >nul 2>&1
'<SYSTEM32>\sc.exe' delete sqlbrowsers
'<SYSTEM32>\cmd.exe' /c %comspec% /c net stop LocalConnectXdc >nul 2>&1
'<SYSTEM32>\cmd.exe' /c sc delete sqlbrowsers
'<SYSTEM32>\sc.exe' config sqlbrowsers start= Disabled
'<SYSTEM32>\cmd.exe' /c sc config sqlbrowsers start= Disabled
'<SYSTEM32>\schtasks.exe' /Create /tn ZB20DCImbe4Yvtz /tr "<Current directory>\EBC8360psDN.exe" /sc HOURLY /mo 3 /st 00:00:00 /ru SYSTEM
'<SYSTEM32>\cmd.exe' /c %comspec% /c sc config sqlbrowsers start= Disabled >nul 2>&1
'<SYSTEM32>\cmd.exe' /c <SYSTEM32>\schtasks.exe /Create /tn ZB20DCImbe4Yvtz /tr "<Current directory>\EBC8360psDN.exe" /sc HOURLY /mo 3 /st 00:00:00 /ru SYSTEM >nul 2>&1
'<SYSTEM32>\cmd.exe' /c echo Y
'<SYSTEM32>\net1.exe' stop sqlbrowsers
'<SYSTEM32>\schtasks.exe' /Delete /TN *
'<SYSTEM32>\cmd.exe' /c start /b /min <SYSTEM32>\cmd.exe /c echo Y
'<SYSTEM32>\cmd.exe' /c %comspec% /c start /b /min %comspec% /c echo Y|<SYSTEM32>\schtasks.exe /Delete /TN * >nul 2>&1
'<SYSTEM32>\cmd.exe' /c net stop sqlbrowsers
'<SYSTEM32>\schtasks.exe' /Delete /TN * /F
'<SYSTEM32>\cmd.exe' /c %comspec% /c net stop sqlbrowsers >nul 2>&1
'<SYSTEM32>\cmd.exe' /c %comspec% /c sc delete sqlbrowsers >nul 2>&1
'<SYSTEM32>\cmd.exe' /c net stop LocalConnectXdc
'<SYSTEM32>\sc.exe' config WindowsDefender start= Disabled
'<SYSTEM32>\net1.exe' stop LocalConnectXdc
'<SYSTEM32>\sc.exe' config RegGroom start= Disabled
'<SYSTEM32>\cmd.exe' /c %comspec% /c sc config Service4 start= Disabled >nul 2>&1
'<SYSTEM32>\cmd.exe' /c sc config RegGroom start= Disabled
'<SYSTEM32>\cmd.exe' /c %comspec% /c sc config RegGroom start= Disabled >nul 2>&1
'<SYSTEM32>\net1.exe' stop RegGroom
'<SYSTEM32>\cmd.exe' /c net stop RegGroom
'<SYSTEM32>\cmd.exe' /c %comspec% /c net stop RegGroom >nul 2>&1
'<SYSTEM32>\sc.exe' config reg start= Disabled
'<SYSTEM32>\cmd.exe' /c sc config reg start= Disabled
'<SYSTEM32>\cmd.exe' /c %comspec% /c sc config reg start= Disabled >nul 2>&1
'<SYSTEM32>\net1.exe' stop reg
'<SYSTEM32>\cmd.exe' /c net stop reg
'<SYSTEM32>\cmd.exe' /c %comspec% /c net stop reg >nul 2>&1
'<SYSTEM32>\sc.exe' config Service4 start= Disabled
'<SYSTEM32>\cmd.exe' /c sc config Service4 start= Disabled
'<SYSTEM32>\net1.exe' stop Service4
'<SYSTEM32>\cmd.exe' /c %comspec% /c sc config LocalConnectXdc start= Disabled >nul 2>&1
'<SYSTEM32>\cmd.exe' /c net stop Service4
'<SYSTEM32>\cmd.exe' /c %comspec% /c net stop Service4 >nul 2>&1
'<SYSTEM32>\sc.exe' delete sqlservrd
'<SYSTEM32>\cmd.exe' /c sc delete sqlservrd
'<SYSTEM32>\cmd.exe' /c %comspec% /c sc delete sqlservrd >nul 2>&1
'<SYSTEM32>\sc.exe' config sqlservrd start= Disabled
'<SYSTEM32>\cmd.exe' /c sc config sqlservrd start= Disabled
'<SYSTEM32>\cmd.exe' /c %comspec% /c sc config sqlservrd start= Disabled >nul 2>&1
'<SYSTEM32>\net1.exe' stop sqlservrd
'<SYSTEM32>\cmd.exe' /c net stop sqlservrd
'<SYSTEM32>\cmd.exe' /c %comspec% /c net stop sqlservrd >nul 2>&1
'<SYSTEM32>\sc.exe' config LocalConnectXdc start= Disabled
'<SYSTEM32>\cmd.exe' /c sc config LocalConnectXdc start= Disabled
'<SYSTEM32>\cmd.exe' /c sc config WMIUpdateService start= Disabled
'<SYSTEM32>\sc.exe' config WMIUpdateService start= Disabled

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations

Free trial