Trojan.DownLoader4.22000

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'ebatesmoemoneymaker0' = '%PROGRAM_FILES%\Ebates_MoeMoneyMaker\ebatesmoemoneymaker0.exe'

Вредоносные функции:

Создает и запускает на исполнение:

%PROGRAM_FILES%\Ebates_MoeMoneyMaker\ebatesmoemoneymaker0.exe
%PROGRAM_FILES%\Ebates_MoeMoneyMaker\ebatesmoemoneymaker1.exe

Ищет следующие окна с целью

обнаружения различных программ и игр:

ClassName: 'AOL Frame25' WindowName: ''

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\Ebates_MoeMoneyMaker\Sy350\Images\ebmm_instructions_header.gif
%PROGRAM_FILES%\Ebates_MoeMoneyMaker\Sy350\Images\ebmm_hot.ico
%PROGRAM_FILES%\Ebates_MoeMoneyMaker\Sy350\Images\ebmm_green_bg.gif
%PROGRAM_FILES%\Ebates_MoeMoneyMaker\Sy350\Images\ebmm_logo_topmox.gif
%PROGRAM_FILES%\Ebates_MoeMoneyMaker\Sy350\Images\ebmm_logo_lrg.gif
%PROGRAM_FILES%\Ebates_MoeMoneyMaker\Sy350\Images\ebmm_logo1.gif
%PROGRAM_FILES%\Ebates_MoeMoneyMaker\Sy350\Images\ebmm_doublelines_bot_grn.gif
%PROGRAM_FILES%\Ebates_MoeMoneyMaker\Sy350\Images\ebmm_cou_moe.gif
%PROGRAM_FILES%\Ebates_MoeMoneyMaker\Sy350\Images\ebmm_cou_logo_greenbground.gif
%PROGRAM_FILES%\Ebates_MoeMoneyMaker\Sy350\Images\ebmm_cou_button_savenow.gif
%PROGRAM_FILES%\Ebates_MoeMoneyMaker\Sy350\Images\ebmm_doublelines_bot.gif
%PROGRAM_FILES%\Ebates_MoeMoneyMaker\Sy350\Images\ebmm_dotted_divider.gif
%PROGRAM_FILES%\Ebates_MoeMoneyMaker\Sy350\Images\ebmm_cou_moe_logo.gif
%PROGRAM_FILES%\Ebates_MoeMoneyMaker\Sy350\Images\ebmm_moe_question.gif
%PROGRAM_FILES%\Ebates_MoeMoneyMaker\Sy350\Images\ebmm_step4.gif
%PROGRAM_FILES%\Ebates_MoeMoneyMaker\Sy350\Images\ebmm_step3.gif
%PROGRAM_FILES%\Ebates_MoeMoneyMaker\Sy350\Images\ebmm_step2.gif
%ALLUSERSPROFILE%\Start Menu\Programs\Ebates Moe Money Maker\Ebates Moe Money Maker FAQ.lnk
%PROGRAM_FILES%\Ebates_MoeMoneyMaker\Sy350\Images\ebmm_step6_tear.gif
%PROGRAM_FILES%\Ebates_MoeMoneyMaker\Sy350\Images\ebmm_step5_tear.gif
%PROGRAM_FILES%\Ebates_MoeMoneyMaker\Sy350\Images\ebmm_step1.gif
%PROGRAM_FILES%\Ebates_MoeMoneyMaker\Sy350\Images\ebmm_moe_with_cash.gif
%PROGRAM_FILES%\Ebates_MoeMoneyMaker\Sy350\Images\ebmm_moe_top.gif
%PROGRAM_FILES%\Ebates_MoeMoneyMaker\Sy350\Images\ebmm_moe_reminder.gif
%PROGRAM_FILES%\Ebates_MoeMoneyMaker\Sy350\Images\ebmm_spacer.gif
%PROGRAM_FILES%\Ebates_MoeMoneyMaker\Sy350\Images\ebmm_prefs_browser.gif
%PROGRAM_FILES%\Ebates_MoeMoneyMaker\Sy350\Images\ebmm_preferences.gif
%PROGRAM_FILES%\Ebates_MoeMoneyMaker\Sy350\Sy350\350_0.dat
%PROGRAM_FILES%\Ebates_MoeMoneyMaker\Ap350\ebmmp350.dat
%PROGRAM_FILES%\Ebates_MoeMoneyMaker\Ap350\ebmm350.dat
%PROGRAM_FILES%\Ebates_MoeMoneyMaker\Sy350\Html\ebmmC03.htm
%PROGRAM_FILES%\Ebates_MoeMoneyMaker\Sy350\Sy350\350_2.dat
%PROGRAM_FILES%\Ebates_MoeMoneyMaker\Sy350\Sy350\350_1.dat
%PROGRAM_FILES%\Ebates_MoeMoneyMaker\ebatesmoemoneymaker2.dll
%PROGRAM_FILES%\Ebates_MoeMoneyMaker\ebatesmoemoneymaker1.exe
%TEMP%\nsz2.tmp\TopInet.dll
%TEMP%\nsz2.tmp\KillProcDLL.dll
%PROGRAM_FILES%\Ebates_MoeMoneyMaker\ebatesmoemoneymaker2.exe
%PROGRAM_FILES%\Ebates_MoeMoneyMaker\disp350.exe
%PROGRAM_FILES%\Ebates_MoeMoneyMaker\ebatesmoemoneymaker0.exe
%PROGRAM_FILES%\Ebates_MoeMoneyMaker\Sy350\Html\ebmmH03.htm
%PROGRAM_FILES%\Ebates_MoeMoneyMaker\Sy350\Images\ebmm_button_no.gif
%PROGRAM_FILES%\Ebates_MoeMoneyMaker\Sy350\Images\ebmm_button_getcashbck.gif
%PROGRAM_FILES%\Ebates_MoeMoneyMaker\Sy350\Images\ebmm_button_clickhere.gif
%PROGRAM_FILES%\Ebates_MoeMoneyMaker\Sy350\Images\ebmm_clear.gif
%PROGRAM_FILES%\Ebates_MoeMoneyMaker\Sy350\Images\ebmm_button_yes.gif
%PROGRAM_FILES%\Ebates_MoeMoneyMaker\Sy350\Images\ebmm_button_submit.gif
%PROGRAM_FILES%\Ebates_MoeMoneyMaker\Sy350\Images\ebmm.ico
%PROGRAM_FILES%\Ebates_MoeMoneyMaker\Sy350\Html\ebmmRNICP03.htm
%PROGRAM_FILES%\Ebates_MoeMoneyMaker\Sy350\Html\ebmmP0_dis3.htm
%PROGRAM_FILES%\Ebates_MoeMoneyMaker\Sy350\Html\ebmmP03.htm
%PROGRAM_FILES%\Ebates_MoeMoneyMaker\Sy350\Images\ebmm.gif
%PROGRAM_FILES%\Ebates_MoeMoneyMaker\Sy350\Html\ebmmRPMS03.htm
%PROGRAM_FILES%\Ebates_MoeMoneyMaker\Sy350\Html\ebmmRPMP03.htm

Удаляет следующие файлы:

%TEMP%\nsz2.tmp\TopInet.dll
%TEMP%\nsz2.tmp\KillProcDLL.dll

Сетевая активность:

Подключается к:

'www.sy###dates.com':80

TCP:

Запросы HTTP POST:

www.sy###dates.com/downloads/record_downloadstatus.asp?s=###############################
www.sy###dates.com/downloads/record_downloadstatus.asp?s=################################

UDP: