Trojan.DownLoader7.17747

Техническая информация

Вредоносные функции:

Создает и запускает на исполнение:

%PROGRAM_FILES%\baidu\msfsg.exe md5 -s dsetup.exe -d dsetup.exe
%PROGRAM_FILES%\baidu\msfsg.exe md5 -s ronown.dll -d ronown.dll
%TEMP%\is-2MQP2.tmp\setup768294.tmp /SL5="$3008C,880406,54272,%PROGRAM_FILES%\baidu\setup768294.exe" /VERYSILENT /NORESTART
%PROGRAM_FILES%\baidu\dsetup.exe install
%PROGRAM_FILES%\baidu\msfsg.exe md5 -s newnetgar.dll -d newnetgar.dll
%PROGRAM_FILES%\baidu\msfsg.exe md5 -s spass.dll -d spass.dll
%PROGRAM_FILES%\baidu\setup768294.exe /VERYSILENT /NORESTART
%TEMP%\nsl2.tmp\ns5.tmp net stop Dhcp
%TEMP%\nsl2.tmp\ns4.tmp cmd.exe /c netsh interface ip set address name="Local Area Connection" source=dhcp
%TEMP%\nsl2.tmp\ns3.tmp cmd.exe /c netsh -c interface dump>c:\ipconfig.txt
%PROGRAM_FILES%\baidu\new.exe uncompress -s opt256.xml -d setup768294.exe
%PROGRAM_FILES%\baidu\go6002.exe
%PROGRAM_FILES%\baidu\new.exe uncompress -s dsop8.xml -d go6002.exe

Запускает на исполнение:

<SYSTEM32>\net1.exe stop Dhcp
<SYSTEM32>\net.exe stop Dhcp

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\baidu\is-2V71V.tmp
%PROGRAM_FILES%\baidu\is-758GD.tmp
%PROGRAM_FILES%\baidu\is-O4M21.tmp
%PROGRAM_FILES%\baidu\is-FO09M.tmp
%PROGRAM_FILES%\baidu\is-N2OBJ.tmp
%PROGRAM_FILES%\baidu\is-CPM5H.tmp
%TEMP%\is-2MQP2.tmp\setup768294.tmp
%PROGRAM_FILES%\baidu\setup768294.exe
%TEMP%\is-1FTQ7.tmp\_isetup\_RegDLL.tmp
%TEMP%\is-1FTQ7.tmp\spass.dll
%TEMP%\is-1FTQ7.tmp\_isetup\_shfoldr.dll
%PROGRAM_FILES%\baidu\is-FIU7D.tmp
%PROGRAM_FILES%\baidu\newnetgar.dll
%APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\1bbc804a-d108-4128-94f7-83b5a2e049e8
%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\ec702f375e1b12d218f67ab9ef19ca23_23ef5514-3059-436f-a4a7-4cefaab20eb1
%APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\Preferred
%PROGRAM_FILES%\baidu\spass.dll
%PROGRAM_FILES%\baidu\is-356HK.tmp
%PROGRAM_FILES%\baidu\is-MSB08.tmp
<SYSTEM32>\microinfo\MyIEData\main.ini
%PROGRAM_FILES%\baidu\dsetup.exe
%PROGRAM_FILES%\baidu\ronown.dll
%TEMP%\nsl2.tmp\AccessControl.dll
%TEMP%\nsl2.tmp\nsRandom.dll
%TEMP%\nsl2.tmp\Internet.dll
%TEMP%\nsl2.tmp\ns3.tmp
%TEMP%\nsl2.tmp\nsExec.dll
%PROGRAM_FILES%\baidu\uninst18.exe
%PROGRAM_FILES%\baidu\new.exe
%PROGRAM_FILES%\baidu\opt256.xml
%PROGRAM_FILES%\baidu\dsop8.xml
%PROGRAM_FILES%\baidu\tempnethome18.ini
%TEMP%\nsl2.tmp\System.dll
%TEMP%\nsl2.tmp\Math.dll
%TEMP%\nsn7.tmp\NSISArray.dll
%TEMP%\nsn7.tmp\AccessControl.dll
%PROGRAM_FILES%\Internet Explorer.lnk
%PROGRAM_FILES%\baidu\dsop9.xml
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Жф¶Ї Intrenet Expolrer дЇААЖч.lnk
%TEMP%\nsn7.tmp\nsRandom.dll
C:\ipconfig.txt
%TEMP%\nsl2.tmp\ns4.tmp
%TEMP%\nsl2.tmp\ns5.tmp
%TEMP%\nsn7.tmp\System.dll
%PROGRAM_FILES%\baidu\go6002.exe