Trojan.KillFiles.10057

Техническая информация

Вредоносные функции:

Создает и запускает на исполнение:

%TEMP%\MailRu.exe
%TEMP%\activeMail.exe

Изменения в файловой системе:

Создает следующие файлы:

%WINDIR%\MacOS\api-ms-win-core-memory-l1-1-0.dll
%WINDIR%\MacOS\api-ms-win-core-misc-l1-1-0.dll
C:\Users\%USERNAME%\AppData\Roaming\Mozilla\Firefox\Profiles\bin\permissions.sqlite
C:\Users\%USERNAME%\AppData\Roaming\Mozilla\Firefox\Profiles\bin\places.sqlite
%WINDIR%\MacOS\api-ms-win-core-processthreads-l1-1-0.dll
%WINDIR%\MacOS\api-ms-win-core-profile-l1-1-0.dll
%WINDIR%\MacOS\api-ms-win-core-namedpipe-l1-1-0.dll
%WINDIR%\MacOS\api-ms-win-core-processenvironment-l1-1-0.dll
C:\Users\%USERNAME%\AppData\Roaming\Mozilla\Firefox\Profiles\bin\cookies.sqlite
C:\Users\%USERNAME%\AppData\Roaming\Mozilla\Firefox\Profiles\bin\downloads.sqlite
%WINDIR%\MacOS\api-ms-win-core-localization-l1-1-0.dll
%WINDIR%\MacOS\api-ms-win-core-localregistry-l1-1-0.dll
C:\Users\%USERNAME%\AppData\Roaming\Mozilla\Firefox\Profiles\bin\key3.db
C:\Users\%USERNAME%\AppData\Roaming\Mozilla\Firefox\Profiles\bin\localstore.rdf
C:\Users\%USERNAME%\AppData\Roaming\Mozilla\Firefox\Profiles\bin\extensions.ini
C:\Users\%USERNAME%\AppData\Roaming\Mozilla\Firefox\Profiles\bin\extensions.sqlite
%WINDIR%\MacOS\api-ms-win-core-rtlsupport-l1-1-0.dll
%WINDIR%\MacOS\api-ms-win-service-core-l1-1-0.dll
%WINDIR%\MacOS\api-ms-win-service-management-l1-1-0.dll
%WINDIR%\MacOS\api-ms-win-security-lsalookup-l1-1-0.dll
%WINDIR%\MacOS\api-ms-win-security-sddl-l1-1-0.dll
%WINDIR%\MacOS\apilogen.dll
%WINDIR%\MacOS\apisetschema.dll
%WINDIR%\MacOS\api-ms-win-service-management-l2-1-0.dll
%WINDIR%\MacOS\api-ms-win-service-winsvc-l1-1-0.dll
%WINDIR%\MacOS\api-ms-win-core-sysinfo-l1-1-0.dll
%WINDIR%\MacOS\api-ms-win-core-threadpool-l1-1-0.dll
%WINDIR%\MacOS\api-ms-win-core-string-l1-1-0.dll
%WINDIR%\MacOS\api-ms-win-core-synch-l1-1-0.dll
%WINDIR%\MacOS\api-ms-win-core-xstate-l1-1-0.dll
%WINDIR%\MacOS\api-ms-win-security-base-l1-1-0.dll
%WINDIR%\MacOS\api-ms-win-core-ums-l1-1-0.dll
%WINDIR%\MacOS\api-ms-win-core-util-l1-1-0.dll
%WINDIR%\MacOS\aecache.dll
%WINDIR%\MacOS\amcompat.tlb
<LS_APPDATA>\Google\Chrome\User Data\Default\Preferences
%WINDIR%\MacOS\acproxy.dll
%WINDIR%\MacOS\api-ms-win-core-datetime-l1-1-0.dll
%APPDATA%\Opera\Opera\operaprefs.ini
C:\Users\%USERNAME%\AppData\Roaming\Opera\Opera\operaprefs.ini
%WINDIR%\MacOS\api-ms-win-core-console-l1-1-0.dll
%TEMP%\activeMail.exe
%TEMP%\MailRu.exe
%TEMP%\$inst\2.tmp
%TEMP%\$inst\temp_0.tmp
C:\Users\%USERNAME%\AppData\Local\Google\Chrome\User Data\Default\Preferences
%WINDIR%\MacOS\acledit.dll
%PROGRAM_FILES%\mail\mail\Uninstall.exe
%PROGRAM_FILES%\mail\mail\Uninstall.ini
%WINDIR%\MacOS\api-ms-win-core-debug-l1-1-0.dll
%WINDIR%\MacOS\api-ms-win-core-interlocked-l1-1-0.dll
C:\Users\%USERNAME%\AppData\Roaming\Mozilla\Firefox\Profiles\bin\chromeappsstore.sqlite
C:\Users\%USERNAME%\AppData\Roaming\Mozilla\Firefox\Profiles\bin\cert8.db
%WINDIR%\MacOS\api-ms-win-core-heap-l1-1-0.dll
%WINDIR%\MacOS\api-ms-win-core-libraryloader-l1-1-0.dll
C:\Users\%USERNAME%\AppData\Roaming\Mozilla\Firefox\Profiles\bin\content-prefs.sqlite
C:\Users\%USERNAME%\AppData\Roaming\Mozilla\Firefox\Profiles\bin\compatibility.ini
%WINDIR%\MacOS\api-ms-win-core-io-l1-1-0.dll
%WINDIR%\MacOS\api-ms-win-core-fibers-l1-1-0.dll
%APPDATA%\Mozilla\Firefox\profiles.ini
%WINDIR%\MacOS\api-ms-win-core-delayload-l1-1-0.dll
%WINDIR%\MacOS\api-ms-win-core-errorhandling-l1-1-0.dll
C:\Users\%USERNAME%\AppData\Roaming\Mozilla\Firefox\Profiles\bin\bookmarkbackups\bookmarks-2012-03-27.json
%WINDIR%\MacOS\api-ms-win-core-handle-l1-1-0.dll
%WINDIR%\MacOS\api-ms-win-core-file-l1-1-0.dll
C:\Users\%USERNAME%\AppData\Roaming\Mozilla\Firefox\profiles.ini