Trojan.DownLoader7.31726

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Windows Host Process Cleaner' = '%WINDIR%\regcleaner.exe'

Вредоносные функции:

Запускает на исполнение:

%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE http://oc######o.click21.com.br/correioprincipal.php

Изменения в файловой системе:

Создает следующие файлы:

%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\svreuniao_2[1].mp3
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\svgloss_2[1].mp3
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\svpadre_2[1].mp3
%WINDIR%\libeay32.dll
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\cliente[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\cliente[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\svlista_2[1].mp3
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\svgloss_3[1].mp3
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\svpadre_3[1].mp3
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\svtese_3[1].mp3
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\svreuniao_3[1].mp3
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\svtese_2[1].mp3
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\svlista_3[1].mp3
%WINDIR%\ssleay32.dll
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\correioprincipal[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\padre[1].dat
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\tese[1].dat
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\gloss[1].dat
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\lista[1].dat
%WINDIR%\iexplore.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\reuniao[1].dat
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\svpadre[1].dat
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\svtese[1].dat
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\cliente[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\svgloss[1].dat
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\svlista[1].dat
%WINDIR%\regcleaner.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\svreuniao[1].dat

Сетевая активность:

Подключается к:

'se#####et.com.sapo.pt':80
'vo####d.com.sapo.pt':80
'do###.#am-radio-op.net':80
'ne#####sa.com.sapo.pt':80
'oc######o.click21.com.br':80
'ms####e.com.sapo.pt':80
'localhost':1036
'localhost':1040
'li####n.com.sapo.pt':80

TCP:

Запросы HTTP GET:

li####n.com.sapo.pt/svreuniao_2.mp3
vo####d.com.sapo.pt/svgloss_2.mp3
se#####et.com.sapo.pt/svpadre_2.mp3
do###.#am-radio-op.net/cliente.php?to##############################################################################################################################################################################
do###.#am-radio-op.net/cliente.php?to############################################################################################################################################################################
ms####e.com.sapo.pt/svlista_2.mp3
vo####d.com.sapo.pt/svgloss_3.mp3
se#####et.com.sapo.pt/svpadre_3.mp3
ne#####sa.com.sapo.pt/svtese_3.mp3
ne#####sa.com.sapo.pt/svtese_2.mp3
ms####e.com.sapo.pt/svlista_3.mp3
li####n.com.sapo.pt/svreuniao_3.mp3
vo####d.com.sapo.pt/gloss.dat
se#####et.com.sapo.pt/padre.dat
ne#####sa.com.sapo.pt/tese.dat
ms####e.com.sapo.pt/lista.dat
li####n.com.sapo.pt/reuniao.dat
oc######o.click21.com.br/correioprincipal.php
se#####et.com.sapo.pt/svpadre.dat
ne#####sa.com.sapo.pt/svtese.dat
do###.#am-radio-op.net/cliente.php?to########################################################################################################################################################################
ms####e.com.sapo.pt/svlista.dat
li####n.com.sapo.pt/svreuniao.dat
vo####d.com.sapo.pt/svgloss.dat