Trojan.DownLoader26.13954

Technical Information

To ensure autorun and distribution:

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\HideIPLaucherService] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\HideIPLaucherService] 'ImagePath' = '%ProgramFiles%\Hide ALL IP\LauncherService.exe'

Malicious functions:

Executes the following:

'<SYSTEM32>\net.exe' stop HideIPLaucherService

Modifies file system:

Creates the following files:

%ProgramFiles%\Hide ALL IP\is-980QL.tmp
%ProgramFiles%\Hide ALL IP\is-C0CDU.tmp
%ProgramFiles%\Hide ALL IP\is-95GEK.tmp
%ProgramFiles%\Hide ALL IP\is-ORLME.tmp
%ProgramFiles%\Hide ALL IP\is-S9IKQ.tmp
%ProgramFiles%\Hide ALL IP\is-8151C.tmp
%ProgramFiles%\Hide ALL IP\is-SH0UE.tmp
%ProgramFiles%\Hide ALL IP\is-QH0M6.tmp
%ALLUSERSPROFILE%\Desktop\Hide ALL IP.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Hide ALL IP\Uninstall Hide ALL IP.lnk
%ProgramFiles%\Hide ALL IP\unins000.dat
%ProgramFiles%\Hide ALL IP\unins000.msg
%ProgramFiles%\Hide ALL IP\is-G17SQ.tmp
%ProgramFiles%\Hide ALL IP\is-PHQ9P.tmp
%ALLUSERSPROFILE%\Start Menu\Programs\Hide ALL IP\Hide ALL IP.lnk
%ProgramFiles%\Hide ALL IP\is-IR1KA.tmp
%TEMP%\is-F08PN.tmp\_isetup\_shfoldr.dll
%TEMP%\is-7K57H.tmp\~bkdcejz.tmp
%ProgramFiles%\Hide ALL IP\is-NCPVL.tmp
%ProgramFiles%\Hide ALL IP\is-U0K5R.tmp
%TEMP%\kinzhsg
%TEMP%\aut1.tmp
%TEMP%\~bkdcejz.tmp
%TEMP%\aut2.tmp
%ProgramFiles%\Hide ALL IP\is-IH5IH.tmp
%ProgramFiles%\Hide ALL IP\is-TOAIA.tmp
%ProgramFiles%\Hide ALL IP\is-TG67O.tmp
%ProgramFiles%\Hide ALL IP\is-A2JNS.tmp
%ProgramFiles%\Hide ALL IP\is-FAEF3.tmp
%ProgramFiles%\Hide ALL IP\is-S2VJ1.tmp
%ProgramFiles%\Hide ALL IP\is-H6PJN.tmp
%ProgramFiles%\Hide ALL IP\is-SDV3L.tmp

Sets the 'hidden' attribute to the following files:

%TEMP%\~bkdcejz.tmp

Deletes the following files:

%TEMP%\aut2.tmp
%TEMP%\kinzhsg
%TEMP%\aut1.tmp

Moves the following files:

from %ProgramFiles%\Hide ALL IP\is-C0CDU.tmp to %ProgramFiles%\Hide ALL IP\networkdllx64.dll
from %ProgramFiles%\Hide ALL IP\is-980QL.tmp to %ProgramFiles%\Hide ALL IP\bigflags.dat
from %ProgramFiles%\Hide ALL IP\is-SH0UE.tmp to %ProgramFiles%\Hide ALL IP\sntutils.dll
from %ProgramFiles%\Hide ALL IP\is-S9IKQ.tmp to %ProgramFiles%\Hide ALL IP\sntx64tool.dll
from %ProgramFiles%\Hide ALL IP\is-QH0M6.tmp to %ProgramFiles%\Hide ALL IP\networkdllx64_L.dll
from %ProgramFiles%\Hide ALL IP\is-G17SQ.tmp to %ProgramFiles%\Hide ALL IP\AutoUpgrade.exe
from %ProgramFiles%\Hide ALL IP\is-IR1KA.tmp to %ProgramFiles%\Hide ALL IP\hideallip.buildnum
from %ProgramFiles%\Hide ALL IP\is-PHQ9P.tmp to %ProgramFiles%\Hide ALL IP\cookieintf.dll
from %ProgramFiles%\Hide ALL IP\is-ORLME.tmp to %ProgramFiles%\Hide ALL IP\ipdb.dat
from %ProgramFiles%\Hide ALL IP\is-95GEK.tmp to %ProgramFiles%\Hide ALL IP\networktunnelx64helper.exe
from %ProgramFiles%\Hide ALL IP\is-8151C.tmp to %ProgramFiles%\Hide ALL IP\networkdll.dll
from %ProgramFiles%\Hide ALL IP\is-FAEF3.tmp to %ProgramFiles%\Hide ALL IP\libeay32.dll
from %ProgramFiles%\Hide ALL IP\is-SDV3L.tmp to %ProgramFiles%\Hide ALL IP\hideallip.dat
from %ProgramFiles%\Hide ALL IP\is-S2VJ1.tmp to %ProgramFiles%\Hide ALL IP\ssleay32.dll
from %ProgramFiles%\Hide ALL IP\is-U0K5R.tmp to %ProgramFiles%\Hide ALL IP\unins000.exe
from %ProgramFiles%\Hide ALL IP\is-NCPVL.tmp to %ProgramFiles%\Hide ALL IP\networkdll_L.dll
from %ProgramFiles%\Hide ALL IP\is-A2JNS.tmp to %ProgramFiles%\Hide ALL IP\networktunnelx64.sys
from %ProgramFiles%\Hide ALL IP\is-TG67O.tmp to %ProgramFiles%\Hide ALL IP\networkdlllsp.dll
from %ProgramFiles%\Hide ALL IP\is-IH5IH.tmp to %ProgramFiles%\Hide ALL IP\networktunneldrv.zap
from %ProgramFiles%\Hide ALL IP\is-H6PJN.tmp to %ProgramFiles%\Hide ALL IP\HideAllIP.exe
from %ProgramFiles%\Hide ALL IP\is-TOAIA.tmp to %ProgramFiles%\Hide ALL IP\LauncherService.exe

Miscellaneous:

Searches for the following windows:

ClassName: 'MS_WINHELP' WindowName: ''

Creates and executes the following:

'%ProgramFiles%\Hide ALL IP\LauncherService.exe' start nolaunchanyfile.txt
'%ProgramFiles%\Hide ALL IP\LauncherService.exe'
'%TEMP%\~bkdcejz.tmp' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
'%TEMP%\is-7K57H.tmp\~bkdcejz.tmp' /SL5="$100E2,4408957,56832,%TEMP%\~bkdcejz.tmp" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-

Executes the following: