Trojan.DownLoader4.21032

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'mvsong_update' = '%PROGRAM_FILES%\mvsong\mvsong_update.exe'

Вредоносные функции:

Создает и запускает на исполнение:

%PROGRAM_FILES%\mvsong\MV_Song.exe
%PROGRAM_FILES%\mvsong\mvsong_update.exe

Запускает на исполнение:

<SYSTEM32>\cmd.exe /c \DelUS.bat

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\mvsong\skin\volume100.bmp
%PROGRAM_FILES%\mvsong\skin\volume40.bmp
%PROGRAM_FILES%\mvsong\skin\top_right.bmp
%PROGRAM_FILES%\mvsong\skin\volume10.bmp
%PROGRAM_FILES%\mvsong\skin\volume70.bmp
%PROGRAM_FILES%\mvsong\skin\volume80.bmp
%PROGRAM_FILES%\mvsong\skin\volume50.bmp
%PROGRAM_FILES%\mvsong\skin\volume60.bmp
%PROGRAM_FILES%\mvsong\skin\top_left.bmp
%PROGRAM_FILES%\mvsong\skin\seach_bg.bmp
%PROGRAM_FILES%\mvsong\skin\search_bg.bmp
%PROGRAM_FILES%\mvsong\skin\playlist_right.bmp
%PROGRAM_FILES%\mvsong\skin\right_bg.bmp
%PROGRAM_FILES%\mvsong\skin\skin_bg01.bmp
%PROGRAM_FILES%\mvsong\skin\top_bg.bmp
%PROGRAM_FILES%\mvsong\skin\search_left.bmp
%PROGRAM_FILES%\mvsong\skin\search_right.bmp
%TEMP%\nsx3.tmp\SelfDelete.dll
C:\DelUS.bat
%HOMEPATH%\Desktop\№«єкјЫ ЗГ·№АМѕо.lnk
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\№«єкјЫ ЗГ·№АМѕо.lnk
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\Music[1]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\swfobject[1].js
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\iutil[1].php
%PROGRAM_FILES%\mvsong\updateinfo.ini
%HOMEPATH%\Start Menu\Programs\MVSong ЗГ·№АМѕо\MVSong ЗГ·№АМѕо ЅЗЗа.lnk
%PROGRAM_FILES%\mvsong\skin\volume_bar_left.bmp
%PROGRAM_FILES%\mvsong\skin\volume_bar_right.bmp
%PROGRAM_FILES%\mvsong\skin\volume90.bmp
%PROGRAM_FILES%\mvsong\skin\volume_bar_bg.bmp
%HOMEPATH%\Desktop\№«єкјЫ ИЁЖдАМБц.lnk
%HOMEPATH%\Start Menu\Programs\MVSong ЗГ·№АМѕо\MVSong ЗГ·№АМѕо Б¦°Е.lnk
%PROGRAM_FILES%\mvsong\skin\volume_controler.bmp
%PROGRAM_FILES%\mvsong\uninstall.exe
%PROGRAM_FILES%\mvsong\skin\playlist_left.bmp
%PROGRAM_FILES%\mvsong\skin\center_bg_dot.bmp
%PROGRAM_FILES%\mvsong\skin\colon1.bmp
%PROGRAM_FILES%\mvsong\skin\bottom_left.bmp
%PROGRAM_FILES%\mvsong\skin\bottom_right.bmp
%PROGRAM_FILES%\mvsong\skin\list_title_left.bmp
%PROGRAM_FILES%\mvsong\skin\list_title_right.bmp
%PROGRAM_FILES%\mvsong\skin\left_bg.bmp
%PROGRAM_FILES%\mvsong\skin\list_title_bg.bmp
%PROGRAM_FILES%\mvsong\skin\bottom_bg.bmp
%TEMP%\nsx3.tmp\KillProcDLL.dll
%PROGRAM_FILES%\mvsong\MV_Song.exe
%TEMP%\nsc2.tmp
%TEMP%\nsx3.tmp\DLLCount3.dll
%PROGRAM_FILES%\mvsong\you.html
%PROGRAM_FILES%\mvsong\skin\bg_dot.bmp
%PROGRAM_FILES%\mvsong\mvsong_icon.ico
%PROGRAM_FILES%\mvsong\mvsong_update.exe
%PROGRAM_FILES%\mvsong\skin\number9.bmp
%PROGRAM_FILES%\mvsong\skin\play01_on.bmp
%PROGRAM_FILES%\mvsong\skin\number7.bmp
%PROGRAM_FILES%\mvsong\skin\number8.bmp
%PROGRAM_FILES%\mvsong\skin\play_controler.bmp
%PROGRAM_FILES%\mvsong\skin\playlist_bg.bmp
%PROGRAM_FILES%\mvsong\skin\play02_on.bmp
%PROGRAM_FILES%\mvsong\skin\play03_on.bmp
%PROGRAM_FILES%\mvsong\skin\number6.bmp
%PROGRAM_FILES%\mvsong\skin\number0.bmp
%PROGRAM_FILES%\mvsong\skin\number1.bmp
%PROGRAM_FILES%\mvsong\skin\mvsong_logo.bmp
%PROGRAM_FILES%\mvsong\skin\mvsong_skin.bmp
%PROGRAM_FILES%\mvsong\skin\number4.bmp
%PROGRAM_FILES%\mvsong\skin\number5.bmp
%PROGRAM_FILES%\mvsong\skin\number2.bmp
%PROGRAM_FILES%\mvsong\skin\number3.bmp

Удаляет следующие файлы:

%TEMP%\nsx3.tmp\SelfDelete.dll
%PROGRAM_FILES%\mvsong\updateinfo.ini
%TEMP%\nsx3.tmp\DLLCount3.dll
%TEMP%\nsx3.tmp\KillProcDLL.dll

Самоудаляется.

Сетевая активность:

Подключается к:

'localhost':1040
'gd###.youtube.com':80
'sw######t.googlecode.com':80
'vi###tsoft.net':80
'up####.mvsong.com':80
'localhost':1038

TCP:

Запросы HTTP GET:

gd###.youtube.com/feeds/api/videos/-/Music?or###############################################################
sw######t.googlecode.com/svn/tags/rc3/swfobject/src/swfobject.js
vi###tsoft.net/counter/insert.php?db###################################################################
up####.mvsong.com/update/iutil.php

UDP: