Trojan.DownLoader4.19044

Техническая информация

Вредоносные функции:

Внедряет код в

следующие системные процессы:

Idle

Изменения в файловой системе:

Создает следующие файлы:

%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\jx vi^i[1].functions
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\i[1].functions
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\t[1].A
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\eubzacpe[1].functions
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\¬°¤s[1].functions
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\rio¤[1].Itn
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\rio¤[1].Itn
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\jx vi^i[1].functions
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\i[1].functions
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\v[1].functions
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\eubzacpe[1].functions
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\¬°¤s[1].functions
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\v[1].functions
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\v[1].functions
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\eubzacpe[1].functions
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\¬°¤s[1].functions
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\«_aoud][1]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\^v[1].functions
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\t[1].A
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\«_aoud][1]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\^v[1].functions
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\t[1].A
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\rio¤[1].Itn
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\jx vi^i[1].functions
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\i[1].functions

Удаляет следующие файлы:

%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\t[1].A
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\v[1].functions
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\«_aoud][1]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\^v[1].functions
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\eubzacpe[1].functions
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\jx vi^i[1].functions
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\i[1].functions
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\¬°¤s[1].functions
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\rio¤[1].Itn
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\t[1].A
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\v[1].functions
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\«_aoud][1]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\^v[1].functions
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\eubzacpe[1].functions
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\jx vi^i[1].functions
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\i[1].functions
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\¬°¤s[1].functions
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\rio¤[1].Itn

Сетевая активность:

Подключается к:

'??####s.localdomain':80
'eu#####e.localdomain':80
'ri###.localdomain':80
'i.###aldomain':80
'11#.#11.111.8':80
'??#####].localdomain':80
'localhost':1034
'^v.##caldomain':80
'v.###aldomain':80
't.###aldomain':80

TCP:

Запросы HTTP GET:

ri###.localdomain/?o###############################################################################
??####s.localdomain/?qA############################################################################################
i.###aldomain/??K##############################################################################################
11#.#11.111.8/??o####################################
eu#####e.localdomain/???######################################################################################
^v.##caldomain/??R##########################################################################################
??#####].localdomain/??a#####
v.###aldomain/?U?############################################################################################
t.###aldomain/??O###############################################################################################

UDP: