Trojan.KeyLogger.39077

Техническая информация

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\regsvr32.exe' atl.dll /s

Устанавливает процедуры перхвата сообщений

о нажатии клавиш клавиатуры:

Библиотека-обработчик для всех процессов: <Текущая директория>\cfgdll.dll

Изменения в файловой системе:

Создает следующие файлы:

%ProgramFiles%\blct_game_B\ybz.bmp
%ProgramFiles%\blct_game_B\yxtb.bmp
%ProgramFiles%\blct_game_B\x9.bmp
%ProgramFiles%\blct_game_B\x10.bmp
%ProgramFiles%\blct_game_B\z_9.bmp
%ProgramFiles%\blct_game_B\z_12.bmp
%ProgramFiles%\blct_game_B\z_13.bmp
%ProgramFiles%\blct_game_B\z_10.bmp
%ProgramFiles%\blct_game_B\z_11.bmp
%ProgramFiles%\blct_game_B\x8.bmp
%ProgramFiles%\blct_game_B\tong2.bmp
%ProgramFiles%\blct_game_B\tongdeng.bmp
%ProgramFiles%\blct_game_B\tong_4.bmp
%ProgramFiles%\blct_game_B\tong1.bmp
%ProgramFiles%\blct_game_B\x3.bmp
%ProgramFiles%\blct_game_B\x6.bmp
%ProgramFiles%\blct_game_B\x7.bmp
%ProgramFiles%\blct_game_B\x4.bmp
%ProgramFiles%\blct_game_B\x5.bmp
%ProgramFiles%\blct_game_B\z_14.bmp
%ProgramFiles%\blct_game_B\z_27.bmp
%ProgramFiles%\blct_game_B\z_28.bmp
%ProgramFiles%\blct_game_B\z_25.bmp
%ProgramFiles%\blct_game_B\z_26.bmp
%ProgramFiles%\blct_game_B\z_29.bmp
%ProgramFiles%\blct_game_B\z_32.bmp
%ProgramFiles%\blct_game_B\z_33.bmp
%ProgramFiles%\blct_game_B\z_30.bmp
%ProgramFiles%\blct_game_B\z_31.bmp
%ProgramFiles%\blct_game_B\z_24.bmp
%ProgramFiles%\blct_game_B\z_17.bmp
%ProgramFiles%\blct_game_B\z_18.bmp
%ProgramFiles%\blct_game_B\z_15.bmp
%ProgramFiles%\blct_game_B\z_16.bmp
%ProgramFiles%\blct_game_B\z_19.bmp
%ProgramFiles%\blct_game_B\z_22.bmp
%ProgramFiles%\blct_game_B\z_23.bmp
%ProgramFiles%\blct_game_B\z_20.bmp
%ProgramFiles%\blct_game_B\z_21.bmp
%ProgramFiles%\blct_game_B\j_12.bmp
%ProgramFiles%\blct_game_B\j_13.bmp
%ProgramFiles%\blct_game_B\j_10.bmp
%ProgramFiles%\blct_game_B\j_11.bmp
%ProgramFiles%\blct_game_B\j_14.bmp
%ProgramFiles%\blct_game_B\jbz.bmp
%ProgramFiles%\blct_game_B\jingong_1.bmp
%ProgramFiles%\blct_game_B\j_15.bmp
%ProgramFiles%\blct_game_B\j_16.bmp
%ProgramFiles%\blct_game_B\j_9.bmp
%ProgramFiles%\blct_game_B\j_2.bmp
%ProgramFiles%\blct_game_B\j_3.bmp
%ProgramFiles%\blct_game_B\huawei2.bmp
%ProgramFiles%\blct_game_B\j_1.bmp
%ProgramFiles%\blct_game_B\j_4.bmp
%ProgramFiles%\blct_game_B\j_7.bmp
%ProgramFiles%\blct_game_B\j_8.bmp
%ProgramFiles%\blct_game_B\j_5.bmp
%ProgramFiles%\blct_game_B\j_6.bmp
%ProgramFiles%\blct_game_B\jsz.bmp
%ProgramFiles%\blct_game_B\shan9.bmp
%ProgramFiles%\blct_game_B\shan9_2.bmp
%ProgramFiles%\blct_game_B\sbz.bmp
%ProgramFiles%\blct_game_B\shan8.bmp
%ProgramFiles%\blct_game_B\te1.bmp
%ProgramFiles%\blct_game_B\te2_2.bmp
%ProgramFiles%\blct_game_B\tong_3.bmp
%ProgramFiles%\blct_game_B\te1_1.bmp
%ProgramFiles%\blct_game_B\te2.bmp
%ProgramFiles%\blct_game_B\opguanggao.bmp
%ProgramFiles%\blct_game_B\man2.bmp
%ProgramFiles%\blct_game_B\Manhei.bmp
%ProgramFiles%\blct_game_B\man_1.bmp
%ProgramFiles%\blct_game_B\man1.bmp
%ProgramFiles%\blct_game_B\Mxun.bmp
%ProgramFiles%\blct_game_B\nvhuang1.bmp
%ProgramFiles%\blct_game_B\nvhuang2.bmp
%ProgramFiles%\blct_game_B\Notjz.bmp
%ProgramFiles%\blct_game_B\nvhuang_1.bmp
%ProgramFiles%\blct_game_B\ґуКШ»¤ХЯ.bmp
%ProgramFiles%\blct_game_B\Btwo_27.bmp
%ProgramFiles%\blct_game_B\C5.txt
%ProgramFiles%\blct_game_B\ґнОу_3.bmp
%ProgramFiles%\blct_game_B\Btwo_25.bmp
%ProgramFiles%\blct_game_B\shouhu2.bmp
%ProgramFiles%\blct_game_B\shouhu3.bmp
%ProgramFiles%\blct_game_B\Btwo_26.bmp
%ProgramFiles%\blct_game_B\shouhu1.bmp
%ProgramFiles%\blct_game_B\C4.txt
%ProgramFiles%\blct_game_B\z_2.bmp
%ProgramFiles%\blct_game_B\z_3.bmp
%ProgramFiles%\blct_game_B\ЅрЧКФґ.bmp
%ProgramFiles%\blct_game_B\z_1.bmp
%ProgramFiles%\blct_game_B\z_4.bmp
%ProgramFiles%\blct_game_B\z_7.bmp
%ProgramFiles%\blct_game_B\z_8.bmp
%ProgramFiles%\blct_game_B\z_5.bmp
%ProgramFiles%\blct_game_B\z_6.bmp
%ProgramFiles%\blct_game_B\shouhu4.bmp
%ProgramFiles%\blct_game_B\8±ѕ5ј¶№Вщ.ini
%ProgramFiles%\blct_game_B\9±ѕ5ј¶№Вщ.ini
%ProgramFiles%\blct_game_B\shan8b.bmp
%ProgramFiles%\blct_game_B\8±ѕ4ј¶№Вщ.ini
%ProgramFiles%\blct_game_B\Бщ±ѕЕдЦГ.ini
%ProgramFiles%\blct_game_B\10±ѕ11±ѕёЯР§ЕдЦГ.ini
%ProgramFiles%\blct_game_B\9±ѕёЯР§ЕдЦГ.ini
%ProgramFiles%\blct_game_B\ЖЯ±ѕЕдЦГ.ini
%ProgramFiles%\blct_game_B\Ое±ѕЕдЦГ.ini
%ProgramFiles%\blct_game_B\shan8a.bmp
%ProgramFiles%\blct_game_B\sbz2.bmp
%ProgramFiles%\blct_game_B\sbz3.bmp
%ProgramFiles%\blct_game_B\diaoxian_1.bmp
%ProgramFiles%\blct_game_B\BGJHY.bmp
%ProgramFiles%\blct_game_B\kpdenglu.bmp
%ProgramFiles%\blct_game_B\kpshan.bmp
%ProgramFiles%\blct_game_B\kpshan2.bmp
%ProgramFiles%\blct_game_B\xczaishuo.bmp
%ProgramFiles%\blct_game_B\kaopu2.bmp
%ProgramFiles%\blct_game_B\z_46.bmp
%ProgramFiles%\blct_game_B\z_47.bmp
%ProgramFiles%\blct_game_B\z_44.bmp
%ProgramFiles%\blct_game_B\z_45.bmp
%ProgramFiles%\blct_game_B\z_48.bmp
%ProgramFiles%\blct_game_B\z_51.bmp
%ProgramFiles%\blct_game_B\z_52.bmp
%ProgramFiles%\blct_game_B\z_49.bmp
%ProgramFiles%\blct_game_B\z_50.bmp
%ProgramFiles%\blct_game_B\z_43.bmp
%ProgramFiles%\blct_game_B\z_36.bmp
%ProgramFiles%\blct_game_B\z_37.bmp
%ProgramFiles%\blct_game_B\z_34.bmp
%ProgramFiles%\blct_game_B\z_35.bmp
%ProgramFiles%\blct_game_B\z_38.bmp
%ProgramFiles%\blct_game_B\z_41.bmp
%ProgramFiles%\blct_game_B\z_42.bmp
%ProgramFiles%\blct_game_B\z_39.bmp
%ProgramFiles%\blct_game_B\z_40.bmp
%ProgramFiles%\blct_game_B\z_53.bmp
%ProgramFiles%\blct_game_B\іЗЗЅ.bmp
%ProgramFiles%\blct_game_B\ґнОу_1.bmp
%ProgramFiles%\blct_game_B\°ґЕҐЛСЛч»ШУЄ.bmp
%ProgramFiles%\blct_game_B\°µєЪСµБ·УЄ.bmp
%ProgramFiles%\blct_game_B\ґнОу_2.bmp
%ProgramFiles%\blct_game_B\ЅбКшХЅ¶·.bmp
%ProgramFiles%\blct_game_B\ЅрЙэ.bmp
%ProgramFiles%\blct_game_B\·ЁКх№¤і§.bmp
%ProgramFiles%\blct_game_B\№јэЕ®»К.bmp
%ProgramFiles%\blct_game_B\°ґЕҐ·ЕЖъ.bmp
%ProgramFiles%\blct_game_B\z_56.bmp
%ProgramFiles%\blct_game_B\z_57.bmp
%ProgramFiles%\blct_game_B\z_54.bmp
%ProgramFiles%\blct_game_B\z_55.bmp
%ProgramFiles%\blct_game_B\zhuom.bmp
%ProgramFiles%\blct_game_B\Zyou.bmp
%ProgramFiles%\blct_game_B\zzcs.bmp
%ProgramFiles%\blct_game_B\zjin.bmp
%ProgramFiles%\blct_game_B\Zshui.bmp
%ProgramFiles%\blct_game_B\h6.bmp
%ProgramFiles%\blct_game_B\A2.txt
%ProgramFiles%\blct_game_B\A3.txt
%ProgramFiles%\blct_game_B\A0.txt
%ProgramFiles%\blct_game_B\A1.txt
%ProgramFiles%\blct_game_B\A4.txt
%ProgramFiles%\blct_game_B\A7.txt
%ProgramFiles%\blct_game_B\A8.txt
%ProgramFiles%\blct_game_B\A5.txt
%ProgramFiles%\blct_game_B\A6.txt
%ProgramFiles%\blct_game_B\УРИЛВр.bmp
%ProgramFiles%\blct_game_B\Л®Йэ.bmp
%ProgramFiles%\blct_game_B\Л®ЧКФґ.bmp
%ProgramFiles%\blct_game_B\И·¶Ё.bmp
%ProgramFiles%\blct_game_B\Йэј¶ЦР.bmp
%ProgramFiles%\blct_game_B\ЛСЛч¶ФКЦ.bmp
%ProgramFiles%\blct_game_B\Т°ВщИЛНх.bmp
%ProgramFiles%\blct_game_B\УНЙэ.bmp
%ProgramFiles%\blct_game_B\СµБ·ѕь¶У.bmp
%ProgramFiles%\blct_game_B\СµБ·УЄ.bmp
%ProgramFiles%\blct_game_B\C1.txt
%ProgramFiles%\blct_game_B\ben9.bmp
%ProgramFiles%\blct_game_B\ben10.bmp
%ProgramFiles%\blct_game_B\ben7.bmp
%ProgramFiles%\blct_game_B\ben8.bmp
%ProgramFiles%\blct_game_B\ben11.bmp
%ProgramFiles%\blct_game_B\ben14.bmp
%ProgramFiles%\blct_game_B\ben15.bmp
%ProgramFiles%\blct_game_B\ben12.bmp
%ProgramFiles%\blct_game_B\ben13.bmp
%ProgramFiles%\blct_game_B\ben6.bmp
%ProgramFiles%\blct_game_B\dm.dll
%ProgramFiles%\blct_game_B\RegDll.dll
%ProgramFiles%\blct_game_B\C2.txt
%ProgramFiles%\blct_game_B\C3.txt
%ProgramFiles%\blct_game_B\Anniujuan.bmp
%ProgramFiles%\blct_game_B\baidu2.bmp
%ProgramFiles%\blct_game_B\ben5.bmp
%ProgramFiles%\blct_game_B\Anniupai.bmp
%ProgramFiles%\blct_game_B\baidenglu.bmp
%TEMP%\BackGround.bmp
<Текущая директория>\cfgdll.dll
<Текущая директория>\plugin\TSAJJL.DLL
%TEMP%\mymacro.zip
<Текущая директория>\ShieldModule.dat
<Текущая директория>\<Имя файла>.ini
%APPDATA%\qmacro\shield\SD000.dat
%APPDATA%\mymacro\qdisp.dll
%TEMP%\6313.tmp
<Текущая директория>\plugin\SYS.DLL
%TEMP%\mac2.tmp
%TEMP%\plugin.zip
%TEMP%\mymacro_errinfo.exe
%TEMP%\mac1.tmp
<Текущая директория>\plugin\SYSEX.DLL
<Текущая директория>\plugin\REGDLL.DLL
<Текущая директория>\plugin\FILE.DLL
<Текущая директория>\plugin\MSG.DLL
<Текущая директория>\plugin\WINDOW.DLL
%APPDATA%\qmacro\shield\SD001.dat
<Текущая директория>\radiobox_disabled_checked.ico
<Текущая директория>\radiobox_disabled_unchecked.ico
<Текущая директория>\radiobox_checked.ico
<Текущая директория>\radiobox_unchecked.ico
<Текущая директория>\timer_icon.ico
%WINDIR%\Temp\SpeedDLL.dll
<Текущая директория>\plugin\SYSEX.ini
%TEMP%\~DFCD8C.tmp
<Текущая директория>\plugin\FILE.ini
<Текущая директория>\browsebox_dir.ico
%APPDATA%\qmacro\shield\SD004.dat
%APPDATA%\qmacro\shield\Shield.ini
%APPDATA%\qmacro\shield\SD002.dat
%APPDATA%\qmacro\shield\SD003.dat
<Текущая директория>\checkbox_checked.ico
<Текущая директория>\checkbox_disabled_unchecked.ico
<Текущая директория>\browsebox_file.ico
<Текущая директория>\checkbox_unchecked.ico
<Текущая директория>\checkbox_disabled_checked.ico
%ProgramFiles%\blct_game_B\Btwo_24.bmp
%ProgramFiles%\blct_game_B\bzqd.bmp
%ProgramFiles%\blct_game_B\Btwo_22.bmp
%ProgramFiles%\blct_game_B\Btwo_23.bmp
%ProgramFiles%\blct_game_B\dingwei.bmp
%ProgramFiles%\blct_game_B\f1.bmp
%ProgramFiles%\blct_game_B\f2.bmp
%ProgramFiles%\blct_game_B\djs.bmp
%ProgramFiles%\blct_game_B\dklt.bmp
%ProgramFiles%\blct_game_B\Btwo_21.bmp
%ProgramFiles%\blct_game_B\Btwo_14.bmp
%ProgramFiles%\blct_game_B\Btwo_15.bmp
%ProgramFiles%\blct_game_B\Btwo_12.bmp
%ProgramFiles%\blct_game_B\Btwo_13.bmp
%ProgramFiles%\blct_game_B\Btwo_16.bmp
%ProgramFiles%\blct_game_B\Btwo_19.bmp
%ProgramFiles%\blct_game_B\Btwo_20.bmp
%ProgramFiles%\blct_game_B\Btwo_17.bmp
%ProgramFiles%\blct_game_B\Btwo_18.bmp
%ProgramFiles%\blct_game_B\f3.bmp
%ProgramFiles%\blct_game_B\guanggao7.bmp
%ProgramFiles%\blct_game_B\guotu1.bmp
%ProgramFiles%\blct_game_B\guanggao4.bmp
%ProgramFiles%\blct_game_B\guanggao5.bmp
%ProgramFiles%\blct_game_B\h1.bmp
%ProgramFiles%\blct_game_B\h4.bmp
%ProgramFiles%\blct_game_B\h5.bmp
%ProgramFiles%\blct_game_B\h2.bmp
%ProgramFiles%\blct_game_B\h3.bmp
%ProgramFiles%\blct_game_B\guanggao3.bmp
%ProgramFiles%\blct_game_B\fs1.bmp
%ProgramFiles%\blct_game_B\fs2.bmp
%ProgramFiles%\blct_game_B\f4.bmp
%ProgramFiles%\blct_game_B\f5.bmp
%ProgramFiles%\blct_game_B\fs3.bmp
%ProgramFiles%\blct_game_B\gshan9.bmp
%ProgramFiles%\blct_game_B\guanggao2.bmp
%ProgramFiles%\blct_game_B\fs4.bmp
%ProgramFiles%\blct_game_B\gblt.bmp
%ProgramFiles%\blct_game_B\Bone_9.bmp
%ProgramFiles%\blct_game_B\Bone_10.bmp
%ProgramFiles%\blct_game_B\Bone_7.bmp
%ProgramFiles%\blct_game_B\Bone_8.bmp
%ProgramFiles%\blct_game_B\Bone_11.bmp
%ProgramFiles%\blct_game_B\Bone_14.bmp
%ProgramFiles%\blct_game_B\Bone_15.bmp
%ProgramFiles%\blct_game_B\Bone_12.bmp
%ProgramFiles%\blct_game_B\Bone_13.bmp
%ProgramFiles%\blct_game_B\Bone_6.bmp
%ProgramFiles%\blct_game_B\ben18.bmp
%ProgramFiles%\blct_game_B\BGJ.bmp
%ProgramFiles%\blct_game_B\ben16.bmp
%ProgramFiles%\blct_game_B\ben17.bmp
%ProgramFiles%\blct_game_B\Bone_1.bmp
%ProgramFiles%\blct_game_B\Bone_4.bmp
%ProgramFiles%\blct_game_B\Bone_5.bmp
%ProgramFiles%\blct_game_B\Bone_2.bmp
%ProgramFiles%\blct_game_B\Bone_3.bmp
%ProgramFiles%\blct_game_B\Bone_16.bmp
%ProgramFiles%\blct_game_B\Btwo_5.bmp
%ProgramFiles%\blct_game_B\Btwo_6.bmp
%ProgramFiles%\blct_game_B\Btwo_3.bmp
%ProgramFiles%\blct_game_B\Btwo_4.bmp
%ProgramFiles%\blct_game_B\Btwo_7.bmp
%ProgramFiles%\blct_game_B\Btwo_10.bmp
%ProgramFiles%\blct_game_B\Btwo_11.bmp
%ProgramFiles%\blct_game_B\Btwo_8.bmp
%ProgramFiles%\blct_game_B\Btwo_9.bmp
%ProgramFiles%\blct_game_B\Btwo_2.bmp
%ProgramFiles%\blct_game_B\Bone_19.bmp
%ProgramFiles%\blct_game_B\Bone_20.bmp
%ProgramFiles%\blct_game_B\Bone_17.bmp
%ProgramFiles%\blct_game_B\Bone_18.bmp
%ProgramFiles%\blct_game_B\Bone_21.bmp
%ProgramFiles%\blct_game_B\Bone_24.bmp
%ProgramFiles%\blct_game_B\Btwo_1.bmp
%ProgramFiles%\blct_game_B\Bone_22.bmp
%ProgramFiles%\blct_game_B\Bone_23.bmp

Удаляет следующие файлы:

<Текущая директория>\radiobox_checked.ico
<Текущая директория>\browsebox_dir.ico
<Текущая директория>\browsebox_file.ico
<Текущая директория>\radiobox_unchecked.ico
<Текущая директория>\timer_icon.ico
<Текущая директория>\radiobox_disabled_unchecked.ico
<Текущая директория>\radiobox_disabled_checked.ico
<Текущая директория>\ShieldModule.dat
%TEMP%\mymacro.zip
%TEMP%\plugin.zip
<Текущая директория>\checkbox_checked.ico
<Текущая директория>\checkbox_disabled_unchecked.ico
<Текущая директория>\checkbox_disabled_checked.ico
<Текущая директория>\checkbox_unchecked.ico

Перемещает следующие файлы:

%TEMP%\BackGround.bmp в %TEMP%\b50background.bmp

Сетевая активность:

Подключается к:

'c.###huoa.com':80

TCP:

Запросы HTTP GET:

http://c.###huoa.com/c2/MymacroidSalesUrl.aspx?my#######################
http://c.###huoa.com/banner/Q10624.htm

UDP:

DNS ASK c.###huoa.com

Другое:

Ищет следующие окна:

ClassName: 'Shell_TrayWnd' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней