Trojan.DownLoader7.6488

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '极品桌面' = '%PROGRAM_FILES%\jpdesk(88E6680F)\jpdesk.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ј«Ж·ЧАГж' = '%PROGRAM_FILES%\jpdesk(88E6680F)\jpdesk.exe'

Вредоносные функции:

Создает и запускает на исполнение:

%PROGRAM_FILES%\jpdesk(88E6680F)\jpdesk.exe /NoWizard /AddTrainTick

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\jpdesk(88E6680F)\Background\У«Д»\background.ini
%PROGRAM_FILES%\jpdesk(88E6680F)\Background\НёГч\separator_Vert.png
%PROGRAM_FILES%\jpdesk(88E6680F)\Background\НёГч\background_Horz.png
%PROGRAM_FILES%\jpdesk(88E6680F)\Background\У«Д»\bg.png
%ALLUSERSPROFILE%\Start Menu\ј«Ж·ЧАГж.lnk
%TEMP%\UpdateInfo.exe
%PROGRAM_FILES%\jpdesk(88E6680F)\Background\У«Д»\separator.png
%PROGRAM_FILES%\jpdesk(88E6680F)\Background\НёГч\background.ini
%PROGRAM_FILES%\jpdesk(88E6680F)\Background\Б¤За\bg.png
%PROGRAM_FILES%\jpdesk(88E6680F)\Background\Б¤За\background.ini
%PROGRAM_FILES%\jpdesk(88E6680F)\Background\А¶ВМ\separator bottom.png
%PROGRAM_FILES%\jpdesk(88E6680F)\Background\Б¤За\sep.png
%PROGRAM_FILES%\jpdesk(88E6680F)\Background\МїєЪ\separator.png
%PROGRAM_FILES%\jpdesk(88E6680F)\Background\МїєЪ\bg.png
%PROGRAM_FILES%\jpdesk(88E6680F)\Background\МїєЪ\background.ini
%TEMP%\5.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\info[1]
%TEMP%\4.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\weather.pc2[1]
%TEMP%\7.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\MZђ[1].xml
%TEMP%\6.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\info.jpdesk[1]
%APPDATA%\JPDesk\mods.ini
%ALLUSERSPROFILE%\Desktop\ј«Ж·ЧАГж.lnk
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\ј«Ж·ЧАГж.lnk
%TEMP%\nse3.tmp\NSISdl.dll
%APPDATA%\JPDesk\CurTheme.Theme
%PROGRAM_FILES%\jpdesk(88E6680F)\uninst.exe
%TEMP%\instmp.tmp
%PROGRAM_FILES%\jpdesk(88E6680F)\PicLib\System\Lock.png
%PROGRAM_FILES%\jpdesk(88E6680F)\PicLib\System\DesktopBg1.jpg
%PROGRAM_FILES%\jpdesk(88E6680F)\PicLib\System\DesktopBG.jpg
%PROGRAM_FILES%\jpdesk(88E6680F)\PicLib\System\MyComputer.png
%PROGRAM_FILES%\jpdesk(88E6680F)\PicLib\System\QQ.png
%PROGRAM_FILES%\jpdesk(88E6680F)\PicLib\System\NetWork.png
%PROGRAM_FILES%\jpdesk(88E6680F)\PicLib\System\MyDocument.png
%PROGRAM_FILES%\jpdesk(88E6680F)\PicLib\System\Almanac.png
%TEMP%\nse3.tmp\KillProcDLL.dll
%TEMP%\nse3.tmp\nsWebJPDesk.dll
%TEMP%\nse2.tmp
%PROGRAM_FILES%\jpdesk(88E6680F)\jpdesk.exe
%PROGRAM_FILES%\jpdesk(88E6680F)\updateinfo.txt.tmp
%PROGRAM_FILES%\jpdesk(88E6680F)\Default.png.tmp
%PROGRAM_FILES%\jpdesk(88E6680F)\poof.png.tmp
%PROGRAM_FILES%\jpdesk(88E6680F)\Background\ЅрКф\background.ini
%PROGRAM_FILES%\jpdesk(88E6680F)\PicLib\System\wmplayer.png
%PROGRAM_FILES%\jpdesk(88E6680F)\PicLib\System\taobao.png
%PROGRAM_FILES%\jpdesk(88E6680F)\Background\ЅрКф\background_bottom.png
%PROGRAM_FILES%\jpdesk(88E6680F)\Background\А¶ВМ\background_bottom.png
%PROGRAM_FILES%\jpdesk(88E6680F)\Background\А¶ВМ\background.ini
%PROGRAM_FILES%\jpdesk(88E6680F)\Background\ЅрКф\separator bottom.png
%PROGRAM_FILES%\jpdesk(88E6680F)\PicLib\System\msnmsgr.png
%PROGRAM_FILES%\jpdesk(88E6680F)\PicLib\System\SearchPage.png
%PROGRAM_FILES%\jpdesk(88E6680F)\PicLib\System\Recycle_empty.png
%PROGRAM_FILES%\jpdesk(88E6680F)\PicLib\System\Recycle_Full.png
%PROGRAM_FILES%\jpdesk(88E6680F)\PicLib\System\TrainTick.png
%PROGRAM_FILES%\jpdesk(88E6680F)\PicLib\System\iexplore.png
%PROGRAM_FILES%\jpdesk(88E6680F)\PicLib\System\folder.png
%PROGRAM_FILES%\jpdesk(88E6680F)\PicLib\System\Weather.png

Удаляет следующие файлы:

%TEMP%\5.tmp
%TEMP%\6.tmp
%TEMP%\7.tmp
%TEMP%\4.tmp
%TEMP%\nse3.tmp\KillProcDLL.dll
%TEMP%\nse3.tmp\NSISdl.dll
%TEMP%\nse3.tmp\nsWebJPDesk.dll

Перемещает следующие файлы:

%PROGRAM_FILES%\jpdesk(88E6680F)\updateinfo.txt.tmp в %PROGRAM_FILES%\jpdesk(88E6680F)\updateinfo.txt
%PROGRAM_FILES%\jpdesk(88E6680F)\Default.png.tmp в %PROGRAM_FILES%\jpdesk(88E6680F)\Default.png
%PROGRAM_FILES%\jpdesk(88E6680F)\poof.png.tmp в %PROGRAM_FILES%\jpdesk(88E6680F)\poof.png

Сетевая активность:

Подключается к:

'in##.jpdesk.com':80
'up###e1.pc2.cc':80
'we###er.pc2.cc':80
'jp##.pc2.cc':80
'localhost':1037
'tj.##zhe.com':80

TCP:

Запросы HTTP GET:

we###er.pc2.cc/?ac########
we###er.pc2.cc/ini/MZ?.x##
tj.##zhe.com/?da################################################################################################
up###e1.pc2.cc/info/?28
jp##.pc2.cc/?da#######################################################################
tj.##zhe.com/?da#######################################################################
in##.jpdesk.com/?op########

UDP: