Trojan.DownLoader4.35775

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'DW6' = '"%PROGRAM_FILES%\The Weather Channel FW\Desktop\DesktopWeather.exe"'

Изменения в файловой системе:

Создает следующие файлы:

%ALLUSERSPROFILE%\Start Menu\Programs\The Weather Channel\Desktop 6\Give Us Your Feedback.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\The Weather Channel\Desktop 6\Help.lnk
%ALLUSERSPROFILE%\Desktop\The Weather Channel Desktop .lnk
%ALLUSERSPROFILE%\Start Menu\Programs\The Weather Channel\Desktop 6\Uninstall.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\The Weather Channel\Desktop 6\The Weather Channel Desktop.lnk
<LS_APPDATA>\The Weather Channel\Desktop\~GLH000f.TMP
<LS_APPDATA>\The Weather Channel\Desktop\~GLH000e.TMP
<LS_APPDATA>\The Weather Channel\Desktop\ver.txt
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\ver[1].txt
%PROGRAM_FILES%\The Weather Channel FW\Desktop\apps.ini
%TEMP%\9.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\7[1]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\dw01_notext[1].jpg
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\DtwTbEula[1].html
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\DtwTbEula[1].html
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\ver[1].txt
%PROGRAM_FILES%\The Weather Channel FW\Desktop\INSTALL.LOG
%TEMP%\8.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\6[1]
%PROGRAM_FILES%\The Weather Channel FW\Desktop\~GLH000d.TMP
<SYSTEM32>\~GLH0002.TMP
%TEMP%\~GLH0000.TMP
<LS_APPDATA>\The Weather Channel\Desktop\apps.ini
<SYSTEM32>\temp.000
%TEMP%\GLG6.tmp
%TEMP%\GLK2.tmp
%TEMP%\GLC1.tmp
%TEMP%\GLW4.tmp
%TEMP%\GLM3.tmp
C:\~GLHTTP1.TMP
%PROGRAM_FILES%\The Weather Channel FW\Desktop\~GLH000a.TMP
%PROGRAM_FILES%\The Weather Channel FW\Desktop\~GLH0009.TMP
%PROGRAM_FILES%\The Weather Channel FW\Desktop\~GLH000c.TMP
%PROGRAM_FILES%\The Weather Channel FW\Desktop\~GLH000b.TMP
%PROGRAM_FILES%\The Weather Channel FW\Desktop\~GLH0008.TMP
%PROGRAM_FILES%\The Weather Channel FW\Desktop\~GLH0005.TMP
%PROGRAM_FILES%\The Weather Channel FW\Desktop\~GLH0004.TMP
%PROGRAM_FILES%\The Weather Channel FW\Desktop\~GLH0007.TMP
%PROGRAM_FILES%\The Weather Channel FW\Desktop\~GLH0006.TMP

Удаляет следующие файлы:

%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\ver[1].txt
%TEMP%\GLC1.tmp
%TEMP%\GLF7.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\DtwTbEula[1].html
%TEMP%\9.tmp
%TEMP%\8.tmp
C:\~GLHTTP1.TMP
<SYSTEM32>\~GLH0002.TMP
%TEMP%\GLW4.tmp
%TEMP%\GLM3.tmp
%TEMP%\GLK2.tmp
%TEMP%\GLG6.tmp

Сетевая активность:

Подключается к:

'au##.#eather.com':443
'localhost':1040
'd.#.#mwx.com':80
'x.##wx.com':80
'localhost':1037
'de#####fw.weather.com':80

TCP:

Запросы HTTP GET:

de#####fw.weather.com/services/dwzeus/dw6/setupv1/files/DtwTbEula.html
x.##wx.com/20/7?id##############################################################
d.#.#mwx.com/web/dwzeus/dw6/install/setupimgs/dw01_notext.jpg
x.##wx.com/20/6?id##############################################################
x.##wx.com/20/3?id##########################################################
de#####fw.weather.com/services/dwzeus/dw6/setupv1/ver.txt
x.##wx.com/20/4?id##########################################################

UDP: