Trojan.KillProc.12652

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Classes\MultiFileDownloader.Torrent\shell\open\command] '' = '"%PROGRAM_FILES%\Multi File Downloader\MultiFileDownloader.exe" "%1"'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Multi File Downloader' = '%PROGRAM_FILES%\Multi File Downloader\MultiFileDownloader.exe'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet002\Services\ffceaabcbdbadecbdf] 'ImagePath' = '%WINDIR%\ffceaabcbdbadecbdf.exe /s'
[<HKLM>\SYSTEM\ControlSet002\Services\ffceaabcbdbadecbdf] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\ffceaabcbdbadecbdf] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\ffceaabcbdbadecbdf] 'ImagePath' = '%WINDIR%\ffceaabcbdbadecbdf.exe /s'

Вредоносные функции:

Создает и запускает на исполнение:

%PROGRAM_FILES%\Multi File Downloader\MultiFileDownloader.exe
%WINDIR%\ffceaabcbdbadecbdf.exe /s

Запускает на исполнение:

<SYSTEM32>\cmd.exe /c "%TEMP%\ee960cdfde57e926dba247ba462bb5b1.bat"
<SYSTEM32>\logonui.exe /status /shutdown
<SYSTEM32>\taskkill.exe /F /IM MultiFileDownloader.exe
<SYSTEM32>\cmd.exe /c "%TEMP%\96cfae6c1f24e5307accdb73af5d0bea.bat"

Внедряет код в

следующие системные процессы:

<SYSTEM32>\winlogon.exe

Пытается завершить работу операционной системы Windows.

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\Multi File Downloader\i\is-O87BI.tmp
%PROGRAM_FILES%\Multi File Downloader\i\is-221P1.tmp
%PROGRAM_FILES%\Multi File Downloader\i\is-EPDA5.tmp
%PROGRAM_FILES%\Multi File Downloader\i\is-IRV6H.tmp
%PROGRAM_FILES%\Multi File Downloader\i\is-6BF3P.tmp
%PROGRAM_FILES%\Multi File Downloader\i\is-NQI52.tmp
%PROGRAM_FILES%\Multi File Downloader\i\is-7E61K.tmp
%PROGRAM_FILES%\Multi File Downloader\i\is-1F46P.tmp
%PROGRAM_FILES%\Multi File Downloader\i\is-2HAHT.tmp
%PROGRAM_FILES%\Multi File Downloader\i\is-C562L.tmp
%PROGRAM_FILES%\Multi File Downloader\i\is-JASFC.tmp
%PROGRAM_FILES%\Multi File Downloader\i\is-PCBQJ.tmp
%PROGRAM_FILES%\Multi File Downloader\i\is-F09R6.tmp
%PROGRAM_FILES%\Multi File Downloader\i\is-JSF45.tmp
%PROGRAM_FILES%\Multi File Downloader\i\is-9K13M.tmp
%PROGRAM_FILES%\Multi File Downloader\i\is-ID7B2.tmp
%PROGRAM_FILES%\Multi File Downloader\i\is-D57SP.tmp
%TEMP%\tor6.tmp
%TEMP%\tor7.tmp
%TEMP%\tor4.tmp
%TEMP%\tor5.tmp
%APPDATA%\Multi File Downloader\tor8.tmp
%TEMP%\tor9.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\ec121fd33159f2e785378861b4e49f3f6499b575[1]
%TEMP%\tor8.tmp
%PROGRAM_FILES%\Multi File Downloader\unins000.dat
%APPDATA%\Multi File Downloader\Wmid.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Multi File Downloader\Multi File Downloader.lnk
%ALLUSERSPROFILE%\Desktop\Multi File Downloader.lnk
%TEMP%\tor1.tmp
%TEMP%\tor3.tmp
%ALLUSERSPROFILE%\Application Data\boost_interprocess\0C741B014D7FCC01\34B5AF57-B590-4D39-8030-0960FFC6CF7C
%PROGRAM_FILES%\Multi File Downloader\i\is-H9TKP.tmp
%TEMP%\ee960cdfde57e926dba247ba462bb5b1.bat
%APPDATA%\Multi File Downloader\mer.txt
%TEMP%\96cfae6c1f24e5307accdb73af5d0bea.bat
<SYSTEM32>\ffceaabcbdbadecbdf.dll
%PROGRAM_FILES%\Multi File Downloader\is-VVAUN.tmp
%PROGRAM_FILES%\Multi File Downloader\i\is-FP809.tmp
%PROGRAM_FILES%\Multi File Downloader\is-068MR.tmp
%APPDATA%\Multi File Downloader\quickstart.xml
%TEMP%\is-63OMV.tmp\677bc3c045e86ad098004755a289da7a.tmp
%TEMP%\is-KCI43.tmp\_isetup\_shfoldr.dll
%TEMP%\2ca17c95e1f9238d9b39fb2e82bf771c
%TEMP%\677bc3c045e86ad098004755a289da7a.exe
%TEMP%\a5389ccca22444ae7f1f0b7268262c79.exe
%WINDIR%\ffceaabcbdbadecbdf.exe
%PROGRAM_FILES%\Multi File Downloader\is-JC2HT.tmp
%TEMP%\is-KCI43.tmp\is-2C8L5.tmp
%PROGRAM_FILES%\Multi File Downloader\i\is-3BQBA.tmp
%PROGRAM_FILES%\Multi File Downloader\i\is-F217N.tmp
%PROGRAM_FILES%\Multi File Downloader\i\is-BFRLH.tmp
%PROGRAM_FILES%\Multi File Downloader\i\is-O3E90.tmp
%PROGRAM_FILES%\Multi File Downloader\i\is-5E86D.tmp
%PROGRAM_FILES%\Multi File Downloader\i\is-473VD.tmp
%PROGRAM_FILES%\Multi File Downloader\i\is-6I62T.tmp
%PROGRAM_FILES%\Multi File Downloader\i\is-FQPUQ.tmp
%PROGRAM_FILES%\Multi File Downloader\i\is-MQS2H.tmp
%PROGRAM_FILES%\Multi File Downloader\i\is-DIVFT.tmp
%PROGRAM_FILES%\Multi File Downloader\i\is-LJR0F.tmp
%PROGRAM_FILES%\Multi File Downloader\i\is-K93IO.tmp
%PROGRAM_FILES%\Multi File Downloader\i\is-LLT98.tmp
%PROGRAM_FILES%\Multi File Downloader\i\is-KS15Q.tmp
%PROGRAM_FILES%\Multi File Downloader\i\is-BV74V.tmp
%PROGRAM_FILES%\Multi File Downloader\i\is-3SUVI.tmp
%PROGRAM_FILES%\Multi File Downloader\i\is-KMUO7.tmp