Trojan.DownLoader23.60730

Техническая информация

Для обеспечения автозапуска и распространения:

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\MSIServer] 'Start' = '00000002'

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\msiexec.exe' /V
'<SYSTEM32>\regsvr32.exe' /s "%ALLUSERSPROFILE%\Application Data\Soda PDF Desktop\Installation\Statistics.dll"
'%ALLUSERSPROFILE%\Application Data\Soda PDF Desktop\Installation\Soda_PDF_Desktop_Installer.exe' /RegServer

Регистрирует COM-сервер:

[<HKLM>\SOFTWARE\Classes\CLSID\{75F3F7EC-B2ED-4851-ABF1-9F1F29D18100}\InprocServer32] '' = '%ALLUSERSPROFILE%\Application Data\Soda PDF Desktop\Installation\Statistics.dll'
[<HKLM>\SOFTWARE\Classes\CLSID\{AF8259A6-AB6D-46E1-AF8D-9CD2AC821A00}\InprocServer32] '' = '%ALLUSERSPROFILE%\Application Data\Soda PDF Desktop\Installation\Statistics.dll'
[<HKLM>\SOFTWARE\Classes\CLSID\{A37C2155-D129-4489-BB43-AF7B51CEA600}\InprocServer32] '' = '%ALLUSERSPROFILE%\Application Data\Soda PDF Desktop\Installation\Statistics.dll'
[<HKLM>\SOFTWARE\Classes\CLSID\{ADFA580A-3B17-4614-876C-8A425AAF6000}\InprocServer32] '' = '%ALLUSERSPROFILE%\Application Data\Soda PDF Desktop\Installation\Statistics.dll'
[<HKLM>\SOFTWARE\Classes\CLSID\{A007937E-38DE-45E3-BF37-D03862DA4C00}\InprocServer32] '' = '%ALLUSERSPROFILE%\Application Data\Soda PDF Desktop\Installation\Statistics.dll'
[<HKLM>\SOFTWARE\Classes\CLSID\{AD0796F7-CC0A-4353-A385-628CEAB59800}\InprocServer32] '' = '%ALLUSERSPROFILE%\Application Data\Soda PDF Desktop\Installation\Statistics.dll'
[<HKLM>\SOFTWARE\Classes\CLSID\{AE9FDA25-5E40-466B-81E2-53D1C1979B00}\InprocServer32] '' = '%ALLUSERSPROFILE%\Application Data\Soda PDF Desktop\Installation\Statistics.dll'
[<HKLM>\SOFTWARE\Classes\CLSID\{A3FC8865-E5C6-492D-8044-CBF135C63F00}\InprocServer32] '' = '%ALLUSERSPROFILE%\Application Data\Soda PDF Desktop\Installation\Statistics.dll'
[<HKLM>\SOFTWARE\Classes\CLSID\{AB1DBBC8-CAF8-4FEE-BF54-60E249E33900}\InprocServer32] '' = '%ALLUSERSPROFILE%\Application Data\Soda PDF Desktop\Installation\Statistics.dll'
[<HKLM>\SOFTWARE\Classes\CLSID\{AF152690-A6BF-4BAA-8E76-D52954B21200}\InprocServer32] '' = '%ALLUSERSPROFILE%\Application Data\Soda PDF Desktop\Installation\Statistics.dll'
[<HKLM>\SOFTWARE\Classes\CLSID\{ABC300F7-DC0D-4640-BFBF-F6458815C200}\InprocServer32] '' = '%ALLUSERSPROFILE%\Application Data\Soda PDF Desktop\Installation\Statistics.dll'
[<HKLM>\SOFTWARE\Classes\CLSID\{A74B4FE7-34F5-40E7-9D46-1617E39ACD00}\LocalServer32] '' = '"%ALLUSERSPROFILE%\Application Data\Soda PDF Desktop\Installation\Soda_PDF_Desktop_Installer.exe"'
[<HKLM>\SOFTWARE\Classes\CLSID\{AB6D2735-3392-47E1-83D6-6ED93BD71D00}\InprocServer32] '' = '%ALLUSERSPROFILE%\Application Data\Soda PDF Desktop\Installation\Statistics.dll'
[<HKLM>\SOFTWARE\Classes\CLSID\{09C4B9DD-73AD-459D-934A-25EC1D0B2300}\InprocServer32] '' = '%ALLUSERSPROFILE%\Application Data\Soda PDF Desktop\Installation\Statistics.dll'
[<HKLM>\SOFTWARE\Classes\CLSID\{A47BD9D5-25E5-46F9-A3C2-120BE6CA3100}\InprocServer32] '' = '%ALLUSERSPROFILE%\Application Data\Soda PDF Desktop\Installation\Statistics.dll'
[<HKLM>\SOFTWARE\Classes\CLSID\{E72F452B-0034-4DCB-8648-916976299600}\InprocServer32] '' = '%ALLUSERSPROFILE%\Application Data\Soda PDF Desktop\Installation\Statistics.dll'
[<HKLM>\SOFTWARE\Classes\CLSID\{AF68E6DC-0B1A-4169-9966-C06D8F2DE300}\InprocServer32] '' = '%ALLUSERSPROFILE%\Application Data\Soda PDF Desktop\Installation\Statistics.dll'
[<HKLM>\SOFTWARE\Classes\CLSID\{A1D7020E-4EB0-4E0D-8A8E-DAA3BB2F0300}\InprocServer32] '' = '%ALLUSERSPROFILE%\Application Data\Soda PDF Desktop\Installation\Statistics.dll'

Изменения в файловой системе:

Создает следующие файлы:

%ALLUSERSPROFILE%\Application Data\Soda PDF Desktop\Installation\Statistics.dll
%ALLUSERSPROFILE%\Application Data\Soda PDF Desktop\Installation\Soda_PDF_Desktop_Installer.exe

Сетевая активность:

Подключается к: