Trojan.DownLoader8.16307

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '%PROGRAM_FILES%\gif_animation\0306_gif_animation.exe' = '%PROGRAM_FILES%\gif_animation\0306\gif_animation.exe'

Вредоносные функции:

Создает и запускает на исполнение:

<SYSTEM32>\system_dll.exe
%PROGRAM_FILES%\gif_animation\0306\gif_animation.exe

Запускает на исполнение:

<SYSTEM32>\reg.exe Export "HKEY_CURRENT_USER\Software\Mail.Ru\Agent" "<SYSTEM32>\file_pwd\agent.reg"

Изменения в файловой системе:

Создает следующие файлы:

<SYSTEM32>\file_pwd\Mozila\cwdgt0y8.default\places.sqlite
<SYSTEM32>\file_pwd\Mozila\cwdgt0y8.default\permissions.sqlite
<SYSTEM32>\file_pwd\Mozila\cwdgt0y8.default\pluginreg.dat
<SYSTEM32>\file_pwd\Mozila\cwdgt0y8.default\search.json
<SYSTEM32>\file_pwd\Mozila\cwdgt0y8.default\prefs.js
<SYSTEM32>\file_pwd\Mozila\cwdgt0y8.default\formhistory.sqlite
<SYSTEM32>\file_pwd\Mozila\cwdgt0y8.default\extensions.sqlite
<SYSTEM32>\file_pwd\Mozila\cwdgt0y8.default\key3.db
<SYSTEM32>\file_pwd\Mozila\cwdgt0y8.default\mimeTypes.rdf
<SYSTEM32>\file_pwd\Mozila\cwdgt0y8.default\localstore.rdf
<SYSTEM32>\file_pwd\Mozila\cwdgt0y8.default\chrome\userChrome-example.css
<SYSTEM32>\file_pwd\Mozila\cwdgt0y8.default\webappsstore.sqlite
<SYSTEM32>\file_pwd\Mozila\cwdgt0y8.default\chrome\userContent-example.css
C:\RECYCLER\pwd.zip
<SYSTEM32>\file_pwd\Mozila\cwdgt0y8.default\bookmarkbackups\bookmarks-2011-11-10.json
<SYSTEM32>\file_pwd\Mozila\cwdgt0y8.default\secmod.db
<SYSTEM32>\file_pwd\Mozila\cwdgt0y8.default\search.sqlite
<SYSTEM32>\file_pwd\Mozila\cwdgt0y8.default\sessionstore.bak
<SYSTEM32>\file_pwd\Mozila\cwdgt0y8.default\signons.sqlite
<SYSTEM32>\file_pwd\Mozila\cwdgt0y8.default\sessionstore.js
%TEMP%\aut4.tmp
<SYSTEM32>\system_dll.exe
%PROGRAM_FILES%\gif_animation\0306\gif.gif
%PROGRAM_FILES%\gif_animation\0306\gif_animation.exe
%TEMP%\aut5.tmp
<SYSTEM32>\blat.dll
%TEMP%\aut1.tmp
%TEMP%\aut2.tmp
%TEMP%\aut3.tmp
<SYSTEM32>\7-zip32.dll
<SYSTEM32>\file_pwd\Mozila\cwdgt0y8.default\content-prefs.sqlite
<SYSTEM32>\file_pwd\Mozila\cwdgt0y8.default\compatibility.ini
<SYSTEM32>\file_pwd\Mozila\cwdgt0y8.default\cookies.sqlite
<SYSTEM32>\file_pwd\Mozila\cwdgt0y8.default\extensions.ini
<SYSTEM32>\file_pwd\Mozila\cwdgt0y8.default\downloads.sqlite
%PROGRAM_FILES%\gif_animation\uninstall.exe
%TEMP%\aut6.tmp
<SYSTEM32>\file_pwd\Mozila\cwdgt0y8.default\bookmarks.html
<SYSTEM32>\file_pwd\Mozila\cwdgt0y8.default\chromeappsstore.sqlite
<SYSTEM32>\file_pwd\Mozila\cwdgt0y8.default\cert8.db

Удаляет следующие файлы:

<SYSTEM32>\file_pwd\Mozila\cwdgt0y8.default\pluginreg.dat
<SYSTEM32>\file_pwd\Mozila\cwdgt0y8.default\places.sqlite
<SYSTEM32>\file_pwd\Mozila\cwdgt0y8.default\search.json
<SYSTEM32>\file_pwd\Mozila\cwdgt0y8.default\prefs.js
<SYSTEM32>\file_pwd\Mozila\cwdgt0y8.default\localstore.rdf
<SYSTEM32>\file_pwd\Mozila\cwdgt0y8.default\key3.db
<SYSTEM32>\file_pwd\Mozila\cwdgt0y8.default\permissions.sqlite
<SYSTEM32>\file_pwd\Mozila\cwdgt0y8.default\mimeTypes.rdf
<SYSTEM32>\file_pwd\Mozila\cwdgt0y8.default\search.sqlite
<SYSTEM32>\file_pwd\Mozila\cwdgt0y8.default\chrome\userChrome-example.css
<SYSTEM32>\file_pwd\Mozila\cwdgt0y8.default\webappsstore.sqlite
<SYSTEM32>\file_pwd\Mozila\cwdgt0y8.default\bookmarkbackups\bookmarks-2011-11-10.json
<SYSTEM32>\file_pwd\Mozila\cwdgt0y8.default\chrome\userContent-example.css
<SYSTEM32>\file_pwd\Mozila\cwdgt0y8.default\sessionstore.bak
<SYSTEM32>\file_pwd\Mozila\cwdgt0y8.default\secmod.db
<SYSTEM32>\file_pwd\Mozila\cwdgt0y8.default\signons.sqlite
<SYSTEM32>\file_pwd\Mozila\cwdgt0y8.default\sessionstore.js
%TEMP%\aut6.tmp
%TEMP%\aut5.tmp
<SYSTEM32>\file_pwd\Mozila\cwdgt0y8.default\bookmarks.html
C:\RECYCLER\pwd.zip
%TEMP%\aut2.tmp
%TEMP%\aut1.tmp
%TEMP%\aut4.tmp
%TEMP%\aut3.tmp
<SYSTEM32>\file_pwd\Mozila\cwdgt0y8.default\cert8.db
<SYSTEM32>\file_pwd\Mozila\cwdgt0y8.default\extensions.ini
<SYSTEM32>\file_pwd\Mozila\cwdgt0y8.default\downloads.sqlite
<SYSTEM32>\file_pwd\Mozila\cwdgt0y8.default\formhistory.sqlite
<SYSTEM32>\file_pwd\Mozila\cwdgt0y8.default\extensions.sqlite
<SYSTEM32>\file_pwd\Mozila\cwdgt0y8.default\compatibility.ini
<SYSTEM32>\file_pwd\Mozila\cwdgt0y8.default\chromeappsstore.sqlite
<SYSTEM32>\file_pwd\Mozila\cwdgt0y8.default\cookies.sqlite
<SYSTEM32>\file_pwd\Mozila\cwdgt0y8.default\content-prefs.sqlite