Trojan.DownLoader29.45790

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'run' = ''
[<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = ''
[<HKLM>\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon] 'shell' = 'Explorer.exe '
[<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'run' = '%WINDIR%\jMhkD\TJZPFV.exe'
[<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%WINDIR%\jMhkD\TJZPFV.exe'
[<HKLM>\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon] 'shell' = 'Explorer.exe %WINDIR%\jMhkD\TJZPFV.exe'

Создает или изменяет следующие файлы

<SYSTEM32>\tasks\microsoft\windows\upnp\services

Создает следующие сервисы

[<HKLM>\System\CurrentControlSet\Services\Application Layre Gateway Saervice] 'ImagePath' = 'cmd.exe /c start %WINDIR%\boy.exe'
[<HKLM>\System\CurrentControlSet\Services\PolicyAgent] 'Start' = '00000002'

Изменения в файловой системе

Создает следующие файлы

%WINDIR%\jmhkd\tscl.html
%WINDIR%\jmhkd\libiconv-2.dll
%WINDIR%\jmhkd\libxml2.dll
%WINDIR%\jmhkd\pcla-0.dll
%WINDIR%\jmhkd\pcre-0.dll
%WINDIR%\jmhkd\pcrecpp-0.dll
%WINDIR%\jmhkd\pcreposix-0.dll
%WINDIR%\jmhkd\posh.dll
%WINDIR%\jmhkd\posh-0.dll
%WINDIR%\jmhkd\riar.dll
%WINDIR%\jmhkd\riar-2.dll
%WINDIR%\jmhkd\ssleay32.dll
%WINDIR%\jmhkd\tibe.dll
%WINDIR%\jmhkd\tibe-1.dll
%WINDIR%\jmhkd\tibe-2.dll
%WINDIR%\jmhkd\trch.dll
%WINDIR%\jmhkd\trch-0.dll
%WINDIR%\jmhkd\trch-1.dll
%WINDIR%\jmhkd\trfo.dll
%WINDIR%\jmhkd\trfo-0.dll
%WINDIR%\jmhkd\trfo-2.dll
%WINDIR%\jmhkd\tucl.dll
%WINDIR%\jmhkd\tucl-1.dll
%WINDIR%\jmhkd\ucl.dll
%WINDIR%\jmhkd\xdvl-0.dll
%WINDIR%\jmhkd\zibe.dll
%WINDIR%\jmhkd\zlib1.dll
%WINDIR%\jmhkd\tff
%WINDIR%\jmhkd\libeay32.dll
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\caasbycl\ip_3322_net[1]
%WINDIR%\jmhkd\libcurl.dll
%WINDIR%\jmhkd\exma-1.dll
%WINDIR%\ime\tps.exe
%WINDIR%\boy.exe
%WINDIR%\jmhkd\tjzpfv.exe
%WINDIR%\end.bat
%WINDIR%\jmhkd\qdx.bat
%WINDIR%\jmhkd\chrome..exe
%WINDIR%\jmhkd\chrome..xml
%WINDIR%\jmhkd\chrome..fb
%WINDIR%\jmhkd\cstr.exe
%WINDIR%\jmhkd\cstr.fb
%WINDIR%\jmhkd\cstr.xml
%WINDIR%\jmhkd\adfw.dll
%WINDIR%\jmhkd\adfw-2.dll
%WINDIR%\jmhkd\cnli-0.dll
%WINDIR%\jmhkd\cnli-1.dll
%WINDIR%\jmhkd\coli-0.dll
%WINDIR%\jmhkd\crli-0.dll
%WINDIR%\jmhkd\dmgd-1.dll
%WINDIR%\jmhkd\dmgd-4.dll
%WINDIR%\jmhkd\esco-0.dll
%WINDIR%\jmhkd\etch-0.dll
%WINDIR%\jmhkd\etchcore-0.x64.dll
%WINDIR%\jmhkd\etchcore-0.x86.dll
%WINDIR%\jmhkd\eteb-2.dll
%WINDIR%\jmhkd\etebcore-2.x64.dll
%WINDIR%\jmhkd\etebcore-2.x86.dll
%WINDIR%\jmhkd\exma.dll
%WINDIR%\jmhkd\iconv.dll
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\ips138[1].htm

Удаляет следующие файлы

%WINDIR%\end.bat
%WINDIR%\jmhkd\qdx.bat

Самоудаляется.

Сетевая активность

TCP

Запросы HTTP GET

http://ip.#322.net/
http://www.ip##8.com/ips138.asp?ip###############

UDP

DNS ASK ip.#322.net
DNS ASK ip##8.com

Другое

Ищет следующие окна

ClassName: '#32770' WindowName: 'chrome..exe - Г“В¦Г“ГѓВіГЊГђГІВґГГЋГі'

Создает и запускает на исполнение

'%WINDIR%\jmhkd\tjzpfv.exe'
'%WINDIR%\syswow64\cmd.exe' /c del "<Полный путь к файлу>"' (со скрытым окном)
'%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\end.bat" "' (со скрытым окном)
'%WINDIR%\syswow64\sc.exe' Create "Application Layre Gateway Saervice" type= own type= interact start= demand DisplayName= "Can not be deledted" binPath= "cmd.exe /c start "%WINDIR%\boy.exe"' (со скрытым окном)
'%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\jMhkD\qdx.bat" "' (со скрытым окном)

Запускает на исполнение

'%WINDIR%\syswow64\cmd.exe' /c del "<Полный путь к файлу>"
'%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\end.bat" "
'%WINDIR%\syswow64\netsh.exe' ipsec static add policy name=ipsec_ply
'%WINDIR%\syswow64\netsh.exe' ipsec static add filterlist name=deny_pt
'%WINDIR%\syswow64\netsh.exe' ipsec static add filterlist name=allow_pt
'%WINDIR%\syswow64\netsh.exe' ipsec static add filter filterlist=deny_pt srcaddr=any dstaddr=ME dstport=445 protocol=TCP
'%WINDIR%\syswow64\netsh.exe' ipsec static add filter filterlist=deny_pt srcaddr=any dstaddr=ME dstport=139 protocol=TCP
'%WINDIR%\syswow64\netsh.exe' ipsec static add filteraction name=deny action=block
'%WINDIR%\syswow64\netsh.exe' ipsec static add filteraction name=allow action=negotiate
'%WINDIR%\syswow64\netsh.exe' ipsec static add rule name=deny policy=ipsec_ply filterlist=deny_pt filteraction=deny
'%WINDIR%\syswow64\netsh.exe' ipsec static add rule name=allow policy=ipsec_ply filterlist=allow_pt filteraction=allow psk="(@=P#$bV4$"
'%WINDIR%\syswow64\netsh.exe' ipsec static set policy name=ipsec_ply assign=y
'%WINDIR%\syswow64\sc.exe' Create "Application Layre Gateway Saervice" type= own type= interact start= demand DisplayName= "Can not be deledted" binPath= "cmd.exe /c start "%WINDIR%\boy.exe"
'%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\jMhkD\qdx.bat" "
'%WINDIR%\syswow64\schtasks.exe' /create /TN "\Microsoft\Windows\UPnP\Services" /RU SYSTEM /TR "%WINDIR%\jMhkD\TJZPFV.exe" /SC ONSTART