Trojan.DownLoader11.18985

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Classes\goodPic\shell\open\command] '' = '"%PROGRAM_FILES%\goodPic\goodPicAp.exe" "%1"'

Вредоносные функции:

Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\goodPic\goodPic.exe' = '%PROGRAM_FILES%\goodPic\goodPic.exe:*:Enabled:Е®Йс»Іб Player'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\goodPic\goodPicAp.exe' = '%PROGRAM_FILES%\goodPic\goodPicAp.exe:*:Enabled:Е®Йс»Іб App'

Создает и запускает на исполнение:

'%TEMP%\is-DIBSS.tmp\goodPic_setup_612.tmp' /SL5="$40092,2481881,117760,%TEMP%\nsa3.tmp\goodPic_setup_612.exe" /verysilent
'%PROGRAM_FILES%\goodPic\goodPicAp.exe' /setup_s
'%TEMP%\nsa3.tmp\goodpic_dae_612.exe'
'%TEMP%\nsa3.tmp\goodPic_setup_612.exe' /verysilent

Изменения в файловой системе:

Создает следующие файлы:

%ALLUSERSPROFILE%\Start Menu\Programs\goodPic\goodPic Player.lnk
%PROGRAM_FILES%\goodPic\plugins\is-R0UJS.tmp
%PROGRAM_FILES%\goodPic\plugins\is-C2BUU.tmp
%PROGRAM_FILES%\goodPic\config\config.ini
%PROGRAM_FILES%\goodPic\unins000.dat
%ALLUSERSPROFILE%\Start Menu\Programs\goodPic\Uninstall їН»§¶Л.lnk
%PROGRAM_FILES%\goodPic\is-8U3EN.tmp
%PROGRAM_FILES%\goodPic\is-RUNHO.tmp
%PROGRAM_FILES%\goodPic\is-RVBM7.tmp
%PROGRAM_FILES%\goodPic\config\is-S3BD6.tmp
%PROGRAM_FILES%\goodPic\is-39PMA.tmp
%PROGRAM_FILES%\goodPic\is-32PVP.tmp
%HOMEPATH%\Desktop\goodPic Player.lnk
%PROGRAM_FILES%\goodPic\config\hlib_block.db-journal
%PROGRAM_FILES%\goodPic\config\hlib_index.db
%PROGRAM_FILES%\goodPic\config\hlib_index.db-journal
%PROGRAM_FILES%\goodPic\config\hlib_pcrc.db
%PROGRAM_FILES%\goodPic\config\hlib_pcrc.db-journal
%PROGRAM_FILES%\goodPic\config\hlib_block.db
%PROGRAM_FILES%\goodPic\meinvGo.url
%PROGRAM_FILES%\goodPic\config\profile.cfg
%PROGRAM_FILES%\goodPic\config\partner.ini
%PROGRAM_FILES%\goodPic\config\CfgTmp.zip
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\cfgPicture[1].zip
%PROGRAM_FILES%\goodPic\top_box.bmp
%TEMP%\is-3FCB5.tmp\MgRecommend.dll
%TEMP%\is-3FCB5.tmp\jpg2bmp.dll
%TEMP%\is-3FCB5.tmp\_isetup\_shfoldr.dll
%TEMP%\is-3FCB5.tmp\top_box.jpg
%TEMP%\is-3FCB5.tmp\left_box.bmp
%TEMP%\is-3FCB5.tmp\setup.jpg
%TEMP%\nsa3.tmp\goodpic_dae_612.exe
%TEMP%\nsa3.tmp\NSISdl.dll
%TEMP%\nsv2.tmp
%TEMP%\is-3FCB5.tmp\_isetup\_RegDLL.tmp
%TEMP%\is-DIBSS.tmp\goodPic_setup_612.tmp
%TEMP%\nsa3.tmp\goodPic_setup_612.exe
%TEMP%\is-3FCB5.tmp\setup.bmp
%PROGRAM_FILES%\goodPic\is-FLNIQ.tmp
%PROGRAM_FILES%\goodPic\is-IVNRF.tmp
%PROGRAM_FILES%\goodPic\is-61TI8.tmp
%PROGRAM_FILES%\goodPic\is-PI1VI.tmp
%PROGRAM_FILES%\goodPic\is-IE3C2.tmp
%PROGRAM_FILES%\goodPic\is-4PBLQ.tmp
%PROGRAM_FILES%\goodPic\is-9AQGH.tmp
%PROGRAM_FILES%\goodPic\is-29O9H.tmp
%TEMP%\is-3FCB5.tmp\top_box.bmp
%PROGRAM_FILES%\goodPic\is-IH3BL.tmp
%PROGRAM_FILES%\goodPic\is-6519D.tmp
%PROGRAM_FILES%\goodPic\is-MPDVP.tmp

Удаляет следующие файлы:

%TEMP%\is-3FCB5.tmp\_isetup\_RegDLL.tmp
%TEMP%\is-3FCB5.tmp\_isetup\_shfoldr.dll
%TEMP%\is-3FCB5.tmp\top_box.bmp
%TEMP%\is-3FCB5.tmp\top_box.jpg
%TEMP%\is-DIBSS.tmp\goodPic_setup_612.tmp
%PROGRAM_FILES%\goodPic\config\hlib_block.db-journal
%PROGRAM_FILES%\goodPic\config\hlib_pcrc.db-journal
%PROGRAM_FILES%\goodPic\config\profile.cfg
%PROGRAM_FILES%\goodPic\config\hlib_index.db-journal
%TEMP%\nsa3.tmp\NSISdl.dll
%PROGRAM_FILES%\goodPic\goodPic.exe
%TEMP%\nsa3.tmp\goodpic_dae_612.exe
%TEMP%\nsa3.tmp\goodPic_setup_612.exe
%TEMP%\is-3FCB5.tmp\jpg2bmp.dll
%TEMP%\is-3FCB5.tmp\setup.bmp
%TEMP%\is-3FCB5.tmp\setup.jpg
%TEMP%\is-3FCB5.tmp\left_box.bmp
%TEMP%\is-3FCB5.tmp\MgRecommend.dll

Перемещает следующие файлы:

%PROGRAM_FILES%\goodPic\is-8U3EN.tmp в %PROGRAM_FILES%\goodPic\msvcr71.dll
%PROGRAM_FILES%\goodPic\is-32PVP.tmp в %PROGRAM_FILES%\goodPic\ppxa.dll
%PROGRAM_FILES%\goodPic\is-RUNHO.tmp в %PROGRAM_FILES%\goodPic\msvcr110.dll
%PROGRAM_FILES%\goodPic\is-PI1VI.tmp в %PROGRAM_FILES%\goodPic\msvcp110.dll
%PROGRAM_FILES%\goodPic\is-RVBM7.tmp в %PROGRAM_FILES%\goodPic\msvcp71.dll
%PROGRAM_FILES%\goodPic\plugins\is-R0UJS.tmp в %PROGRAM_FILES%\goodPic\plugins\TransmitLayer.dll
%PROGRAM_FILES%\goodPic\config\profile.cfg.new в %PROGRAM_FILES%\goodPic\config\profile.cfg
%PROGRAM_FILES%\goodPic\plugins\is-C2BUU.tmp в %PROGRAM_FILES%\goodPic\plugins\mnGLnk.dll
%PROGRAM_FILES%\goodPic\is-39PMA.tmp в %PROGRAM_FILES%\goodPic\sqlite3.dll
%PROGRAM_FILES%\goodPic\config\is-S3BD6.tmp в %PROGRAM_FILES%\goodPic\config\init.config.ini
%PROGRAM_FILES%\goodPic\is-6519D.tmp в %PROGRAM_FILES%\goodPic\goodPicAp.exe
%PROGRAM_FILES%\goodPic\is-IH3BL.tmp в %PROGRAM_FILES%\goodPic\jpg2bmp.dll
%PROGRAM_FILES%\goodPic\is-MPDVP.tmp в %PROGRAM_FILES%\goodPic\goodPic.exe
%PROGRAM_FILES%\goodPic\is-29O9H.tmp в %PROGRAM_FILES%\goodPic\unins000.exe
%PROGRAM_FILES%\goodPic\is-9AQGH.tmp в %PROGRAM_FILES%\goodPic\goodPic.exe
%PROGRAM_FILES%\goodPic\is-4PBLQ.tmp в %PROGRAM_FILES%\goodPic\MGIconLib.dll
%PROGRAM_FILES%\goodPic\is-IE3C2.tmp в %PROGRAM_FILES%\goodPic\MgRecommend.dll
%PROGRAM_FILES%\goodPic\is-FLNIQ.tmp в %PROGRAM_FILES%\goodPic\MFC71.dll
%PROGRAM_FILES%\goodPic\is-61TI8.tmp в %PROGRAM_FILES%\goodPic\meinvGo.ico
%PROGRAM_FILES%\goodPic\is-IVNRF.tmp в %PROGRAM_FILES%\goodPic\meinvGo.url