Trojan.DownLoader11.44602

Technical Information

Malicious functions:

Creates and executes the following:

'<Current directory>\Data\MailWasher by FC Portables\local\stubexe\0x3FE7B2C665B452AB\ContactImporter.exe' Qmx1ZSBMYWdvb24xMS8xOC8yMDE0IDM6MjI6MDAgUE0=
'<Current directory>\Data\MailWasher by FC Portables\local\stubexe\0xBE9C5301DEA3D5EF\AccountImporter.exe' Qmx1ZSBMYWdvb24xMS8xOC8yMDE0IDM6MjE6MDAgUE0=
'<Current directory>\Data\MailWasher by FC Portables\local\stubexe\0x83133FBFB02ACF12\MailWasherPro.exe'

Executes the following:

'<SYSTEM32>\wbem\wmiadap.exe' /R /T

Modifies file system :

Creates the following files:

<Current directory>\Data\MailWasher by FC Portables\roaming\meta\@APPDATA@\Firetrust\MailWasher\regex.txt.__meta__.__tmp__
%TEMP%\tmp2.tmp
<Current directory>\Data\MailWasher by FC Portables\roaming\meta\@APPDATA@\Firetrust\MailWasher\BayesianSettings.xml.__meta__.__tmp__
<Current directory>\Data\MailWasher by FC Portables\roaming\modified\@APPDATA@\Firetrust\MailWasher\regex.txt
<Current directory>\Data\MailWasher by FC Portables\roaming\meta\@APPDATA@\Firetrust\MailWasher\Setting.Xml.__meta__.__tmp__
<Current directory>\Data\MailWasher by FC Portables\roaming\modified\@APPDATA@\Firetrust\MailWasher\RBLknobs.Xml
%TEMP%\tmp1.tmp
<Current directory>\Data\MailWasher by FC Portables\roaming\modified\@APPDATA@\Firetrust\MailWasher\Setting.Xml
<Current directory>\Data\MailWasher by FC Portables\roaming\meta\@PROGRAMFILESX86@\Firetrust\MailWasher.__meta__.__tmp__
<Current directory>\Data\MailWasher by FC Portables\local\meta\@PROGRAMFILESX86@\Firetrust\MailWasher\MCore.dll.__meta__.__tmp__
<Current directory>\Data\MailWasher by FC Portables\roaming\modified\@APPDATA@\Firetrust\MailWasher\contactsAB.txt
<Current directory>\Data\MailWasher by FC Portables\roaming\meta\@PROGRAMFILESX86@\Firetrust.__meta__.__tmp__
<Current directory>\Data\MailWasher by FC Portables\local\meta\@PROGRAMFILESX86@\Firetrust\MailWasher\accexp.dll.__meta__.__tmp__
<Current directory>\Data\MailWasher by FC Portables\roaming\modified\@APPDATA@\Firetrust\MailWasher\BayesianSettings.xml
<Current directory>\Data\MailWasher by FC Portables\local\meta\@PROGRAMFILESX86@\Firetrust\MailWasher\ContactsLib.dll.__meta__.__tmp__
<Current directory>\Data\MailWasher by FC Portables\roaming\modified\@APPDATA@\Firetrust\MailWasher\accounts.txt
<Current directory>\Data\MailWasher by FC Portables\roaming\modified\@APPDATA@\Firetrust\MailWasher\mwpstart.dat
<Current directory>\Data\MailWasher by FC Portables\roaming\modified\@APPDATA@\Firetrust\MailWasher\logs\logs_11-18-2014\MWPapi.log
<Current directory>\Data\MailWasher by FC Portables\roaming\modified\@APPDATA@\Firetrust\MailWasher\logs\logs_11-18-2014\MWPapp_MWPapp.log
<Current directory>\Data\MailWasher by FC Portables\roaming\meta\@APPDATA@\Firetrust\MailWasher\logs\logs_11-18-2014\MWPapp_MWPapp.log.__meta__.__tmp__
<Current directory>\Data\MailWasher by FC Portables\xsandbox.bin.__tmp__
<Current directory>\Data\MailWasher by FC Portables\roaming\meta\@APPDATA@\Firetrust\MailWasher\logs\logs_11-18-2014\MWPapi.log.__meta__.__tmp__
<Current directory>\Data\MailWasher by FC Portables\roaming\meta\@PROGRAMFILESX86@\Firetrust\MailWasher\MailWasherPro.exe.__meta__.__tmp__
<Current directory>\Data\MailWasher by FC Portables\roaming\meta\@APPDATA@\Firetrust\MailWasher\logs\logs_11-18-2014\MWPapp_FirstAlert.log.__meta__.__tmp__
<Current directory>\Data\MailWasher by FC Portables\roaming\modified\@APPDATA@\Firetrust\MailWasher\FirstAlertKnobs.Xml
<Current directory>\Data\MailWasher by FC Portables\roaming\meta\@APPDATA@\Firetrust\MailWasher\RBLknobs.Xml.__meta__.__tmp__
<Current directory>\Data\MailWasher by FC Portables\roaming\modified\@APPDATA@\Firetrust\MailWasher\logs\logs_11-18-2014\MWPapp_FirstAlert.log
<Current directory>\Data\MailWasher by FC Portables\roaming\meta\@APPDATA@\Firetrust\MailWasher\BayesianKnobs.Xml.__meta__.__tmp__
<Current directory>\Data\MailWasher by FC Portables\roaming\meta\@APPDATA@\Firetrust\MailWasher\cache\MWP.db3.__meta__.__tmp__
<Current directory>\Data\MailWasher by FC Portables\roaming\meta\@APPDATA@\Firetrust\MailWasher\FirstAlertKnobs.Xml.__meta__.__tmp__
<Current directory>\Data\MailWasher by FC Portables\roaming\modified\@APPDATA@\Firetrust\MailWasher\BayesianKnobs.Xml

Deletes the following files:

<SYSTEM32>\wbem\Performance\WmiApRpl.ini
<Current directory>\Data\MailWasher by FC Portables\roaming\modified\@APPDATA@\Firetrust\MailWasher\contactsAB.txt
<SYSTEM32>\PerfStringBackup.TMP
<Current directory>\Data\MailWasher by FC Portables\roaming\modified\@APPDATA@\Firetrust\MailWasher\accounts.txt
<SYSTEM32>\d3d9caps.dat
%TEMP%\tmp1.tmp
%TEMP%\tmp2.tmp

Moves the following files:

from <Current directory>\Data\MailWasher by FC Portables\local\temp\@APPDATA@\Firetrust\MailWasher\Setting.Xml to <Current directory>\Data\MailWasher by FC Portables\roaming\modified\@APPDATA@\Firetrust\MailWasher\Setting.Xml
from <Current directory>\Data\MailWasher by FC Portables\roaming\meta\@APPDATA@\Firetrust\MailWasher\RBLknobs.Xml.__meta__.__tmp__ to <Current directory>\Data\MailWasher by FC Portables\roaming\meta\@APPDATA@\Firetrust\MailWasher\RBLknobs.Xml.__meta__
from <Current directory>\Data\MailWasher by FC Portables\local\temp\@APPDATA@\Firetrust\MailWasher\RBLknobs.Xml to <Current directory>\Data\MailWasher by FC Portables\roaming\modified\@APPDATA@\Firetrust\MailWasher\RBLknobs.Xml
from <Current directory>\Data\MailWasher by FC Portables\roaming\meta\@APPDATA@\Firetrust\MailWasher\regex.txt.__meta__.__tmp__ to <Current directory>\Data\MailWasher by FC Portables\roaming\meta\@APPDATA@\Firetrust\MailWasher\regex.txt.__meta__
from <Current directory>\Data\MailWasher by FC Portables\local\temp\@APPDATA@\Firetrust\MailWasher\regex.txt to <Current directory>\Data\MailWasher by FC Portables\roaming\modified\@APPDATA@\Firetrust\MailWasher\regex.txt
from <Current directory>\Data\MailWasher by FC Portables\roaming\meta\@APPDATA@\Firetrust\MailWasher\Setting.Xml.__meta__.__tmp__ to <Current directory>\Data\MailWasher by FC Portables\roaming\meta\@APPDATA@\Firetrust\MailWasher\Setting.Xml.__meta__
from <Current directory>\Data\MailWasher by FC Portables\local\temp\@APPDATA@\Firetrust\MailWasher\FirstAlertKnobs.Xml to <Current directory>\Data\MailWasher by FC Portables\roaming\modified\@APPDATA@\Firetrust\MailWasher\FirstAlertKnobs.Xml
from <Current directory>\Data\MailWasher by FC Portables\roaming\meta\@APPDATA@\Firetrust\MailWasher\BayesianKnobs.Xml.__meta__.__tmp__ to <Current directory>\Data\MailWasher by FC Portables\roaming\meta\@APPDATA@\Firetrust\MailWasher\BayesianKnobs.Xml.__meta__
from <Current directory>\Data\MailWasher by FC Portables\local\temp\@APPDATA@\Firetrust\MailWasher\BayesianKnobs.Xml to <Current directory>\Data\MailWasher by FC Portables\roaming\modified\@APPDATA@\Firetrust\MailWasher\BayesianKnobs.Xml
from <Current directory>\Data\MailWasher by FC Portables\roaming\meta\@APPDATA@\Firetrust\MailWasher\logs\logs_11-18-2014\MWPapp_FirstAlert.log.__meta__.__tmp__ to <Current directory>\Data\MailWasher by FC Portables\roaming\meta\@APPDATA@\Firetrust\MailWasher\logs\logs_11-18-2014\MWPapp_FirstAlert.log.__meta__
from <Current directory>\Data\MailWasher by FC Portables\local\temp\@APPDATA@\Firetrust\MailWasher\logs\logs_11-18-2014\MWPapp_FirstAlert.log to <Current directory>\Data\MailWasher by FC Portables\roaming\modified\@APPDATA@\Firetrust\MailWasher\logs\logs_11-18-2014\MWPapp_FirstAlert.log
from <Current directory>\Data\MailWasher by FC Portables\roaming\meta\@APPDATA@\Firetrust\MailWasher\FirstAlertKnobs.Xml.__meta__.__tmp__ to <Current directory>\Data\MailWasher by FC Portables\roaming\meta\@APPDATA@\Firetrust\MailWasher\FirstAlertKnobs.Xml.__meta__
from <Current directory>\Data\MailWasher by FC Portables\local\temp\@PROGRAMFILESX86@\Firetrust\MailWasher\MCore.dll to <Current directory>\Data\MailWasher by FC Portables\local\modified\@PROGRAMFILESX86@\Firetrust\MailWasher\MCore.dll
from <Current directory>\Data\MailWasher by FC Portables\local\meta\@PROGRAMFILESX86@\Firetrust\MailWasher\ContactsLib.dll.__meta__.__tmp__ to <Current directory>\Data\MailWasher by FC Portables\local\meta\@PROGRAMFILESX86@\Firetrust\MailWasher\ContactsLib.dll.__meta__
from <Current directory>\Data\MailWasher by FC Portables\local\temp\@PROGRAMFILESX86@\Firetrust\MailWasher\ContactsLib.dll to <Current directory>\Data\MailWasher by FC Portables\local\modified\@PROGRAMFILESX86@\Firetrust\MailWasher\ContactsLib.dll
from <Current directory>\Data\MailWasher by FC Portables\roaming\meta\@PROGRAMFILESX86@\Firetrust.__meta__.__tmp__ to <Current directory>\Data\MailWasher by FC Portables\roaming\meta\@PROGRAMFILESX86@\Firetrust.__meta__
from <Current directory>\Data\MailWasher by FC Portables\roaming\meta\@PROGRAMFILESX86@\Firetrust\MailWasher.__meta__.__tmp__ to <Current directory>\Data\MailWasher by FC Portables\roaming\meta\@PROGRAMFILESX86@\Firetrust\MailWasher.__meta__
from <Current directory>\Data\MailWasher by FC Portables\local\meta\@PROGRAMFILESX86@\Firetrust\MailWasher\MCore.dll.__meta__.__tmp__ to <Current directory>\Data\MailWasher by FC Portables\local\meta\@PROGRAMFILESX86@\Firetrust\MailWasher\MCore.dll.__meta__
from <Current directory>\Data\MailWasher by FC Portables\local\stubexe\0xBE9C5301DEA3D5EF\AccountImporter.exe.__tmp__ to <Current directory>\Data\MailWasher by FC Portables\local\stubexe\0xBE9C5301DEA3D5EF\AccountImporter.exe
from <Current directory>\Data\MailWasher by FC Portables\roaming\meta\@APPDATA@\Firetrust\MailWasher\BayesianSettings.xml.__meta__.__tmp__ to <Current directory>\Data\MailWasher by FC Portables\roaming\meta\@APPDATA@\Firetrust\MailWasher\BayesianSettings.xml.__meta__
from <Current directory>\Data\MailWasher by FC Portables\local\temp\@APPDATA@\Firetrust\MailWasher\BayesianSettings.xml to <Current directory>\Data\MailWasher by FC Portables\roaming\modified\@APPDATA@\Firetrust\MailWasher\BayesianSettings.xml
from <Current directory>\Data\MailWasher by FC Portables\local\stubexe\0x3FE7B2C665B452AB\ContactImporter.exe.__tmp__ to <Current directory>\Data\MailWasher by FC Portables\local\stubexe\0x3FE7B2C665B452AB\ContactImporter.exe
from <Current directory>\Data\MailWasher by FC Portables\local\meta\@PROGRAMFILESX86@\Firetrust\MailWasher\accexp.dll.__meta__.__tmp__ to <Current directory>\Data\MailWasher by FC Portables\local\meta\@PROGRAMFILESX86@\Firetrust\MailWasher\accexp.dll.__meta__
from <Current directory>\Data\MailWasher by FC Portables\local\temp\@PROGRAMFILESX86@\Firetrust\MailWasher\accexp.dll to <Current directory>\Data\MailWasher by FC Portables\local\modified\@PROGRAMFILESX86@\Firetrust\MailWasher\accexp.dll
from <Current directory>\Data\MailWasher by FC Portables\roaming\meta\@APPDATA@\Firetrust\MailWasher\cache\MWP.db3.__meta__.__tmp__ to <Current directory>\Data\MailWasher by FC Portables\roaming\meta\@APPDATA@\Firetrust\MailWasher\cache\MWP.db3.__meta__
from %TEMP%\SPOON\CACHE\0x206934920A525CBD\sxs\Manifests\MailWasherPro.exe_0x7abccb0f9410fd83d397cb4c735d0d7a.1.manifest.__tmp__ to %TEMP%\SPOON\CACHE\0x206934920A525CBD\sxs\Manifests\MailWasherPro.exe_0x7abccb0f9410fd83d397cb4c735d0d7a.1.manifest
from %TEMP%\SPOON\CACHE\0x206934920A525CBD\sxs\Manifests\FTClientNode.dll_0x5325cdc63912ad4424961b0738a20c33.2.manifest.__tmp__ to %TEMP%\SPOON\CACHE\0x206934920A525CBD\sxs\Manifests\FTClientNode.dll_0x5325cdc63912ad4424961b0738a20c33.2.manifest
from %TEMP%\SPOON\CACHE\0x206934920A525CBD\sxs\Manifests\FTBridge.dll_0xe5a524dda34dcacb6a3b0e69a30dda05.2.manifest.__tmp__ to %TEMP%\SPOON\CACHE\0x206934920A525CBD\sxs\Manifests\FTBridge.dll_0xe5a524dda34dcacb6a3b0e69a30dda05.2.manifest
from %TEMP%\SPOON\CACHE\0x206934920A525CBD\sxs\Manifests\MWPImportUtil.exe_0x2a0fca7c9b8aeb02f31da29beb900ea6.1.manifest.__tmp__ to %TEMP%\SPOON\CACHE\0x206934920A525CBD\sxs\Manifests\MWPImportUtil.exe_0x2a0fca7c9b8aeb02f31da29beb900ea6.1.manifest
from %TEMP%\SPOON\CACHE\0x206934920A525CBD\sxs\Manifests\MWPBridgeDLL.dll_0x76f5b3027534697aa2d889bf147bb23b.2.manifest.__tmp__ to %TEMP%\SPOON\CACHE\0x206934920A525CBD\sxs\Manifests\MWPBridgeDLL.dll_0x76f5b3027534697aa2d889bf147bb23b.2.manifest
from %TEMP%\SPOON\CACHE\0x206934920A525CBD\sxs\Manifests\MWPappDLL.dll_0xf7b80b55f2c244e51234bddd3eab1b13.2.manifest.__tmp__ to %TEMP%\SPOON\CACHE\0x206934920A525CBD\sxs\Manifests\MWPappDLL.dll_0xf7b80b55f2c244e51234bddd3eab1b13.2.manifest
from %TEMP%\SPOON\CACHE\0x206934920A525CBD\sxs\_MyApplication.app@1.0.0.0\_MyApplication.app@1.0.0.0.manifest.__tmp__ to %TEMP%\SPOON\CACHE\0x206934920A525CBD\sxs\_MyApplication.app@1.0.0.0\_MyApplication.app@1.0.0.0.manifest
from <Current directory>\Data\MailWasher by FC Portables\local\stubexe\0x83133FBFB02ACF12\MailWasherPro.exe.__tmp__ to <Current directory>\Data\MailWasher by FC Portables\local\stubexe\0x83133FBFB02ACF12\MailWasherPro.exe
from <Current directory>\Data\MailWasher by FC Portables\xsandbox.bin.__tmp__ to <Current directory>\Data\MailWasher by FC Portables\xsandbox.bin
from %TEMP%\SPOON\CACHE\0x206934920A525CBD\sxs\Manifests\ContactImporter.exe_0x61c81372dd2e9003d8066a43d73ff27b.1.manifest.__tmp__ to %TEMP%\SPOON\CACHE\0x206934920A525CBD\sxs\Manifests\ContactImporter.exe_0x61c81372dd2e9003d8066a43d73ff27b.1.manifest
from %TEMP%\SPOON\CACHE\0x206934920A525CBD\sxs\Manifests\AccountImporter.exe_0x3d99fb6163ee731bfaeb957f55ac40d0.1.manifest.__tmp__ to %TEMP%\SPOON\CACHE\0x206934920A525CBD\sxs\Manifests\AccountImporter.exe_0x3d99fb6163ee731bfaeb957f55ac40d0.1.manifest
from %TEMP%\SPOON\CACHE\0x206934920A525CBD\sxs\_MyApplication.app@1.0.0.0\MyApplication.app.manifest.__tmp__ to %TEMP%\SPOON\CACHE\0x206934920A525CBD\sxs\_MyApplication.app@1.0.0.0\MyApplication.app.manifest
from <Current directory>\Data\MailWasher by FC Portables\roaming\meta\@APPDATA@\Firetrust\MailWasher\logs\logs_11-18-2014\MWPapi.log.__meta__.__tmp__ to <Current directory>\Data\MailWasher by FC Portables\roaming\meta\@APPDATA@\Firetrust\MailWasher\logs\logs_11-18-2014\MWPapi.log.__meta__
from <Current directory>\Data\MailWasher by FC Portables\local\temp\@APPDATA@\Firetrust\MailWasher\logs\logs_11-18-2014\MWPapi.log to <Current directory>\Data\MailWasher by FC Portables\roaming\modified\@APPDATA@\Firetrust\MailWasher\logs\logs_11-18-2014\MWPapi.log
from <Current directory>\Data\MailWasher by FC Portables\roaming\meta\@PROGRAMFILESX86@\Firetrust\MailWasher\MailWasherPro.exe.__meta__.__tmp__ to <Current directory>\Data\MailWasher by FC Portables\roaming\meta\@PROGRAMFILESX86@\Firetrust\MailWasher\MailWasherPro.exe.__meta__
from <Current directory>\Data\MailWasher by FC Portables\local\temp\@APPDATA@\Firetrust\MailWasher\cache\MWP.db3 to <Current directory>\Data\MailWasher by FC Portables\roaming\modified\@APPDATA@\Firetrust\MailWasher\cache\MWP.db3
from <Current directory>\Data\MailWasher by FC Portables\roaming\meta\@APPDATA@\Firetrust\MailWasher\logs\logs_11-18-2014\MWPapp_MWPapp.log.__meta__.__tmp__ to <Current directory>\Data\MailWasher by FC Portables\roaming\meta\@APPDATA@\Firetrust\MailWasher\logs\logs_11-18-2014\MWPapp_MWPapp.log.__meta__
from <Current directory>\Data\MailWasher by FC Portables\local\temp\@APPDATA@\Firetrust\MailWasher\logs\logs_11-18-2014\MWPapp_MWPapp.log to <Current directory>\Data\MailWasher by FC Portables\roaming\modified\@APPDATA@\Firetrust\MailWasher\logs\logs_11-18-2014\MWPapp_MWPapp.log
from %TEMP%\SPOON\CACHE\0x206934920A525CBD\sxs\X86_Microsoft.Windows.AdvancedInstallerUpdater@1.0.0.0\Microsoft.Windows.AdvancedInstallerUpdater.manifest.__tmp__ to %TEMP%\SPOON\CACHE\0x206934920A525CBD\sxs\X86_Microsoft.Windows.AdvancedInstallerUpdater@1.0.0.0\Microsoft.Windows.AdvancedInstallerUpdater.manifest
from %TEMP%\SPOON\CACHE\0x206934920A525CBD\sxs\Manifests\updater.exe_0xa5767764364e1075b6023bb6e94514dd.1.manifest.__tmp__ to %TEMP%\SPOON\CACHE\0x206934920A525CBD\sxs\Manifests\updater.exe_0xa5767764364e1075b6023bb6e94514dd.1.manifest
from %TEMP%\SPOON\CACHE\0x206934920A525CBD\sxs\Manifests\UninstallFeedback.exe_0xabed5e869e0b2ab143a4b0ffda95f157.1.manifest.__tmp__ to %TEMP%\SPOON\CACHE\0x206934920A525CBD\sxs\Manifests\UninstallFeedback.exe_0xabed5e869e0b2ab143a4b0ffda95f157.1.manifest
from <Current directory>\Data\MailWasher by FC Portables\local\temp\@PROGRAMFILESX86@\Firetrust\MailWasher\MailWasherPro.exe to <Current directory>\Data\MailWasher by FC Portables\roaming\modified\@PROGRAMFILESX86@\Firetrust\MailWasher\MailWasherPro.exe
from <SYSTEM32>\d3d9caps.tmp to <SYSTEM32>\d3d9caps.dat
from %TEMP%\SPOON\CACHE\0x206934920A525CBD\sxs\X86_Microsoft.Windows.AdvancedInstallerUpdater@1.0.0.0\X86_Microsoft.Windows.AdvancedInstallerUpdater@1.0.0.0.manifest.__tmp__ to %TEMP%\SPOON\CACHE\0x206934920A525CBD\sxs\X86_Microsoft.Windows.AdvancedInstallerUpdater@1.0.0.0\X86_Microsoft.Windows.AdvancedInstallerUpdater@1.0.0.0.manifest

Network activity:

Connects to:

'na####.first-alert.net':80
'st###.spoon.net':443

TCP:

HTTP POST requests:

na####.first-alert.net/License.srv

UDP:

DNS ASK na####.first-alert.net
DNS ASK st###.spoon.net

Miscellaneous:

Searches for the following windows:

ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: 'SysListView32' WindowName: ''

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical Information

Curing recommendations

Free trial