Trojan.DownLoader34.47261

Техническая информация

Вредоносные функции

Запускает на исполнение

'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Defraggler" dir=out action=Block program="%ProgramFiles%\Defraggler\Defraggler.exe" enable=yes
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Defraggler64" dir=out action=Block program="%ProgramFiles%\Defraggler\Defraggler64.exe" enable=yes

Изменения в файловой системе

Создает следующие файлы

%TEMP%\aut70db.tmp
%ProgramFiles%\defraggler\lang\lang-1046.dll
%ProgramFiles%\defraggler\lang\lang-1038.dll
%ProgramFiles%\defraggler\lang\lang-1029.dll
%ProgramFiles%\defraggler\lang\lang-2052.dll
%ProgramFiles%\defraggler\lang\lang-1027.dll
%ProgramFiles%\defraggler\lang\lang-1037.dll
%ProgramFiles%\defraggler\lang\lang-1032.dll
%ProgramFiles%\defraggler\lang\lang-1055.dll
%ProgramFiles%\defraggler\lang\lang-1025.dll
%ProgramFiles%\defraggler\lang\lang-1048.dll
%ProgramFiles%\defraggler\lang\lang-1063.dll
%ProgramFiles%\defraggler\lang\lang-1052.dll
%ProgramFiles%\defraggler\lang\lang-1051.dll
%ProgramFiles%\defraggler\lang\lang-1071.dll
%ProgramFiles%\defraggler\lang\lang-5146.dll
%ProgramFiles%\defraggler\lang\lang-1026.dll
%ProgramFiles%\defraggler\lang\lang-1058.dll
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\defraggler\defraggler homepage.url
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\defraggler\defraggler.lnk
C:\users\public\desktop\defraggler.lnk
%ProgramFiles%\defraggler\lang\lang-1057.dll
%ProgramFiles%\defraggler\lang\lang-1062.dll
%ProgramFiles%\defraggler\lang\lang-9999.dll
%ProgramFiles%\defraggler\lang\lang-1060.dll
%ProgramFiles%\defraggler\lang\lang-1059.dll
%ProgramFiles%\defraggler\lang\lang-1079.dll
%ProgramFiles%\defraggler\lang\lang-1065.dll
%ProgramFiles%\defraggler\lang\lang-1067.dll
%ProgramFiles%\defraggler\lang\lang-1066.dll
%ProgramFiles%\defraggler\lang\lang-1061.dll
%ProgramFiles%\defraggler\lang\lang-1050.dll
%ProgramFiles%\defraggler\uninst.exe
%ProgramFiles%\defraggler\lang\lang-1035.dll
%ProgramFiles%\defraggler\lang\lang-1030.dll
%ProgramFiles%\defraggler\lang\lang-1028.dll
%WINDIR%\temp\temp_1\restfiles\blackbunny.gif
%TEMP%\aut710b.tmp
%WINDIR%\temp\temp_1\restfiles\blackbunnyinstall.gif
%TEMP%\aut712b.tmp
%WINDIR%\temp\temp_1\restfiles\blackbunnyend.gif
%TEMP%\aut7d7b.tmp
%WINDIR%\temp\temp_1\restfiles\setup.exe
%TEMP%\aut7ef3.tmp
%WINDIR%\temp\temp_1\restfiles\crack.exe
%TEMP%\nsg8a93.tmp
%TEMP%\nsm8ab4.tmp\system.dll
%TEMP%\nsm8ab4.tmp\userinfo.dll
%TEMP%\nsm8ab4.tmp\inetc.dll
%TEMP%\checkupdate.log
%ProgramFiles%\defraggler\defraggler.exe
%ProgramFiles%\defraggler\df.exe
%ProgramFiles%\defraggler\defraggler64.exe
%ProgramFiles%\defraggler\lang\lang-1034.dll
%ProgramFiles%\defraggler\lang\lang-1036.dll
%ProgramFiles%\defraggler\lang\lang-1043.dll
%ProgramFiles%\defraggler\lang\lang-2070.dll
%ProgramFiles%\defraggler\lang\lang-1040.dll
%ProgramFiles%\defraggler\lang\lang-1044.dll
%ProgramFiles%\defraggler\lang\lang-1049.dll
%ProgramFiles%\defraggler\lang\lang-1053.dll
%ProgramFiles%\defraggler\lang\lang-1041.dll
%ProgramFiles%\defraggler\lang\lang-1031.dll
%ProgramFiles%\defraggler\defragglershell64.dll.new
%ProgramFiles%\defraggler\defragglershell.dll.new
%ProgramFiles%\defraggler\branding.dll
%ProgramFiles%\defraggler\df64.exe
%ProgramFiles%\defraggler\lang\lang-1045.dll
%ProgramFiles%\defraggler\defraggler.dat

Удаляет следующие файлы

%TEMP%\aut70db.tmp
%TEMP%\aut710b.tmp
%TEMP%\aut712b.tmp
%TEMP%\aut7d7b.tmp
%TEMP%\aut7ef3.tmp
%TEMP%\checkupdate.log
%TEMP%\nsm8ab4.tmp\inetc.dll
%TEMP%\nsm8ab4.tmp\system.dll
%TEMP%\nsm8ab4.tmp\userinfo.dll
%WINDIR%\temp\temp_1\restfiles\blackbunny.gif
%WINDIR%\temp\temp_1\restfiles\blackbunnyend.gif
%WINDIR%\temp\temp_1\restfiles\blackbunnyinstall.gif
%WINDIR%\temp\temp_1\restfiles\crack.exe
%WINDIR%\temp\temp_1\restfiles\setup.exe

Перемещает следующие файлы

%ProgramFiles%\defraggler\defragglershell.dll.new в %ProgramFiles%\defraggler\defragglershell.dll
%ProgramFiles%\defraggler\defragglershell64.dll.new в %ProgramFiles%\defraggler\defragglershell64.dll

Сетевая активность

TCP

Запросы HTTP GET

http://se#####.piriform.com/installcheck.aspx?p=######################################################################

UDP

DNS ASK se#####.piriform.com

Другое

Ищет следующие окна

ClassName: 'PiriformRegistration' WindowName: ''
ClassName: '' WindowName: 'Piriform Defraggler'
ClassName: '' WindowName: 'Defraggler'
ClassName: '' WindowName: ''
ClassName: 'PiriformDefraggler' WindowName: ''
ClassName: '#32770' WindowName: ''
ClassName: 'EDIT' WindowName: ''

Создает и запускает на исполнение

'%WINDIR%\temp\temp_1\restfiles\setup.exe' /S /L=1043
'%WINDIR%\temp\temp_1\restfiles\crack.exe'

Запускает на исполнение

'%WINDIR%\syswow64\regsvr32.exe' /I "%ProgramFiles%\Defraggler\DefragglerShell64.dll" /s
'<SYSTEM32>\regsvr32.exe' /I "%ProgramFiles%\Defraggler\DefragglerShell64.dll" /s
'%WINDIR%\syswow64\cmd.exe' /c netsh advfirewall firewall add rule name="Defraggler" dir=out action=Block program="%ProgramFiles%\Defraggler\Defraggler.exe" enable=yes
'%WINDIR%\syswow64\cmd.exe' /c netsh advfirewall firewall add rule name="Defraggler64" dir=out action=Block program="%ProgramFiles%\Defraggler\Defraggler64.exe" enable=yes