Trojan.DownLoader26.54044

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Windows Session' = '<SYSTEM32>\WScript.exe %WINDIR%\SID-1998166001.vbe //T:00'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'Windows Session' = '<SYSTEM32>\WScript.exe %WINDIR%\SID-1998166001.vbe //T:00'

Изменения в файловой системе:

Создает следующие файлы:

C:\SoKeen\RegAndRun.bat
%WINDIR%\ScriptByWOW64.vbs
%WINDIR%\ScriptEZ.dll
%WINDIR%\ScriptEZ.dll.manifest
%WINDIR%\SoKeen - Installation.pdf
%WINDIR%\SoKeenConfigurator.exe
%WINDIR%\SoKeenConfigurator.exe.manifest
%WINDIR%\SoKeenID_Finder.vbe
%WINDIR%\TokenAlerter.vbe
%TEMP%\bcc.vbe
%WINDIR%\wizapi32.dll
%WINDIR%\wscript.exe.manifest
<SYSTEM32>\ScriptEZ.dll
<SYSTEM32>\Wizapi32.dll
%WINDIR%\SID-1998166001.vbe
%TEMP%\b7c.vbe
%TEMP%\_start.bat
%WINDIR%\RegAndRun.bat
%WINDIR%\SoKeen_Trial.vbe
%WINDIR%\ReadMe.htm
C:\SoKeen\ReadMe.htm
C:\SoKeen\ScriptByWOW64.vbs
C:\SoKeen\ScriptEZ.dll
C:\SoKeen\SoKeenConfigurator.exe
C:\SoKeen\SoKeenID_Finder.vbe
C:\SoKeen\SoKeen_Trial.vbe
C:\SoKeen\TokenAlerter.vbe
C:\SoKeen\wizapi32.dll
C:\SoKeen\SoKeen - Installation.pdf
%WINDIR%\DXAnimatedGIF.ocx
C:\SoKeen\Globe.gif
C:\SoKeen\DXAnimatedGIF.ocx
C:\SoKeen\wscript.exe.manifest
C:\SoKeen\cscript.exe.manifest
C:\SoKeen\ScriptEZ.dll.manifest
C:\SoKeen\SoKeenConfigurator.exe.manifest
%WINDIR%\cscript.exe.manifest
%WINDIR%\Globe.gif
%HOMEPATH%\

Присваивает атрибут 'скрытый' для следующих файлов:

%WINDIR%\SID-1998166001.vbe

Удаляет следующие файлы:

%TEMP%\_start.bat
%TEMP%\b7c.vbe

Подменяет следующие файлы:

%TEMP%\_start.bat

Сетевая активность:

Подключается к:

'74.##5.232.51':80
'so##en.net':80

TCP:

Запросы HTTP GET:

http://sites.google.com/site/scriptezapi/home/new_route.xml via 74.##5.232.51

Запросы HTTP POST:

http://www.so##en.net/sokeen/SoKeen_requester.php via so##en.net

UDP:

DNS ASK sites.google.com
DNS ASK www.so##en.net

Другое:

Ищет следующие окна:

ClassName: 'EDIT' WindowName: ''
ClassName: '#32770' WindowName: 'CScript.exe - Application Error'
ClassName: '#32770' WindowName: 'Microsoft ? Windows Based Script Host'
ClassName: '#32770' WindowName: 'Microsoft ® Windows Based Script Host'
ClassName: '#32770' WindowName: 'WScript.exe - Erreur d?application'
ClassName: '#32770' WindowName: 'WScript.exe - Erreur d’application'
ClassName: '#32770' WindowName: 'CScript.exe - Erreur d'
ClassName: '#32770' WindowName: 'CScript.exe - Erreur dpplication'
ClassName: '#32770' WindowName: 'CScript.exe - Erreur d?application'
ClassName: '#32770' WindowName: 'ServerDoc.exe - Erreur d’application'
ClassName: '#32770' WindowName: 'Microsoft Visual C++ Runtime Library'
ClassName: '#32770' WindowName: 'ServerDocMobile.exe - Application Error'
ClassName: '#32770' WindowName: 'ServerDocMobile.exe - Erreur d'
ClassName: '#32770' WindowName: 'ServerDocMobile.exe - Erreur dpplication'
ClassName: '#32770' WindowName: 'CScript.exe - Erreur d’application'
ClassName: '#32770' WindowName: 'ServerDoc.exe - Erreur d?application'
ClassName: '#32770' WindowName: 'WScript.exe - Application Error'
ClassName: '#32770' WindowName: 'WScript.exe - Erreur dpplication'
ClassName: '#32770' WindowName: 'WScript.exe - Erreur d'
ClassName: '#32770' WindowName: ' Alerter'
ClassName: '#32770' WindowName: 'ServerDoc'
ClassName: '#32770' WindowName: 'ServerDoc: ServerDoc.exe - Erreur d?application'
ClassName: '#32770' WindowName: 'ServerDoc: ServerDoc.exe - Erreur d’application'
ClassName: '#32770' WindowName: 'ServerDoc.exe - Application Error'
ClassName: '#32770' WindowName: 'ServerDoc: ServerDoc.exe - Application Error'
ClassName: '#32770' WindowName: '?Alerter'
ClassName: '#32770' WindowName: 'Simple and Smart TCP/IP Server'
ClassName: '#32770' WindowName: 'ServerDoc.exe - Erreur dpplication'
ClassName: '#32770' WindowName: 'ServerDoc: ServerDoc.exe - Erreur d'
ClassName: '#32770' WindowName: 'ServerDoc: ServerDoc.exe - Erreur dpplication'
ClassName: '#32770' WindowName: 'eDashBoardServer'
ClassName: '#32770' WindowName: 'eDashBoardServer.exe - Application Error'
ClassName: '#32770' WindowName: 'eDashBoardServer: eDashBoardServer.exe - Application Error'
ClassName: '#32770' WindowName: 'ServerDoc.exe - Erreur d'
ClassName: '#32770' WindowName: 'ServerDocMobile.exe - Erreur d?application'
ClassName: '#32770' WindowName: 'ServerDocMobile.exe - Erreur d’application'

Создает и запускает на исполнение:

'<SYSTEM32>\wscript.exe' "%WINDIR%\SoKeen_Trial.vbe" //T:00
'%WINDIR%\SoKeenConfigurator.exe'
'<SYSTEM32>\wscript.exe' "%WINDIR%\TokenAlerter.vbe" //T:00
'<SYSTEM32>\wscript.exe' "%WINDIR%\SID-1998166001.vbe" //T:00
'<SYSTEM32>\cscript.exe' //T:00 "%TEMP%\b7c.vbe" 2940 "<SYSTEM32>\WScript.exe" "%WINDIR%\TokenAlerter.vbe" //T:00

Запускает на исполнение: