Trojan.Inject6.10166

Technical Information

Modifies file system

Creates the following files

%TEMP%\costura\87562190b7e4a64d3f2a845279ef2bdc\costura.dll
%TEMP%\costura\87562190b7e4a64d3f2a845279ef2bdc\microsoft.bcl.asyncinterfaces.dll
%TEMP%\costura\87562190b7e4a64d3f2a845279ef2bdc\microsoft.diagnostics.fastserialization.dll
%TEMP%\costura\87562190b7e4a64d3f2a845279ef2bdc\microsoft.diagnostics.netcore.client.dll
%TEMP%\costura\87562190b7e4a64d3f2a845279ef2bdc\microsoft.diagnostics.tracing.traceevent.dll
%TEMP%\costura\87562190b7e4a64d3f2a845279ef2bdc\microsoft.extensions.dependencyinjection.abstractions.dll
%TEMP%\costura\87562190b7e4a64d3f2a845279ef2bdc\microsoft.extensions.dependencyinjection.dll
%TEMP%\costura\87562190b7e4a64d3f2a845279ef2bdc\microsoft.extensions.logging.abstractions.dll
%TEMP%\costura\87562190b7e4a64d3f2a845279ef2bdc\microsoft.extensions.logging.dll
%TEMP%\costura\87562190b7e4a64d3f2a845279ef2bdc\microsoft.extensions.options.dll
%TEMP%\costura\87562190b7e4a64d3f2a845279ef2bdc\microsoft.extensions.primitives.dll
%TEMP%\costura\87562190b7e4a64d3f2a845279ef2bdc\microsoft.win32.registry.dll
%TEMP%\costura\87562190b7e4a64d3f2a845279ef2bdc\mysqlconnector.dll
%TEMP%\costura\87562190b7e4a64d3f2a845279ef2bdc\newtonsoft.json.dll
%TEMP%\costura\87562190b7e4a64d3f2a845279ef2bdc\system.buffers.dll
%TEMP%\costura\87562190b7e4a64d3f2a845279ef2bdc\system.collections.immutable.dll
%TEMP%\costura\87562190b7e4a64d3f2a845279ef2bdc\system.diagnostics.diagnosticsource.dll
%TEMP%\costura\87562190b7e4a64d3f2a845279ef2bdc\system.drawing.common.dll
%TEMP%\costura\87562190b7e4a64d3f2a845279ef2bdc\system.io.pipelines.dll
%TEMP%\costura\87562190b7e4a64d3f2a845279ef2bdc\system.memory.dll
%TEMP%\costura\87562190b7e4a64d3f2a845279ef2bdc\system.numerics.vectors.dll
%TEMP%\costura\87562190b7e4a64d3f2a845279ef2bdc\system.reflection.metadata.dll
%TEMP%\costura\87562190b7e4a64d3f2a845279ef2bdc\system.reflection.typeextensions.dll
%TEMP%\costura\87562190b7e4a64d3f2a845279ef2bdc\system.runtime.compilerservices.unsafe.dll
%TEMP%\costura\87562190b7e4a64d3f2a845279ef2bdc\system.security.accesscontrol.dll
%TEMP%\costura\87562190b7e4a64d3f2a845279ef2bdc\system.security.principal.windows.dll
%TEMP%\costura\87562190b7e4a64d3f2a845279ef2bdc\system.text.encodings.web.dll
%TEMP%\costura\87562190b7e4a64d3f2a845279ef2bdc\system.text.json.dll
%TEMP%\costura\87562190b7e4a64d3f2a845279ef2bdc\system.threading.tasks.extensions.dll
%TEMP%\costura\87562190b7e4a64d3f2a845279ef2bdc\system.valuetuple.dll
%TEMP%\costura\87562190b7e4a64d3f2a845279ef2bdc\tesseract.dll
%TEMP%\talesrunnercursor_35d1b693b617494b99e21808abcbd194.cur
<Current directory>\yzfpmcwddvd.exe
%ALLUSERSPROFILE%\aloneaior\flags\989a32bdcd68640ac28bc6ea0eaafcc8d84bbdaee12d6492302c9451c10afa3e.flag
%TEMP%\alonedbcert_cached_2676.pem
%TEMP%\tmp825.tmp
%TEMP%\tmp826.tmp
%TEMP%\tmp856.tmp
%TEMP%\tmp855.tmp
%LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\<File name>.exe.log
%LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\yzfpmcwddvd.exe.log
%TEMP%\talesrunnercursor_3173a8a62ace4561aaba3ad50757a441.cur
%TEMP%\alonedbcert_cached_3012.pem
%TEMP%\tmp59b0.tmp
%TEMP%\tmp59b1.tmp
%TEMP%\tmp5a01.tmp
%TEMP%\tmp5a00.tmp
<Current directory>\alone.ini

Sets the 'hidden' attribute to the following files

%ALLUSERSPROFILE%\aloneaior\flags\989a32bdcd68640ac28bc6ea0eaafcc8d84bbdaee12d6492302c9451c10afa3e.flag

Deletes following files that it created itself

%TEMP%\tmp825.tmp
%TEMP%\tmp826.tmp
%TEMP%\tmp856.tmp
%TEMP%\tmp855.tmp
%TEMP%\tmp59b0.tmp
%TEMP%\tmp59b1.tmp
%TEMP%\tmp5a00.tmp
%TEMP%\tmp5a01.tmp

Deletes itself.

Network activity

Connects to

'ai########ior1337.i.aivencloud.com':23697
'ra#.####ubusercontent.com':443

TCP

Other

'ai########ior1337.i.aivencloud.com':23697
'ra#.####ubusercontent.com':443

UDP

DNS ASK ai########ior1337.i.aivencloud.com
DNS ASK ra#.####ubusercontent.com

Miscellaneous

Creates and executes the following

'<Current directory>\yzfpmcwddvd.exe' --updater --mode New --old "<Full path to file>" --new "<Current directory>\yzfpmcwddvd.exe" --args "--patched" --ppid 2676
'<Current directory>\yzfpmcwddvd.exe' --patched