Trojan.DownLoader34.38183

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[<HKLM>\Software\Classes\Direct WAV MP3 Splitter\shell\open\command] '' = '"%ProgramFiles(x86)%\Direct WAV MP3 Splitter\Splitter.exe" "%1"'

Изменения в файловой системе

Создает следующие файлы

%TEMP%\is-ue4fl.tmp\<Имя файла>.tmp
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\direct wav mp3 splitter\direct wav mp3 splitter.lnk
%ProgramFiles(x86)%\direct wav mp3 splitter\images\is-7love.tmp
%ProgramFiles(x86)%\direct wav mp3 splitter\images\is-5c57d.tmp
%ProgramFiles(x86)%\direct wav mp3 splitter\images\is-hi98e.tmp
%ProgramFiles(x86)%\direct wav mp3 splitter\images\is-14uhg.tmp
%ProgramFiles(x86)%\direct wav mp3 splitter\images\is-3mofv.tmp
%ProgramFiles(x86)%\direct wav mp3 splitter\images\is-s3jk3.tmp
%ProgramFiles(x86)%\direct wav mp3 splitter\images\is-e70up.tmp
%ProgramFiles(x86)%\direct wav mp3 splitter\images\is-9m8nc.tmp
%ProgramFiles(x86)%\direct wav mp3 splitter\images\is-e0ssu.tmp
%ProgramFiles(x86)%\direct wav mp3 splitter\images\is-8dd9m.tmp
%ProgramFiles(x86)%\direct wav mp3 splitter\is-fqdjm.tmp
%ProgramFiles(x86)%\direct wav mp3 splitter\is-233po.tmp
%ProgramFiles(x86)%\direct wav mp3 splitter\is-iisvk.tmp
%ProgramFiles(x86)%\direct wav mp3 splitter\is-gm20e.tmp
%ProgramFiles(x86)%\direct wav mp3 splitter\is-1ntie.tmp
%ProgramFiles(x86)%\direct wav mp3 splitter\is-eutqt.tmp
%TEMP%\is-kcd58.tmp\_isetup\_iscrypt.dll
%TEMP%\is-kcd58.tmp\_isetup\_setup64.tmp
%ProgramFiles(x86)%\direct wav mp3 splitter\splitter.url
%ProgramFiles(x86)%\direct wav mp3 splitter\unins000.dat

Перемещает следующие файлы

%ProgramFiles(x86)%\direct wav mp3 splitter\is-eutqt.tmp в %ProgramFiles(x86)%\direct wav mp3 splitter\unins000.exe
%ProgramFiles(x86)%\direct wav mp3 splitter\is-1ntie.tmp в %ProgramFiles(x86)%\direct wav mp3 splitter\splitter.exe
%ProgramFiles(x86)%\direct wav mp3 splitter\is-gm20e.tmp в %ProgramFiles(x86)%\direct wav mp3 splitter\readme.txt
%ProgramFiles(x86)%\direct wav mp3 splitter\is-iisvk.tmp в %ProgramFiles(x86)%\direct wav mp3 splitter\splithelp.chm
%ProgramFiles(x86)%\direct wav mp3 splitter\is-233po.tmp в %ProgramFiles(x86)%\direct wav mp3 splitter\bass.dll
%ProgramFiles(x86)%\direct wav mp3 splitter\is-fqdjm.tmp в %ProgramFiles(x86)%\direct wav mp3 splitter\bass_fx.dll
%ProgramFiles(x86)%\direct wav mp3 splitter\images\is-8dd9m.tmp в %ProgramFiles(x86)%\direct wav mp3 splitter\images\button_big_buy_the_full_version_now-trans.png
%ProgramFiles(x86)%\direct wav mp3 splitter\images\is-e0ssu.tmp в %ProgramFiles(x86)%\direct wav mp3 splitter\images\buy.gif
%ProgramFiles(x86)%\direct wav mp3 splitter\images\is-9m8nc.tmp в %ProgramFiles(x86)%\direct wav mp3 splitter\images\buynow_sm.gif
%ProgramFiles(x86)%\direct wav mp3 splitter\images\is-e70up.tmp в %ProgramFiles(x86)%\direct wav mp3 splitter\images\buy_full_version.gif
%ProgramFiles(x86)%\direct wav mp3 splitter\images\is-s3jk3.tmp в %ProgramFiles(x86)%\direct wav mp3 splitter\images\cancel_sm.gif
%ProgramFiles(x86)%\direct wav mp3 splitter\images\is-3mofv.tmp в %ProgramFiles(x86)%\direct wav mp3 splitter\images\continue_free_trial.gif
%ProgramFiles(x86)%\direct wav mp3 splitter\images\is-14uhg.tmp в %ProgramFiles(x86)%\direct wav mp3 splitter\images\customersvc_sm.gif
%ProgramFiles(x86)%\direct wav mp3 splitter\images\is-hi98e.tmp в %ProgramFiles(x86)%\direct wav mp3 splitter\images\register_sm.gif
%ProgramFiles(x86)%\direct wav mp3 splitter\images\is-5c57d.tmp в %ProgramFiles(x86)%\direct wav mp3 splitter\images\reissuekey_sm.gif
%ProgramFiles(x86)%\direct wav mp3 splitter\images\is-7love.tmp в %ProgramFiles(x86)%\direct wav mp3 splitter\images\security_lock_text.gif

Сетевая активность

Подключается к

'sy###ee.info':80

TCP

Запросы HTTP POST

http://sy###ee.info/v2/events

UDP

DNS ASK sy###ee.info

Другое

Создает и запускает на исполнение

'%TEMP%\is-ue4fl.tmp\<Имя файла>.tmp' /SL5="$120228,9329914,54784,<Полный путь к файлу>"
'%ProgramFiles(x86)%\direct wav mp3 splitter\splitter.exe' <Имя файла>.exe