Trojan.KillProc.11686

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Internet Explorer\Extensions\{b02A04EE-3024-11D2-8F1F-0000F87ABD16}] 'Exec' = 'http://www.biso.cn/js/re.asp?i=2'
[<HKLM>\SOFTWARE\Microsoft\Internet Explorer\Extensions\{b02A04EE-3024-11D2-8F1F-0000F87ABD16}] 'ClsidExtension' = '░┘╢╚╦╤╦ў'
[<HKLM>\SOFTWARE\Microsoft\Internet Explorer\Extensions\{b03A04EE-3024-11D2-8F1F-0000F87ABD16}] 'Exec' = 'http://www.biso.cn/js/re.asp?i=9'
[<HKLM>\SOFTWARE\Microsoft\Internet Explorer\Extensions\{b01A04EE-3024-11D2-8F1F-0000F87ABD16}] 'ClsidExtension' = '╨┬╬┼╫╩╤╢'
[<HKLM>\SOFTWARE\Microsoft\Internet Explorer\Extensions\{b01A04EE-3024-11D2-8F1F-0000F87ABD16}] 'Exec' = 'http://www.biso.cn/js/re.asp?i=1'
[<HKLM>\SOFTWARE\Microsoft\Internet Explorer\Extensions\{b02A04EE-3024-11D2-8F1F-0000F87ABD16}] 'ClsidExtension' = '╣╚╕ш╦╤╦ў'

Вредоносные функции:

Запускает на исполнение:

<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b02A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "ClsidExtension" /d "╣╚╕ш╦╤╦ў" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b02A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "CLSID" /d "{1FBA04EE-3024-11D2-8F1F-0000F87ABD16}" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b02A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "Exec" /d "http://www.bi#o.cn/js/re.asp?i=#" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b02A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "MenuStatusBar" /d "╣╚╕ш╦╤╦ў" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b02A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "MenuText" /d "╣╚╕ш╦╤╦ў" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b02A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "Default Visible" /d "yes" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b02A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "ButtonText" /d "╣╚╕ш╦╤╦ў" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b02A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "Icon" /d "<SYSTEM32>\gg.ico" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b02A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "hotIcon" /d "<SYSTEM32>\gg.ico" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b02A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "default Icon" /d "<SYSTEM32>\gg.ico" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b03A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "" /d "" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b02A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "ClsidExtension" /d "░┘╢╚╦╤╦ў" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b03A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "CLSID" /d "{1FBA04EE-3024-11D2-8F1F-0000F87ABD16}" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b03A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "Exec" /d "http://www.bi#o.cn/js/re.asp?i=#" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b02A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "MenuStatusBar" /d "░┘╢╚╦╤╦ў" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b03A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "MenuText" /d "░┘╢╚╦╤╦ў" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b03A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "Default Visible" /d "yes" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b03A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "ButtonText" /d "░┘╢╚╦╤╦ў" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b03A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "Icon" /d "<SYSTEM32>\bd.ico" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b03A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "hotIcon" /d "<SYSTEM32>\bd.ico" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b03A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "default Icon" /d "<SYSTEM32>\bd.ico" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b02A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "" /d "" /f
<SYSTEM32>\at.exe 11:37 /every:T %WINDIR%\repair\winopim.exe
<SYSTEM32>\at.exe /delete /yes
<SYSTEM32>\at.exe 22:37 /every:M %WINDIR%\repair\intel.exe
<SYSTEM32>\reg.exe add "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Google╦╤╦ў" /v "" /d "http://www.bi#o.cn/js/menu.asp?me#########" /f
<SYSTEM32>\reg.exe delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce" /va /f
<SYSTEM32>\ping.exe -n 1 g-cn.6600.org
<SYSTEM32>\cmd.exe /c """%TEMP%\win32.bat"""
<SYSTEM32>\ping.exe -n 1 b-cn.8800.org
<SYSTEM32>\taskkill.exe /f /im 360sd.exe
<SYSTEM32>\findstr.exe /m /c:"111.111.111.2 www.ba##u.com" "<DRIVERS>\etc\hosts"
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b01A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "" /d "" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b01A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "ClsidExtension" /d "╨┬╬┼╫╩╤╢" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b01A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "CLSID" /d "{1FBA04EE-3024-11D2-8F1F-0000F87ABD16}" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b01A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "Exec" /d "http://www.bi#o.cn/js/re.asp?i=#" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b01A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "MenuStatusBar" /d "╨┬╬┼╫╩╤╢" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b01A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "MenuText" /d "╨┬╬┼╫╩╤╢" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b01A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "Default Visible" /d "yes" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b01A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "ButtonText" /d "╨┬╬┼╫╩╤╢" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b01A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "Icon" /d "<SYSTEM32>\shell32.dll,14" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b01A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "hotIcon" /d "<SYSTEM32>\shell32.dll,14" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b01A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "default Icon" /d "<SYSTEM32>\shell32.dll,14" /f

Изменения в файловой системе:

Создает следующие файлы:

<SYSTEM32>\sg.ico
<SYSTEM32>\gg.ico
<SYSTEM32>\bd.ico
%HOMEPATH%\Favorites\═°╒╛╡╝║╜.url
%HOMEPATH%\Favorites\Baidu╦╤╦ў.url
%HOMEPATH%\Favorites\Google╦╤╦ў.url
%TEMP%\sg.ico
%TEMP%\gg.ico
%TEMP%\bd.ico
<Текущая директория>\a.txt
%TEMP%\exe1.tmp
%TEMP%\win32.bat

Удаляет следующие файлы:

%TEMP%\bd.ico
%TEMP%\gg.ico
%TEMP%\sg.ico
<Текущая директория>\a.txt
%TEMP%\exe1.tmp
%TEMP%\win32.bat

Сетевая активность:

UDP:

DNS ASK b-##.8800.org
DNS ASK g-##.6600.org

Другое:

Ищет следующие окна:

ClassName: '' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней