Trojan.DownLoader4.21001

Техническая информация

Для обеспечения автозапуска и распространения:

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\IEMaoSvc] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

%PROGRAM_FILES%\IEMao\IEMaoSvc.exe INS "%TEMP%\SE205.exe" /regserver

Запускает на исполнение:

<SYSTEM32>\regsvr32.exe /s "%PROGRAM_FILES%\IEMao\IEMaoBar.dll"
<SYSTEM32>\regsvr32.exe /s "<SYSTEM32>\midas.dll"
<SYSTEM32>\regsvr32.exe /s "%PROGRAM_FILES%\IEMao\iemao.dll"

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\IEMao\Search\is-G39LG.tmp
%PROGRAM_FILES%\IEMao\Search\is-5D7AU.tmp
%PROGRAM_FILES%\IEMao\Search\is-FO0KH.tmp
%PROGRAM_FILES%\IEMao\Search\is-4CI4L.tmp
%PROGRAM_FILES%\IEMao\Search\is-4BEUV.tmp
%PROGRAM_FILES%\IEMao\Search\is-D6G9B.tmp
%PROGRAM_FILES%\IEMao\Search\is-J1BSC.tmp
%PROGRAM_FILES%\IEMao\Search\is-10RIO.tmp
%PROGRAM_FILES%\IEMao\Search\is-0ASKF.tmp
%PROGRAM_FILES%\IEMao\Search\is-VPMNN.tmp
%PROGRAM_FILES%\IEMao\Search\is-51LJN.tmp
%PROGRAM_FILES%\IEMao\Search\is-TI22F.tmp
%PROGRAM_FILES%\IEMao\Search\is-2RMPT.tmp
%PROGRAM_FILES%\IEMao\Search\is-V971V.tmp
%PROGRAM_FILES%\IEMao\Search\is-7IBM8.tmp
%PROGRAM_FILES%\IEMao\Search\is-7COM5.tmp
%PROGRAM_FILES%\IEMao\Search\is-K10VE.tmp
%PROGRAM_FILES%\IEMao\is-C3OKQ.tmp
%HOMEPATH%\Favorites\IEГЁµјєЅ.url
%PROGRAM_FILES%\IEMao\Search\is-OBSM1.tmp
%PROGRAM_FILES%\IEMao\Search\is-LILO9.tmp
%PROGRAM_FILES%\IEMao\Site.ini
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\gg[1].asp
%PROGRAM_FILES%\IEMao\unins000.dat
%PROGRAM_FILES%\IEMao\iemao.cg
%PROGRAM_FILES%\IEMao\Search\is-36M7V.tmp
%PROGRAM_FILES%\IEMao\Search\is-SHTJI.tmp
%PROGRAM_FILES%\IEMao\Search\is-BGEP6.tmp
%PROGRAM_FILES%\IEMao\Search\is-56VI3.tmp
%PROGRAM_FILES%\IEMao\Search\is-2QV5H.tmp
%PROGRAM_FILES%\IEMao\Search\is-6CNID.tmp
%PROGRAM_FILES%\IEMao\Search\is-4FO4M.tmp
%PROGRAM_FILES%\IEMao\Search\is-R0HEK.tmp
%PROGRAM_FILES%\IEMao\is-OG4DM.tmp
%PROGRAM_FILES%\IEMao\is-0JEAM.tmp
%PROGRAM_FILES%\IEMao\is-11SSI.tmp
<SYSTEM32>\is-IL91I.tmp
%PROGRAM_FILES%\IEMao\Search\is-BHF46.tmp
%PROGRAM_FILES%\IEMao\Search\is-KH5U2.tmp
%PROGRAM_FILES%\IEMao\Search\is-4TCST.tmp
%PROGRAM_FILES%\IEMao\Search\is-7NEU8.tmp
%TEMP%\is-KJ9KU.tmp\_isetup\_RegDLL.tmp
%TEMP%\is-KJ9KU.tmp\_isetup\_shfoldr.dll
%TEMP%\SE205.exe
%TEMP%\is-6MFP9.tmp\SE205.tmp
%PROGRAM_FILES%\IEMao\is-C9A0Q.tmp
%PROGRAM_FILES%\IEMao\is-1UAN7.tmp
%TEMP%\is-KJ9KU.tmp\IEMaoSvc.exe
%PROGRAM_FILES%\IEMao\is-JAPGC.tmp
%PROGRAM_FILES%\IEMao\Search\is-58DCN.tmp
%PROGRAM_FILES%\IEMao\Search\is-QOJ0V.tmp
%PROGRAM_FILES%\IEMao\Search\is-N498A.tmp
%PROGRAM_FILES%\IEMao\Search\is-HK0UU.tmp
%PROGRAM_FILES%\IEMao\Search\is-EH3SI.tmp
%PROGRAM_FILES%\IEMao\Search\is-FQ2HD.tmp
%PROGRAM_FILES%\IEMao\Search\is-3139D.tmp
%PROGRAM_FILES%\IEMao\Search\is-GNL36.tmp
%PROGRAM_FILES%\IEMao\Search\is-2J7OR.tmp
%PROGRAM_FILES%\IEMao\Search\is-LGPD2.tmp
%PROGRAM_FILES%\IEMao\Search\is-OKTMM.tmp
%PROGRAM_FILES%\IEMao\Search\is-2D5O7.tmp
%PROGRAM_FILES%\IEMao\Search\is-T26SV.tmp
%PROGRAM_FILES%\IEMao\Search\is-87TNE.tmp
%PROGRAM_FILES%\IEMao\Search\is-76UPL.tmp
%PROGRAM_FILES%\IEMao\Search\is-9J256.tmp
%PROGRAM_FILES%\IEMao\Search\is-LVB4R.tmp