Trojan.DownLoad3.7874

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices] 'ASMAgent' = '%PROGRAM_FILES%\Asset Services Management\ASMAgent.exe'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\ASMAgent] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

%PROGRAM_FILES%\Asset Services Management\Register.exe
%PROGRAM_FILES%\Asset Services Management\ASMAgent.exe
%TEMP%\ASM1.tmp\ASMSetup.exe

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\Asset Services Management\ASMBeacon.dll
%PROGRAM_FILES%\Asset Services Management\ASMAgent.exe
%PROGRAM_FILES%\Asset Services Management\ASMIncl.sys
%PROGRAM_FILES%\Asset Services Management\HTTPParser31.dll
%PROGRAM_FILES%\Asset Services Management\ClassLibrary31.dll
%PROGRAM_FILES%\Asset Services Management\ASMUtils31.dll
%TEMP%\ASM1.tmp\msvcr80.dll
%TEMP%\ASM1.tmp\Register.exe
%TEMP%\ASM1.tmp\VisualParse.DLL
%PROGRAM_FILES%\Asset Services Management\ASMExcl.sys
%TEMP%\ASM1.tmp\ASMEXP.DAT
%TEMP%\ASM1.tmp\Microsoft.VC80.CRT.manifest
%PROGRAM_FILES%\Asset Services Management\Microsoft.VC80.CRT\Microsoft.VC80.CRT.manifest
%PROGRAM_FILES%\Asset Services Management\Inventory.W2K
%PROGRAM_FILES%\Asset Services Management\Register.exe
C:\Asmflag.sys
%PROGRAM_FILES%\Asset Services Management\Microsoft.VC80.CRT\msvcr80.dll
%PROGRAM_FILES%\Asset Services Management\Msvcr80.dll
%PROGRAM_FILES%\Asset Services Management\Inventory.dll
%PROGRAM_FILES%\Asset Services Management\IncludeExclude.dll
%PROGRAM_FILES%\Asset Services Management\asmmemory.dll
%PROGRAM_FILES%\Asset Services Management\ASMMemoryDriver.sys
%PROGRAM_FILES%\Asset Services Management\VisualParse.dll
%TEMP%\ASM1.tmp\SControl.dll
%TEMP%\ASM1.tmp\ASMMemoryDriver.sys
%TEMP%\ASM1.tmp\asmmemory.dll
%TEMP%\ASM1.tmp\ASMIncl.sys
%TEMP%\ASM1.tmp\asmsetup.ini
%TEMP%\ASM1.tmp\ASMSetup.exe
%TEMP%\ASM1.tmp\ASMPayload.dll
%TEMP%\ASM1.tmp\ASMAgent.EXE
%TEMP%\ASM1.tmp\extract.tmp
%TEMP%\ASM1.tmp\ASMCMD.DAT
%TEMP%\ASM1.tmp\ASMFlag.sys
%TEMP%\ASM1.tmp\ASMExcl.sys
%TEMP%\ASM1.tmp\ASMBeacon.DLL
%TEMP%\ASM1.tmp\Inventory.W2K
%TEMP%\ASM1.tmp\Inventory.DLL
%TEMP%\ASM1.tmp\IncludeExclude.dll
%TEMP%\ASM1.tmp\Inventory.x64
%TEMP%\ASM1.tmp\Inventory.WNT
%TEMP%\ASM1.tmp\Inventory.W9X
%TEMP%\ASM1.tmp\CDEVA32.DLL
%TEMP%\ASM1.tmp\CDEVA16.DLL
%TEMP%\ASM1.tmp\ASMUtils31.DLL
%TEMP%\ASM1.tmp\HTTPParser31.DLL
%TEMP%\ASM1.tmp\ClassLibrary3164.DLL
%TEMP%\ASM1.tmp\ClassLibrary31.DLL