Trojan.DownLoader4.23803

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'CashBack' = '%PROGRAM_FILES%\CashBack\bin\cashback.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'NaviSearch' = '%PROGRAM_FILES%\NaviSearch\bin\nls.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'BullsEye Network' = '%PROGRAM_FILES%\BullsEye Network\bin\bargains.exe'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\ZESOFT] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

<SYSTEM32>\angelex.exe 0
<SYSTEM32>\instsrv.exe ZESOFT %WINDIR%\zeta.exe
%PROGRAM_FILES%\BullsEye Network\bin\bargains.exe
%WINDIR%\autoheal.exe
<SYSTEM32>\exdl2.exe 2~0
<SYSTEM32>\exdl1.exe 1~0
<SYSTEM32>\exdl3.exe 3~0
<SYSTEM32>\msexreg.exe /S HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\NaviSearch <SYSTEM32>\vx2x.nls /S HKLM SOFTWARE\CashBack <SYSTEM32>\vx3.nls /S HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\CashBack <SYSTEM32>\vx3x.nls /S HKLM SOFTWARE\Bargains <SYSTEM32>\vx1.nls /S HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BargainBuddy <SYSTEM32>\vx1x.nls /S HKLM SOFTWARE\NaviSearch <SYSTEM32>\vx2.nls
%PROGRAM_FILES%\Funcade\funcade.exe
%WINDIR%\nls8037_MARKETING14.exe
%PROGRAM_FILES%\Funcade\package8036_MARKETING14.exe
%WINDIR%\adp8036_MARKETING14.exe
%PROGRAM_FILES%\CashBack\bin\cashback.exe
%PROGRAM_FILES%\NaviSearch\bin\nls.exe
%WINDIR%\cb8036_MARKETING14.exe
%WINDIR%\exdl.exe 3~No 2~No 1~No

Запускает на исполнение:

<SYSTEM32>\regsvr32.exe /s <SYSTEM32>\mscb.dll
%WINDIR%\explorer.exe "http://www.na###earch.net/redir/fc_install_redir.html"
<SYSTEM32>\regsvr32.exe /s <SYSTEM32>\msbe.dll
<SYSTEM32>\regsvr32.exe /s <SYSTEM32>\nvms.dll

Изменения в файловой системе:

Создает следующие файлы:

C:\temp\bb_welcome.html
C:\temp\bb_welcome1.swf
C:\temp\bb_auto_wider.swf
%PROGRAM_FILES%\CashBack\bin\flash.exe
C:\temp\bb_click_wider.swf
C:\temp\blank.gif
%PROGRAM_FILES%\CashBack\Uninstall.exe
%PROGRAM_FILES%\NaviSearch\t1310660916.dec
<SYSTEM32>\mscb.dll
C:\temp\icon.gif
C:\temp\logo.gif
%PROGRAM_FILES%\CashBack\bb_auto_wider.swf
%PROGRAM_FILES%\CashBack\bb_welcome.html
%PROGRAM_FILES%\CashBack\bb_click_wider.swf
%PROGRAM_FILES%\CashBack\template.html
%PROGRAM_FILES%\CashBack\template2.html
%PROGRAM_FILES%\CashBack\bb_welcome1.swf
%PROGRAM_FILES%\CashBack\bin\cashback.exe
%PROGRAM_FILES%\CashBack\bin\cb.exe
%PROGRAM_FILES%\CashBack\logo.gif
%PROGRAM_FILES%\CashBack\blank.gif
%PROGRAM_FILES%\CashBack\icon.gif
<SYSTEM32>\vx2.nls
<SYSTEM32>\vx2x.nls
<SYSTEM32>\mac80ex.idf
<SYSTEM32>\vx1x.nls
<SYSTEM32>\exdl1.exe
<SYSTEM32>\javex80.vxd
<SYSTEM32>\vx3.nls
<SYSTEM32>\vx3x.nls
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\webservice[2].main
<SYSTEM32>\t1310660934.dec
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\webservice[1].main
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\webservice[1].main
<SYSTEM32>\angelex.exe
%TEMP%\nsxC.tmp
<SYSTEM32>\exdl3.exe
<SYSTEM32>\exdl2.exe
<SYSTEM32>\instsrv.exe
%WINDIR%\zeta.exe
<SYSTEM32>\vx1.nls
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\webservice[1].main
<SYSTEM32>\msexreg.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\webservice[1].main
%PROGRAM_FILES%\CashBack\flash.exe
%WINDIR%\exclean.exe
<SYSTEM32>\exclean.exe
%WINDIR%\autoheal.exe
<SYSTEM32>\javexulm.vxd
<SYSTEM32>\bbchk.exe
%WINDIR%\adp8036_MARKETING14.exe
%TEMP%\nso6.tmp
%PROGRAM_FILES%\BullsEye Network\bargains.exe
%HOMEPATH%\Start Menu\Programs\Funcade\Uninstall.lnk
%HOMEPATH%\Desktop\Funcade.lnk
%HOMEPATH%\Start Menu\Programs\Funcade\Funcade.lnk
%PROGRAM_FILES%\Funcade\uninstall.exe
%TEMP%\nso4.tmp
%PROGRAM_FILES%\Funcade\package8036_MARKETING14.exe
%TEMP%\nsm2.tmp
%PROGRAM_FILES%\Funcade\funcade.exe
%WINDIR%\exdl.exe
<SYSTEM32>\mqexdlm.srg
<SYSTEM32>\exul.exe
<SYSTEM32>\exdl.exe
%WINDIR%\exul.exe
%WINDIR%\bbchk.exe
%PROGRAM_FILES%\NaviSearch\ad.dat
<SYSTEM32>\nvms.dll
%PROGRAM_FILES%\NaviSearch\bin\nls.exe
%PROGRAM_FILES%\NaviSearch\nls.exe
%PROGRAM_FILES%\NaviSearch\ad-nls.dat
%PROGRAM_FILES%\NaviSearch\Uninstall.exe
%PROGRAM_FILES%\CashBack\cashback.exe
%PROGRAM_FILES%\CashBack\cb.exe
%PROGRAM_FILES%\CashBack\mscb.dll
%WINDIR%\cb8036_MARKETING14.exe
%TEMP%\nsvA.tmp
%PROGRAM_FILES%\BullsEye Network\bin\bargains.exe
%PROGRAM_FILES%\BullsEye Network\bin\adv.exe
%PROGRAM_FILES%\BullsEye Network\msbe.dll
%PROGRAM_FILES%\BullsEye Network\adv.exe
%PROGRAM_FILES%\BullsEye Network\adx.exe
%PROGRAM_FILES%\BullsEye Network\bin\adx.exe
%TEMP%\nsg8.tmp
%PROGRAM_FILES%\NaviSearch\nvms.dll
%WINDIR%\nls8037_MARKETING14.exe
<SYSTEM32>\msbe.dll
%PROGRAM_FILES%\BullsEye Network\Uninstall.exe

Удаляет следующие файлы:

%WINDIR%\cb8036_MARKETING14.exe
%WINDIR%\exdl.exe
%PROGRAM_FILES%\CashBack\flash.exe
%PROGRAM_FILES%\CashBack\cashback.exe
%PROGRAM_FILES%\CashBack\cb.exe
%PROGRAM_FILES%\NaviSearch\t1310660916.dec
<SYSTEM32>\t1310660934.dec
%WINDIR%\exclean.exe
%WINDIR%\exul.exe
%WINDIR%\bbchk.exe
%PROGRAM_FILES%\BullsEye Network\adx.exe
%WINDIR%\adp8036_MARKETING14.exe
%PROGRAM_FILES%\BullsEye Network\adv.exe
%PROGRAM_FILES%\BullsEye Network\msbe.dll
%PROGRAM_FILES%\BullsEye Network\bargains.exe
%WINDIR%\nls8037_MARKETING14.exe
%PROGRAM_FILES%\CashBack\mscb.dll
%PROGRAM_FILES%\NaviSearch\ad-nls.dat
%PROGRAM_FILES%\NaviSearch\nvms.dll
%PROGRAM_FILES%\NaviSearch\nls.exe

Сетевая активность:

Подключается к:

'ad#####r.outblaze.com':80

TCP:

Запросы HTTP GET:

ad#####r.outblaze.com/scripts/adpopper/webservice.main?ve###############################################
ad#####r.outblaze.com/scripts/adpopper/webservice.main?ty##########
ad#####r.outblaze.com/scripts/adpopper/webservice.main?ve###################################################

UDP: