Trojan.DownLoader11.31977

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Classes\ShenmTv\shell\open\command] '' = '"%PROGRAM_FILES%\ShenmTv\ShenmTvAp.exe" "%1"'

Вредоносные функции:

Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\ShenmTv\HttpDownLoad.exe' = '%PROGRAM_FILES%\ShenmTv\HttpDownLoad.exe:*:Enabled:HttpDownLoad'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\ShenmTv\ShenmTv.exe' = '%PROGRAM_FILES%\ShenmTv\ShenmTv.exe:*:Enabled:ЙсВнУ°КУ Player'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\ShenmTv\ShenmTvAp.exe' = '%PROGRAM_FILES%\ShenmTv\ShenmTvAp.exe:*:Enabled:ЙсВнУ°КУ App'

Создает и запускает на исполнение:

'%PROGRAM_FILES%\ShenmTv\ShenmTvAp.exe' /setup_s
'%TEMP%\is-PQNT3.tmp\shenmtv_setup.tmp' /SL5="$30092,2625873,148992,<Текущая директория>\shenmtv_setup.exe" /verysilent
'<Текущая директория>\shenmtv_setup.exe' /verysilent

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\ShenmTv\is-VRTPQ.tmp
%PROGRAM_FILES%\ShenmTv\is-PH7Q9.tmp
%PROGRAM_FILES%\ShenmTv\config\is-MEQPM.tmp
%PROGRAM_FILES%\ShenmTv\plugins\is-5UTHP.tmp
%PROGRAM_FILES%\ShenmTv\plugins\is-FAV4A.tmp
%PROGRAM_FILES%\ShenmTv\is-P9FMD.tmp
%PROGRAM_FILES%\ShenmTv\is-2L2G1.tmp
%PROGRAM_FILES%\ShenmTv\is-8UANG.tmp
%PROGRAM_FILES%\ShenmTv\is-MGMT1.tmp
%PROGRAM_FILES%\ShenmTv\is-TPN37.tmp
%PROGRAM_FILES%\ShenmTv\mgLeying.url
%PROGRAM_FILES%\ShenmTv\config\partner.ini
%PROGRAM_FILES%\ShenmTv\top_box.bmp
%PROGRAM_FILES%\ShenmTv\config\profile.cfg.new
%PROGRAM_FILES%\ShenmTv\config\CfgTmp.zip
%ALLUSERSPROFILE%\Start Menu\Programs\ShenmTv\Uninstall ІҐ·ЕЖч.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\ShenmTv\ShenmTv Player.lnk
%PROGRAM_FILES%\ShenmTv\unins000.dat
%HOMEPATH%\Desktop\ShenmTv Player.lnk
%PROGRAM_FILES%\ShenmTv\config\config.ini
%PROGRAM_FILES%\ShenmTv\is-5MC21.tmp
%TEMP%\is-0JFV6.tmp\setup.jpg
%TEMP%\is-0JFV6.tmp\MgRecommend.dll
%TEMP%\is-0JFV6.tmp\left_box.bmp
%TEMP%\is-0JFV6.tmp\setup.bmp
%TEMP%\is-0JFV6.tmp\top_box.jpg
%TEMP%\is-PQNT3.tmp\shenmtv_setup.tmp
<Текущая директория>\shenmtv_setup.exe
%TEMP%\is-0JFV6.tmp\_isetup\_RegDLL.tmp
%TEMP%\is-0JFV6.tmp\jpg2bmp.dll
%TEMP%\is-0JFV6.tmp\_isetup\_shfoldr.dll
%PROGRAM_FILES%\ShenmTv\is-7FR4B.tmp
%PROGRAM_FILES%\ShenmTv\is-07CIH.tmp
%PROGRAM_FILES%\ShenmTv\is-65H4L.tmp
%PROGRAM_FILES%\ShenmTv\is-NNSSL.tmp
%PROGRAM_FILES%\ShenmTv\is-BQ9AE.tmp
%PROGRAM_FILES%\ShenmTv\is-ER7MB.tmp
%TEMP%\is-0JFV6.tmp\top_box.bmp
%PROGRAM_FILES%\ShenmTv\is-0JHSE.tmp
%PROGRAM_FILES%\ShenmTv\is-UPNUK.tmp
%PROGRAM_FILES%\ShenmTv\is-NVEM3.tmp

Удаляет следующие файлы:

%TEMP%\is-0JFV6.tmp\_isetup\_RegDLL.tmp
%TEMP%\is-0JFV6.tmp\top_box.jpg
%TEMP%\is-0JFV6.tmp\top_box.bmp
<Текущая директория>\shenmtv_setup.exe
%TEMP%\is-PQNT3.tmp\shenmtv_setup.tmp
%TEMP%\is-0JFV6.tmp\_isetup\_shfoldr.dll
%TEMP%\is-0JFV6.tmp\left_box.bmp
%TEMP%\is-0JFV6.tmp\jpg2bmp.dll
%PROGRAM_FILES%\ShenmTv\ShenmTv.exe
%TEMP%\is-0JFV6.tmp\setup.jpg
%TEMP%\is-0JFV6.tmp\setup.bmp
%TEMP%\is-0JFV6.tmp\MgRecommend.dll

Перемещает следующие файлы:

%PROGRAM_FILES%\ShenmTv\is-MGMT1.tmp в %PROGRAM_FILES%\ShenmTv\ShenmTv.exe
%PROGRAM_FILES%\ShenmTv\is-PH7Q9.tmp в %PROGRAM_FILES%\ShenmTv\ShenmTvAp.exe
%PROGRAM_FILES%\ShenmTv\is-TPN37.tmp в %PROGRAM_FILES%\ShenmTv\ppxa.dll
%PROGRAM_FILES%\ShenmTv\is-P9FMD.tmp в %PROGRAM_FILES%\ShenmTv\msvcr110.dll
%PROGRAM_FILES%\ShenmTv\is-8UANG.tmp в %PROGRAM_FILES%\ShenmTv\msvcr71.dll
%PROGRAM_FILES%\ShenmTv\plugins\is-5UTHP.tmp в %PROGRAM_FILES%\ShenmTv\plugins\TransmitLayer.dll
%PROGRAM_FILES%\ShenmTv\config\profile.cfg.new в %PROGRAM_FILES%\ShenmTv\config\profile.cfg
%PROGRAM_FILES%\ShenmTv\plugins\is-FAV4A.tmp в %PROGRAM_FILES%\ShenmTv\plugins\MgDLink.dll
%PROGRAM_FILES%\ShenmTv\is-VRTPQ.tmp в %PROGRAM_FILES%\ShenmTv\sqlite3.dll
%PROGRAM_FILES%\ShenmTv\config\is-MEQPM.tmp в %PROGRAM_FILES%\ShenmTv\config\init.config.ini
%PROGRAM_FILES%\ShenmTv\is-2L2G1.tmp в %PROGRAM_FILES%\ShenmTv\msvcp71.dll
%PROGRAM_FILES%\ShenmTv\is-UPNUK.tmp в %PROGRAM_FILES%\ShenmTv\jpg2bmp.dll
%PROGRAM_FILES%\ShenmTv\is-07CIH.tmp в %PROGRAM_FILES%\ShenmTv\MFC71.dll
%PROGRAM_FILES%\ShenmTv\is-NVEM3.tmp в %PROGRAM_FILES%\ShenmTv\HttpDownLoad.exe
%PROGRAM_FILES%\ShenmTv\is-ER7MB.tmp в %PROGRAM_FILES%\ShenmTv\unins000.exe
%PROGRAM_FILES%\ShenmTv\is-0JHSE.tmp в %PROGRAM_FILES%\ShenmTv\ShenmTv.exe
%PROGRAM_FILES%\ShenmTv\is-NNSSL.tmp в %PROGRAM_FILES%\ShenmTv\MgRecommend.dll
%PROGRAM_FILES%\ShenmTv\is-5MC21.tmp в %PROGRAM_FILES%\ShenmTv\msvcp110.dll
%PROGRAM_FILES%\ShenmTv\is-BQ9AE.tmp в %PROGRAM_FILES%\ShenmTv\mgLeying.url
%PROGRAM_FILES%\ShenmTv\is-7FR4B.tmp в %PROGRAM_FILES%\ShenmTv\MGIconLib.dll
%PROGRAM_FILES%\ShenmTv\is-65H4L.tmp в %PROGRAM_FILES%\ShenmTv\mgLeying.ico