Trojan.DownLoader7.27733

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] '*toxicfree' = '%PROGRAM_FILES%\ToxicFree\toxicSafe.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'ToxicUpdate' = '%PROGRAM_FILES%\ToxicFree\ToxicUpdate.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'winsxstf' = '%PROGRAM_FILES%\toxicfree\smss.exe'

Вредоносные функции:

Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\toxicfree\toxickcsc.exe' = '%PROGRAM_FILES%\toxicfree\toxickcsc.exe:*:Enabled:VMS_PORT_sxs106'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\toxicfree\toxicupdate.exe' = '%PROGRAM_FILES%\toxicfree\toxicupdate.exe:*:Enabled:VMS_PORT_sxs102'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%WINDIR%\temp\toxicview.exe' = '%WINDIR%\temp\toxicview.exe:*:Enabled:VMS_PORT_sxs103'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%ALLUSERSPROFILE%\Start Menu\Programs\Startup\ToxicFree.exe' = '%ALLUSERSPROFILE%\Start Menu\Programs\Startup\ToxicFree.exe:*:Enabled:VMS_PORT_sxs105'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%WINDIR%\temp\smstf.exe' = '%WINDIR%\temp\smstf.exe:*:Enabled:VMS_PORT_sxs104'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\toxicfree\toxicfree.exe' = '%PROGRAM_FILES%\toxicfree\toxicfree.exe:*:Enabled:VMS_PORT_sxs101'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '<SYSTEM32>\winsxsrf.exe' = '<SYSTEM32>\winsxstf.exe:*:Enabled:winsxsrf'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\toxicfree\smss.exe' = '%PROGRAM_FILES%\toxicfree\smss.exe:*:Enabled:winsxstf'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '<SYSTEM32>\wintfcap.exe' = '<SYSTEM32>\wintfcap.exe:*:Enabled:wintfcap'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '<SYSTEM32>\rundll321.exe' = '<SYSTEM32>\rundll321.exe:*:Enabled:VMS_WIN1'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '<SYSTEM32>\vrftfsvc.exe' = '<SYSTEM32>\vrftfsvc.exe:*:Enabled:VMS_WIN'

Для затруднения выявления своего присутствия в системе

блокирует запуск следующих системных утилит:

Диспетчера задач (Taskmgr)

Создает и запускает на исполнение:

<SYSTEM32>\7zip.exe x ToxicBlock.zip
<SYSTEM32>\7zip.exe (загружен из сети Интернет)

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\ToxicFree\Setup\ToxicFree.dat
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ToxicBlock[1].zip
%PROGRAM_FILES%\ToxicFree\Setup\ToxicBlock.zip
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\MZђ[1]
%PROGRAM_FILES%\ToxicFree\MZђ
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\ToxicFree[1].dat
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\7zip[1].exe
%PROGRAM_FILES%\ToxicFree\ToxicUpdateLog.txt
%WINDIR%\Application Data\WinSxS\$security_1.0.1_SxS\tfIcon.exe
%WINDIR%\Application Data\WinSxS\$security_1.0.1_SxS\WinSxS4.dat
<SYSTEM32>\7zip.exe
%WINDIR%\Application Data\WinSxS\$security_1.0.1_SxS\tfMain.INI
%WINDIR%\Application Data\WinSxS\$security_1.0.1_SxS\tfProcess.INI
%PROGRAM_FILES%\ToxicFree\ExeList.txt
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\7z[1].dll
<SYSTEM32>\7z.dll
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\GreenINet_v260[1].dll
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\7-zip[1].dll
<SYSTEM32>\7-zip.dll
<SYSTEM32>\GreenINet_v260.dll
%WINDIR%\Application Data\WinSxS\$security_1.0.1_SxS\Update_Run.txt
%WINDIR%\Application Data\WinSxS\$security_1.0.1_SxS\FileUnLock_Req.txt
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\ExeList[1].txt
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\ToxicIcon[1].exe
%PROGRAM_FILES%\ToxicFree\ToxicIcon.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ToxicFree[1].lnk

Удаляет следующие файлы:

%WINDIR%\Application Data\WinSxS\$security_1.0.1_SxS\Update_Run.txt
%PROGRAM_FILES%\ToxicFree\ExeList.txt
%TEMP%\~DFC6C6.tmp
%WINDIR%\Application Data\WinSxS\$security_1.0.1_SxS\FileUnLock_Req.txt
%PROGRAM_FILES%\ToxicFree\Setup\ToxicBlock.zip
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ToxicFree[1].lnk
%WINDIR%\Application Data\WinSxS\$security_1.0.1_SxS\tfProcess.INI
%WINDIR%\Application Data\WinSxS\$security_1.0.1_SxS\tfMain.INI

Сетевая активность:

Подключается к: