Trojan.Inject.3832

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt] 'DLLName' = 'crypts.dll'

Вредоносные функции:

Внедряет код в

следующие системные процессы:

%WINDIR%\Explorer.EXE

Изменения в файловой системе:

Создает следующие файлы:

%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[7].php
%TEMP%\C077.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[6].php
%TEMP%\BD2B.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[7].php
%TEMP%\C6E0.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[7].php
%TEMP%\C3E2.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[7].php
%TEMP%\A936.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[6].php
%TEMP%\A0BA.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[5].php
%TEMP%\B135.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[6].php
%TEMP%\B9B1.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[6].php
%TEMP%\B4A0.tmp
%TEMP%\C9FC.tmp
%TEMP%\F041.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[9].php
%TEMP%\EA56.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[9].php
%TEMP%\F38D.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[10].php
%TEMP%\FA44.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[9].php
%TEMP%\F6F8.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[8].php
%TEMP%\D5A5.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[8].php
%TEMP%\CD48.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[8].php
%TEMP%\E4D7.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[9].php
%TEMP%\E015.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[8].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[5].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[2].php
%TEMP%\4EC2.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[2].php
%TEMP%\45C9.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[2].php
%TEMP%\6140.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[3].php
%TEMP%\5912.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[2].php
%TEMP%\25FC.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[1].php
<SYSTEM32>\crypts.dll
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[1].php
%TEMP%\332B.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[1].php
%TEMP%\3B97.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[1].php
%TEMP%\3648.tmp
%TEMP%\675A.tmp
%TEMP%\8581.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[4].php
%TEMP%\7D25.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[4].php
%TEMP%\8B7C.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[5].php
%TEMP%\9ADE.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[5].php
%TEMP%\95AE.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[3].php
%TEMP%\71AB.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[3].php
%TEMP%\6C2D.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[3].php
%TEMP%\7881.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[4].php
%TEMP%\74E7.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[4].php