Trojan.DownLoader30.9811

Техническая информация

Вредоносные функции

Запускает на исполнение

'<SYSTEM32>\net.exe' stop sharedaccess

Изменения в файловой системе

Создает следующие файлы

%TEMP%\~1.bat
%WINDIR%\pand.txt
<Текущая директория>\ftp.txt
<Текущая директория>\123.txt
<SYSTEM32>\zz.vbs
<SYSTEM32>\aabb.txt
<Текущая директория>\b.txt
%APPDATA%\spiritsoft\urlspirit\product.dat

Присваивает атрибут 'скрытый' для следующих файлов

%TEMP%\~1.bat

Удаляет следующие файлы

<Текущая директория>\ftp.txt
<Текущая директория>\123.txt

Подменяет следующие файлы

<Текущая директория>\123.txt

Сетевая активность

TCP

Запросы HTTP GET

http://go#.gl/ewgWF
http://www.zh##i.com/images/iphentb.png?48##
http://www.zh##i.com/images/bg_with.png
http://www.zh##i.com/images/bgblack.png
http://im####0.zhiji.com/images/ldy_xl3.png
http://www.zh##i.com/jiaoben3176/index2.html?25####
http://www.zh##i.com/img/zghlw.png
http://www.zh##i.com/images/dlman.jpg
http://www.zh##i.com/images/djman.jpg
http://www.zh##i.com/images/sy_xl_a.png
http://www.zh##i.com/images/lyman.jpg
http://www.zh##i.com/images/beijing_b.jpg
http://www.zh##i.com/images/bottom_logo.png?85##
http://www.zh##i.com/images/hytj_18.jpg
http://www.zh##i.com/images/hytj_17.jpg
http://www.zh##i.com/images/hytj_16.jpg
http://www.zh##i.com/images/hytj_15.jpg
http://www.zh##i.com/images/hytj_14.jpg
http://www.zh##i.com/images/hytj_13.jpg
http://www.zh##i.com/images/beian.png
http://www.zh##i.com/images/sy_an_a.png
http://www.zh##i.com/images/aaaa.png
http://www.zh##i.com/images/sy_an_1.png
http://hm.##idu.com/hm.js?0d##############################
http://www.zh##i.com/img/banner3_bg.jpg
http://lx###.baidu.com/float/log.gif?fT#######################################################################
http://www.zh##i.com/img/banner1_bg_a.png
http://lx###.baidu.com/float/_l.js?si########################################################################################################################################
http://lx###.baidu.com/float/log.gif?fT########################################################################
http://hm.##idu.com/hm.gif?cc####################################################################################################################################################################...
http://www.zh##i.com/jiaoben3176/images/r-btn.png
http://www.zh##i.com/jiaoben3176/images/fc_rw.png
http://www.zh##i.com/jiaoben3176/images/l-btn.png
http://se##.zhiji.com/qq_group/sfyz/validate.jsp
http://im####0.zhiji.com/images/ldy_qq2.png
http://www.zh##i.com/
http://www.zh##i.com/jiaoben3176/js/main.js
http://www.zh##i.com/jiaoben3176/js/jquery.js
http://www.zh##i.com/jiaoben3176/css/style.css?36##
http://www.zh##i.com/img/banner_bg_a.png
http://www.zh##i.com/images/jiantouup.png
http://www.zh##i.com/images/fcwm_line.jpg
http://www.zh##i.com/images/hytj_12.jpg
http://www.zh##i.com/images/sy_bg3_a.jpg
http://www.zh##i.com/images/hytj_11.jpg
http://www.zh##i.com/images/hytj_9.jpg
http://www.zh##i.com/images/biaotiy_1.png
http://www.zh##i.com/zhiji_logo.ico
http://www.zh##i.com/favicon.ico
http://www.zh##i.com/js/index.js
http://www.zh##i.com/js/jquery-1.11.2.min.js
http://ww##.zhiji.com/public_js_css/js/default.js
http://ww##.zhiji.com/public_js_css/css/city.css
http://www.zh##i.com/js/loading.js
http://www.zh##i.com/images/right.png
http://www.zh##i.com/js/custom.js
http://www.zh##i.com/js/iosOverlay.js
http://www.zh##i.com/js/jquery.placeholder.min.js
http://www.zh##i.com/js/jquery-1.7.2.min.js
http://www.zh##i.com/js/lrtk_a.js
http://www.zh##i.com/css/common_a.css
http://www.zh##i.com/css/iosOverlay.css
http://www.zh##i.com/js/jquery.js
http://www.zh##i.com/css/lrtk4_f.css?47#######
http://www.zh##i.com/js/spin.min.js
http://www.zh##i.com/images/wrong.png
http://www.zh##i.com/img/jbzx.png
http://www.zh##i.com/img/banner_bg_hei.png?69#####
http://www.zh##i.com/images/hytj_8.jpg
http://www.zh##i.com/images/hytj_7.jpg
http://www.zh##i.com/images/hytj_6.jpg
http://www.zh##i.com/images/hytj_5.jpg
http://www.zh##i.com/images/hytj_4.jpg
http://www.zh##i.com/images/hytj_3.jpg
http://www.zh##i.com/images/hytj_2.jpg
http://www.zh##i.com/images/hytj_1.jpg
http://im####0.zhiji.com/images/ldy_logo_1.png
http://www.zh##i.com/images/sy_csns.png
http://www.zh##i.com/images/sy_djns.png
http://www.zh##i.com/images/sy_lyns.png
http://www.zh##i.com/images/p2_1a.jpg?47##
http://www.zh##i.com/images/p1_1a.jpg
http://www.zh##i.com/images/p1a.jpg?58##
http://www.zh##i.com/images/sy_ss.jpg
http://www.zh##i.com/images/baomi-t-2.png
http://www.zh##i.com/img/banner3_a.png?69#####
http://www.zh##i.com/img/banner1_left-a-1.png?69#####
http://www.zh##i.com/images/hytj_10.jpg
http://lx###.baidu.com/lxb.js?si#########