Trojan.KeyLogger.14602

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'msnscr.exe' = '<SYSTEM32>\msnscr.exe'

Вредоносные функции:

Создает и запускает на исполнение:

<SYSTEM32>\msnscr.exe

Изменения в файловой системе:

Создает следующие файлы:

<SYSTEM32>\msnscr.exe

Другое:

Ищет следующие окна:

ClassName: '' WindowName: 'BES - Mozilla Firefox'
ClassName: '' WindowName: 'BES - Microsoft Internet Explorer'
ClassName: '' WindowName: 'Millennium bcp - Mozilla Firefox'
ClassName: '' WindowName: 'Banco Nazionale del Lavoro - Microsoft Internet Explorer'
ClassName: '' WindowName: '..:: Banif.pt - Bem vindo ::.. - Mozilla Firefox'
ClassName: '' WindowName: '..:: Banif.pt - Bem vindo ::.. - Microsoft Internet Explorer'
ClassName: '' WindowName: 'Bank of American Fork - Mozilla Firefox'
ClassName: '' WindowName: 'Bank of American Fork - Microsoft Internet Explorer'
ClassName: '' WindowName: 'Bank of America | Home | Personal - Mozilla Firefox'
ClassName: '' WindowName: 'Millennium bcp - Microsoft Internet Explorer'
ClassName: '' WindowName: 'Bank Austria Creditanstalt - Mozilla Firefox'
ClassName: '' WindowName: 'Bank Austria Creditanstalt - Microsoft Internet Explorer'
ClassName: '' WindowName: 'Banco Nazionale del Lavoro - Mozilla Firefox'
ClassName: '' WindowName: 'BHUnet - Microsoft Internet Explorer'
ClassName: '' WindowName: 'Republic Bank - Mozilla Firefox'
ClassName: '' WindowName: 'Republic Bank - Microsoft Internet Explorer'
ClassName: '' WindowName: 'Bienvenidos a Banco Santander Uruguay - Mozilla Firefox'
ClassName: '' WindowName: 'Bienvenidos a Banco Santander Uruguay - Microsoft Internet Explorer'
ClassName: '' WindowName: 'BHUnet - Mozilla Firefox'
ClassName: '' WindowName: 'Bienvenidos al Banco Mercantil - Microsoft Internet Explorer'
ClassName: '' WindowName: 'Banco Comafi - Mozilla Firefox'
ClassName: '' WindowName: 'Banco Comafi - Microsoft Internet Explorer'
ClassName: '' WindowName: 'BANCO BICE - Mozilla Firefox'
ClassName: '' WindowName: 'BANCO BICE - Microsoft Internet Explorer'
ClassName: '' WindowName: 'Bienvenidos al Banco Mercantil - Mozilla Firefox'
ClassName: '' WindowName: 'Bank of America | Home | Personal - Microsoft Internet Explorer'
ClassName: '' WindowName: 'BankBoston - Microsoft Internet Explorer'
ClassName: '' WindowName: '[bb.com.br] - Mozilla Firefox'
ClassName: '' WindowName: '[bb.com.br] - Microsoft Internet Explorer'
ClassName: '' WindowName: 'Banco Santander - Mozilla Firefox'
ClassName: '' WindowName: 'Banco Santander - Microsoft Internet Explorer'
ClassName: '' WindowName: 'BankBoston - Mozilla Firefox'
ClassName: '' WindowName: 'Caixa Econ?mica Federal - Microsoft Internet Explorer'
ClassName: '' WindowName: 'PuTTY Configuration'
ClassName: '' WindowName: 'Banco Bradesco S/A - Microsoft Internet Explorer'
ClassName: '' WindowName: 'PayPal - Welcome - Mozilla Firefox'
ClassName: '' WindowName: 'PayPal - Welcome - Microsoft Internet Explorer'
ClassName: '' WindowName: 'Caixa Econ?mica Federal - Mozilla Firefox'
ClassName: '' WindowName: 'Unibanco.com - Microsoft Internet Explorer'
ClassName: '' WindowName: 'Wells Fargo Home Page - Microsoft Internet Explorer'
ClassName: '' WindowName: 'https://ww9.banrisul.com.br - Banrisul - Microsoft Internet Explorer'
ClassName: '' WindowName: 'Portal Internet Banrisul - Microsoft Internet Explorer'
ClassName: '' WindowName: 'Barclays Bank - Mozilla Firefox'
ClassName: '' WindowName: 'Barclays Bank - Microsoft Internet Explorer'
ClassName: '' WindowName: 'Wells Fargo Home Page - Mozilla Firefox'
ClassName: '' WindowName: 'Banespa - Mozilla Firefox'
ClassName: '' WindowName: 'Banespa - Microsoft Internet Explorer'
ClassName: '' WindowName: 'Unibanco.com - Mozilla Firefox'
ClassName: '' WindowName: 'Banco Rural - Mozilla Firefox'
ClassName: '' WindowName: 'Banco Rural - Microsoft Internet Explorer'
ClassName: '' WindowName: 'B A N R I S U L - Microsoft Internet Explorer'