Trojan.DownLoader4.22512

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'xhrmy' = '%WINDIR%\Xhrmy.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'RebateNation0' = '"%PROGRAM_FILES%\Rebate_Nation\RebateNation0.exe"'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'djrebn5300.exe' = '""%TEMP%\djrebn5300.exe""'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Tsl' = '"%CommonProgramFiles%\tsa\tsl.exe"'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'RebateNation0' = '%PROGRAM_FILES%\Rebate_Nation\RebateNation0.exe'

Вредоносные функции:

Создает и запускает на исполнение:

%PROGRAM_FILES%\Rebate_Nation\RebateNation1.exe
%WINDIR%\HLInstaller3.exe
%WINDIR%\Xhrmy.exe
%PROGRAM_FILES%\Rebate_Nation\RebateNation0.exe
<SYSTEM32>\PreInstaller_p1.exe
<SYSTEM32>\Eprocessing_40kd34fg.exe
<SYSTEM32>\eaffiliate2.exe
<SYSTEM32>\Rebate.exe
<SYSTEM32>\TVM_B538.EXE
<SYSTEM32>\40kd34fg.exe

Запускает на исполнение:

<SYSTEM32>\regsvr32.exe /s "<SYSTEM32>\ATPartners.dll"

Ищет следующие окна с целью

обнаружения различных программ и игр:

ClassName: 'AOL Frame25' WindowName: ''

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\tvmupdater.exe
%PROGRAM_FILES%\Rebate_Nation\Sy5300\Images\rebn_c_pop_settings.gif
%PROGRAM_FILES%\Rebate_Nation\Sy5300\Images\rebn_c_logo_small.gif
%WINDIR%\HLInstaller3.exe
%TEMP%\nslE.tmp\nsisdl.dll
<SYSTEM32>\PreInstaller_p1.exe
%WINDIR%\Xhrmy.exe
%PROGRAM_FILES%\Rebate_Nation\Sy5300\Images\rebn_c_gray_circles.gif
%PROGRAM_FILES%\Rebate_Nation\Sy5300\Html\pref5300c.htm
%PROGRAM_FILES%\Rebate_Nation\Sy5300\Html\popo5300c.htm
%PROGRAM_FILES%\Rebate_Nation\Sy5300\Html\f_spec5300c_ub.htm
%PROGRAM_FILES%\Rebate_Nation\Sy5300\Html\scri5300a.htm
%PROGRAM_FILES%\Rebate_Nation\Sy5300\Images\rebn_c_envelope_footer.gif
%PROGRAM_FILES%\Rebate_Nation\Sy5300\Images\p.gif
%PROGRAM_FILES%\Rebate_Nation\Sy5300\Html\spec5300c.htm
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\post[1].htm
%PROGRAM_FILES%\Rebate_Nation\Sy5300\Tp5300\foot5300c_ub.htm
%PROGRAM_FILES%\Rebate_Nation\Sy5300\Tp5300\foot5300c_rb.htm
%PROGRAM_FILES%\Rebate_Nation\Sy5300\Tp5300\f_spec5300c_ub.htm
%PROGRAM_FILES%\Rebate_Nation\Sy5300\Tp5300\popo5300c.htm
%PROGRAM_FILES%\Rebate_Nation\Sy5300\Tp5300\log.txt
%PROGRAM_FILES%\Rebate_Nation\Sy5300\Tp5300\spec5300c.htm
%PROGRAM_FILES%\Rebate_Nation\Sy5300\Tp5300\pref5300c.htm
%PROGRAM_FILES%\Rebate_Nation\Sy5300\Tp5300\f_spec5300c_rb.htm
%PROGRAM_FILES%\Rebate_Nation\Da5300\4e11a4d633d7.dat
%PROGRAM_FILES%\Rebate_Nation\Sy5300\Tp5300\scri5300a.htm
%TEMP%\Incredifind.exe
%PROGRAM_FILES%\Rebate_Nation\Da5300\%USERNAME%\4e11a4de5fc3.dat
%PROGRAM_FILES%\Rebate_Nation\Sy5300\Tp5300\f_popo5300c_ub.htm
%PROGRAM_FILES%\Rebate_Nation\Sy5300\Tp5300\f_popo5300c_rb.htm
%PROGRAM_FILES%\Rebate_Nation\Da5300\5300sh.dat
<SYSTEM32>\ATPartners.dll
%TEMP%\~GLH0000.TMP
%TEMP%\GLM5.tmp
%TEMP%\GLC8.tmp
<SYSTEM32>\TVM_B538.EXE
%TEMP%\GLMA.tmp
%TEMP%\GLK9.tmp
%TEMP%\djrebn5300.exe
<SYSTEM32>\Rebate.exe
<SYSTEM32>\Eprocessing_40kd34fg.exe
<SYSTEM32>\eaffiliate2.exe
%TEMP%\GLC2.tmp
%TEMP%\GLK3.tmp
%TEMP%\jkill.exe
<SYSTEM32>\40kd34fg.exe
%TEMP%\iB.tmp
%PROGRAM_FILES%\Rebate_Nation\Sy5300\Html\foot5300c_rb.htm
%PROGRAM_FILES%\Rebate_Nation\Sy5300\Sy5300\5300_2.dat
%PROGRAM_FILES%\Rebate_Nation\Sy5300\Sy5300\5300_1.dat
%PROGRAM_FILES%\Rebate_Nation\Sy5300\Html\foot5300c_ub.htm
%PROGRAM_FILES%\Rebate_Nation\Sy5300\Html\f_spec5300c_rb.htm
%PROGRAM_FILES%\Rebate_Nation\Sy5300\Html\f_popo5300c_ub.htm
%PROGRAM_FILES%\Rebate_Nation\Sy5300\Html\f_popo5300c_rb.htm
%PROGRAM_FILES%\Rebate_Nation\Sy5300\Sy5300\5300_0.dat
%PROGRAM_FILES%\Rebate_Nation\RebateNation1.exe
%CommonProgramFiles%\tsa\temp.000
%CommonProgramFiles%\tsa\~GLH0000.TMP
%PROGRAM_FILES%\Rebate_Nation\RebateNation0.exe
%PROGRAM_FILES%\Rebate_Nation\Ap5300\rebn5300.dat
%PROGRAM_FILES%\Rebate_Nation\Ap5300\psid5301.dat
%PROGRAM_FILES%\Rebate_Nation\disp5300.exe

Удаляет следующие файлы:

%CommonProgramFiles%\tsa\~GLH0000.TMP
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\post[1].htm
%TEMP%\GLC2.tmp
%TEMP%\GLK3.tmp
%TEMP%\GLM5.tmp

Сетевая активность:

Подключается к:

'www.si###arch.com':80
'www.to###xie.com':80
'www.re####nation.com':80
'21#.#33.246.150':80
'www.to####elocity.com':80
'www.we###tinfo.net':80

TCP:

Запросы HTTP GET:

www.to###xie.com/external/builds/downloads2/mercexcl.dat
www.re####nation.com/acti.asp?cl###################################
www.to####elocity.comhttp://www.totalvelocity.com/Bundling/TvmUpdater4bp5.exe?ve#######################################
www.si###arch.com/Incredifind/partner/MindSet/exe/setup_incredifind_MindSet_addremove_p1.exe

Запросы HTTP POST: