Trojan.DownLoader7.18605

Техническая информация

Вредоносные функции:

Создает и запускает на исполнение:

%PROGRAM_FILES%\baidu\msfsg.exe md5 -s passthru.dll -d passthru.dll
%PROGRAM_FILES%\baidu\msfsg.exe md5 -s dsetup.exe -d dsetup.exe
%PROGRAM_FILES%\baidu\setup124227.exe /VERYSILENT /NORESTART
%TEMP%\is-VTK66.tmp\setup124227.tmp /SL5="$10108,819358,54272,%PROGRAM_FILES%\baidu\setup124227.exe" /VERYSILENT /NORESTART
%PROGRAM_FILES%\baidu\msfsg.exe md5 -s siglow-nos.sys -d siglow-nos.sys
%PROGRAM_FILES%\baidu\dsetup.exe install
%PROGRAM_FILES%\baidu\msfsg.exe md5 -s spass.dll -d spass.dll
%PROGRAM_FILES%\baidu\msfsg.exe md5 -s newnetgar.dll -d newnetgar.dll
%PROGRAM_FILES%\baidu\msfsg.exe uncompress -s t0001.xml -d t.exe
%PROGRAM_FILES%\baidu\msfsg.exe md5 -s t.exe -d t.exe -l 10000000
<Текущая директория>\uuse-1114.exe
%PROGRAM_FILES%\baidu\msfsg.exe uncompress -s s0001.xml -d s.exe
%PROGRAM_FILES%\baidu\s.exe
%PROGRAM_FILES%\baidu\msfsg.exe uncompress -s dsop7.xml -d setup124227.exe
%PROGRAM_FILES%\baidu\msfsg.exe md5 -s s.exe -d s.exe -l 10000000
%TEMP%\nsg2.tmp\ns5.tmp s.exe

Изменения в файловой системе:

Создает следующие файлы:

<SYSTEM32>\hardpol\MyIEData\main.ini
%PROGRAM_FILES%\baidu\is-LSHAC.tmp
%PROGRAM_FILES%\baidu\is-0KO50.tmp
%PROGRAM_FILES%\baidu\spass.dll
%PROGRAM_FILES%\baidu\dsetup.exe
%PROGRAM_FILES%\baidu\passthru.dll
%PROGRAM_FILES%\baidu\is-UCRUE.tmp
%PROGRAM_FILES%\baidu\is-N1A88.tmp
%PROGRAM_FILES%\baidu\is-9AJPF.tmp
%PROGRAM_FILES%\baidu\is-4BKVC.tmp
%PROGRAM_FILES%\baidu\is-O3QPG.tmp
%PROGRAM_FILES%\baidu\is-2T3AI.tmp
%PROGRAM_FILES%\baidu\newnetgar.dll
%WINDIR%\inf\oem4.PNF
%WINDIR%\inf\oem4.inf
%WINDIR%\inf\oem3.PNF
<DRIVERS>\SETB.tmp
<SYSTEM32>\SETA.tmp
%WINDIR%\inf\INFCACHE.0
%APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\9618955f-70e1-424b-abb1-739648e3a29e
%PROGRAM_FILES%\baidu\siglow-nos.sys
%WINDIR%\inf\oem3.inf
%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\ec702f375e1b12d218f67ab9ef19ca23_23ef5514-3059-436f-a4a7-4cefaab20eb1
%APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\Preferred
%TEMP%\nsg2.tmp\nsRandom.dll
%PROGRAM_FILES%\baidu\un1030142000423.exe
%PROGRAM_FILES%\baidu\temp33.ini
%TEMP%\nsf4.tmp\ioSpecial.ini
%TEMP%\nsg2.tmp\Internet.dll
%TEMP%\nsg2.tmp\AccessControl.dll
%PROGRAM_FILES%\baidu\s0001.xml
%PROGRAM_FILES%\baidu\msfsg.exe
%PROGRAM_FILES%\baidu\dsop7.xml
%TEMP%\nsg2.tmp\System.dll
<Текущая директория>\uuse-1114.exe
%PROGRAM_FILES%\baidu\t0001.xml
%TEMP%\nsf4.tmp\modern-wizard.bmp
%TEMP%\is-TEH6F.tmp\_isetup\_shfoldr.dll
%TEMP%\is-TEH6F.tmp\_isetup\_RegDLL.tmp
%TEMP%\is-VTK66.tmp\setup124227.tmp
%PROGRAM_FILES%\baidu\is-28NVV.tmp
%PROGRAM_FILES%\baidu\is-R2IIG.tmp
%TEMP%\is-TEH6F.tmp\spass.dll
%PROGRAM_FILES%\baidu\t.exe
%PROGRAM_FILES%\baidu\s.exe
%TEMP%\nsf4.tmp\InstallOptions.dll
%PROGRAM_FILES%\baidu\setup124227.exe
%TEMP%\nsg2.tmp\ns5.tmp
%TEMP%\nsg2.tmp\nsExec.dll