Trojan.AVKill.62970

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'UserInit' = '<SYSTEM32>\userinit.exe,%HOMEPATH%\My Documents\MSDCSC\msdcsc.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'MicroUpdate' = '%HOMEPATH%\My Documents\MSDCSC\msdcsc.exe'

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\attrib.exe' "%HOMEPATH%\Local Settings\Temp" +s +h
'<SYSTEM32>\attrib.exe' "%TEMP%\8969458.dog54okhVia.exe" +s +h
'<SYSTEM32>\cmd.exe' /k attrib "%HOMEPATH%\Local Settings\Temp" +s +h
'%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe'
'%HOMEPATH%\My Documents\MSDCSC\msdcsc.exe'
'<SYSTEM32>\notepad.exe'
'<SYSTEM32>\cmd.exe' /k attrib "%TEMP%\8969458.dog54okhVia.exe" +s +h
'%TEMP%\8969458.dog54okhVia.exe'
'%TEMP%\2220670.auhjn0piVia.exe'
'%WINDIR%\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe' /logtoconsole=false /logfile= /u "<Полный путь к файлу>"
'<SYSTEM32>\cmd.exe' /c ""<LS_APPDATA>\melt.bat" "
'<LS_APPDATA>\AudioHD.exe'
'%TEMP%\821589.ju2d5envVia.exe'

Внедряет код в

следующие системные процессы:

%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe

следующие пользовательские процессы:

821589.ju2d5envVia.exe

Изменения в файловой системе:

Создает следующие файлы:

%ProgramFiles%\GUM17.tmp\goopdateres_iw.dll
%ProgramFiles%\GUM17.tmp\goopdateres_ja.dll
%ProgramFiles%\GUM17.tmp\goopdateres_it.dll
%ProgramFiles%\GUM17.tmp\goopdateres_id.dll
%ProgramFiles%\GUM17.tmp\goopdateres_is.dll
%ProgramFiles%\GUM17.tmp\goopdateres_kn.dll
%ProgramFiles%\GUM17.tmp\goopdateres_ml.dll
%ProgramFiles%\GUM17.tmp\goopdateres_mr.dll
%ProgramFiles%\GUM17.tmp\goopdateres_lv.dll
%ProgramFiles%\GUM17.tmp\goopdateres_ko.dll
%ProgramFiles%\GUM17.tmp\goopdateres_lt.dll
%ProgramFiles%\GUM17.tmp\goopdateres_hu.dll
%ProgramFiles%\GUM17.tmp\goopdateres_et.dll
%ProgramFiles%\GUM17.tmp\goopdateres_fa.dll
%ProgramFiles%\GUM17.tmp\goopdateres_es-419.dll
%ProgramFiles%\GUM17.tmp\goopdateres_en-GB.dll
%ProgramFiles%\GUM17.tmp\goopdateres_es.dll
%ProgramFiles%\GUM17.tmp\goopdateres_fi.dll
%ProgramFiles%\GUM17.tmp\goopdateres_hi.dll
%ProgramFiles%\GUM17.tmp\goopdateres_hr.dll
%ProgramFiles%\GUM17.tmp\goopdateres_gu.dll
%ProgramFiles%\GUM17.tmp\goopdateres_fil.dll
%ProgramFiles%\GUM17.tmp\goopdateres_fr.dll
%ProgramFiles%\GUM17.tmp\goopdateres_th.dll
%ProgramFiles%\GUM17.tmp\goopdateres_tr.dll
%ProgramFiles%\GUM17.tmp\goopdateres_te.dll
%ProgramFiles%\GUM17.tmp\goopdateres_sw.dll
%ProgramFiles%\GUM17.tmp\goopdateres_ta.dll
%ProgramFiles%\GUM17.tmp\goopdateres_uk.dll
%ProgramFiles%\GUM17.tmp\goopdateres_zh-TW.dll
%ProgramFiles%\GUM17.tmp\GoogleUpdateSetup.exe
%ProgramFiles%\GUM17.tmp\goopdateres_zh-CN.dll
%ProgramFiles%\GUM17.tmp\goopdateres_ur.dll
%ProgramFiles%\GUM17.tmp\goopdateres_vi.dll
%ProgramFiles%\GUM17.tmp\goopdateres_sv.dll
%ProgramFiles%\GUM17.tmp\goopdateres_pl.dll
%ProgramFiles%\GUM17.tmp\goopdateres_pt-BR.dll
%ProgramFiles%\GUM17.tmp\goopdateres_no.dll
%ProgramFiles%\GUM17.tmp\goopdateres_ms.dll
%ProgramFiles%\GUM17.tmp\goopdateres_nl.dll
%ProgramFiles%\GUM17.tmp\goopdateres_pt-PT.dll
%ProgramFiles%\GUM17.tmp\goopdateres_sl.dll
%ProgramFiles%\GUM17.tmp\goopdateres_sr.dll
%ProgramFiles%\GUM17.tmp\goopdateres_sk.dll
%ProgramFiles%\GUM17.tmp\goopdateres_ro.dll
%ProgramFiles%\GUM17.tmp\goopdateres_ru.dll
%ProgramFiles%\GUM17.tmp\goopdateres_en.dll
%TEMP%\2220670.auhjn0piVia.exe
%TEMP%\8969458.dog54okhVia.exe
%TEMP%\Cab15.tmp
%TEMP%\Cab11.tmp
%TEMP%\Cab13.tmp
%TEMP%\821589.ju2d5envVia.exe
%ProgramFiles%\GUT18.tmp
%ProgramFiles%\GUM17.tmp\GoogleUpdate.exe
<LS_APPDATA>\melt.bat
%HOMEPATH%\My Documents\MSDCSC\msdcsc.exe
<LS_APPDATA>\AudioHD.exe
%TEMP%\CabF.tmp
%APPDATA%\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
%TEMP%\Cab1.tmp
%APPDATA%\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
%APPDATA%\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004
%APPDATA%\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004
%TEMP%\Cab3.tmp
%TEMP%\CabB.tmp
%TEMP%\CabD.tmp
%TEMP%\Cab9.tmp
%TEMP%\Cab5.tmp
%TEMP%\Cab7.tmp
%ProgramFiles%\GUM17.tmp\goopdateres_ar.dll
%ProgramFiles%\GUM17.tmp\goopdateres_bg.dll
%ProgramFiles%\GUM17.tmp\goopdateres_am.dll
%ProgramFiles%\GUM17.tmp\GoogleCrashHandler64.exe
%ProgramFiles%\GUM17.tmp\GoogleUpdateCore.exe
%ProgramFiles%\GUM17.tmp\goopdateres_bn.dll
%ProgramFiles%\GUM17.tmp\goopdateres_de.dll
%ProgramFiles%\GUM17.tmp\goopdateres_el.dll
%ProgramFiles%\GUM17.tmp\goopdateres_da.dll
%ProgramFiles%\GUM17.tmp\goopdateres_ca.dll
%ProgramFiles%\GUM17.tmp\goopdateres_cs.dll
%ProgramFiles%\GUM17.tmp\psuser_64.dll
%ProgramFiles%\GUM17.tmp\GoogleUpdateHelper.msi
%ProgramFiles%\GUM17.tmp\GoogleUpdateBroker.exe
%ProgramFiles%\GUM17.tmp\npGoogleUpdate3.dll
%ProgramFiles%\GUM17.tmp\GoogleCrashHandler.exe
%ProgramFiles%\GUM17.tmp\goopdate.dll
%ProgramFiles%\GUM17.tmp\GoogleUpdateOnDemand.exe
%ProgramFiles%\GUM17.tmp\psmachine_64.dll
%ProgramFiles%\GUM17.tmp\psuser.dll
%ProgramFiles%\GUM17.tmp\psmachine.dll
%ProgramFiles%\GUM17.tmp\GoogleUpdateComRegisterShell64.exe
%ProgramFiles%\GUM17.tmp\GoogleUpdateWebPlugin.exe

Удаляет следующие файлы:

%TEMP%\Cab13.tmp
%TEMP%\Cab11.tmp
%TEMP%\CabF.tmp
%TEMP%\8969458.dog54okhVia.exe
%TEMP%\2220670.auhjn0piVia.exe
%TEMP%\Cab15.tmp
%TEMP%\CabD.tmp
%TEMP%\Cab5.tmp
%TEMP%\Cab3.tmp
%TEMP%\Cab1.tmp
%TEMP%\CabB.tmp
%TEMP%\Cab9.tmp
%TEMP%\Cab7.tmp

Сетевая активность:

Подключается к:

'localhost':1604
'pe#####resol.ddns.net':1604
'se####.globalsign.com':80
'wp#d':80
'www.download.windowsupdate.com':80

TCP:

Запросы HTTP GET:

http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
http://se####.globalsign.com/cacert/gscodesignsha2g2.crt
http://11#.#11.111.1/wpad.dat via wp#d
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt

UDP: