Trojan.DownLoader8.35117

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%ALLUSERSPROFILE%\Start Menu\Programs\Startup\·Ѕ±гїмЛЩЛСЛч.lnk

Вредоносные функции:

Создает и запускает на исполнение:

%TEMP%\is-KQ5LV.tmp\setup1.tmp /SL5="$1013C,264094,51712,<SYSTEM32>\setup1.exe" /SUPPRESSMSGBOXES /VERYSILENT
<SYSTEM32>\setup1.exe /SUPPRESSMSGBOXES /VERYSILENT
%PROGRAM_FILES%\Win32Games\wingames.exe "http://re#.2xi.com/wgtbf"

Запускает на исполнение:

<SYSTEM32>\rundll32.exe "%PROGRAM_FILES%\Win32Games\URL.dll" helpme
<SYSTEM32>\rundll32.exe "%PROGRAM_FILES%\Win32Games\URL.dll" doset
<SYSTEM32>\regsvr32.exe syspowerues.dll /s
<SYSTEM32>\cmd.exe /c ""%PROGRAM_FILES%\Win32Games\aaa.bat" "
<SYSTEM32>\cmd.exe /c ""%PROGRAM_FILES%\Win32Games\doset.bat" "
<SYSTEM32>\cmd.exe /c ""%PROGRAM_FILES%\Win32Games\setup.bat" "

Изменения в файловой системе:

Создает следующие файлы:

%HOMEPATH%\Desktop\Intenet Exploer.ink
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Intenet Exploer.ink
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.ink
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\wgtbf[1]
%HOMEPATH%\Favorites\іЈУГ\ЧїФЅНш.url
%HOMEPATH%\Favorites\µ±µ±Нш.url
%HOMEPATH%\Favorites\іЈУГ\µ±µ±Нш.url
%PROGRAM_FILES%\·Ѕ±гїмЛЩЛСЛч\is-59SPV.tmp
%PROGRAM_FILES%\·Ѕ±гїмЛЩЛСЛч\is-1QOMQ.tmp
%TEMP%\is-FTML7.tmp\_isetup\_shfoldr.dll
%PROGRAM_FILES%\·Ѕ±гїмЛЩЛСЛч\is-HDQI0.tmp
%PROGRAM_FILES%\·Ѕ±гїмЛЩЛСЛч\unins000.dat
%ALLUSERSPROFILE%\Start Menu\Programs\·Ѕ±гїмЛЩЛСЛч\·Ѕ±гїмЛЩЛСЛч.lnk
<SYSTEM32>\helpme.ink
%HOMEPATH%\Favorites\ЧїФЅНш.url
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\I?OI?¤±u·a.ink
%HOMEPATH%\Desktop\I?OI?¤±u·a.ink
%HOMEPATH%\Favorites\ОчУОЎ¤±щ·в.url
%HOMEPATH%\Desktop\IO±¦Io?nEOIO?UCo.ink
%HOMEPATH%\Desktop\??OII·.ink
%HOMEPATH%\Favorites\РЎУОП·.url
%HOMEPATH%\Favorites\іЈУГ\РЎУОП·.url
%HOMEPATH%\Favorites\іЈУГ\ОчУОНш.url
%HOMEPATH%\Favorites\МФ±¦НшЅсИХМШјЫЗш.url
%HOMEPATH%\Favorites\іЈУГ\МФ±¦НшЅсИХМШјЫЗш.url
%HOMEPATH%\Favorites\ОчУОНш.url
%HOMEPATH%\Favorites\іЈУГ\ОчУОЎ¤±щ·в.url
%HOMEPATH%\Start Menu\Intenet Exploer.ink
%HOMEPATH%\Start Menu\IO±¦Io?nEOIO?UCo.ink
%PROGRAM_FILES%\Win32Games\jiuzhou.ico
%PROGRAM_FILES%\Win32Games\Internet.vbs
%PROGRAM_FILES%\Win32Games\dangdangwang.ico
%PROGRAM_FILES%\Win32Games\minigame.ico
%PROGRAM_FILES%\Win32Games\setup.exe
%PROGRAM_FILES%\Win32Games\setup.bat
%PROGRAM_FILES%\Win32Games\minigame.vbs
%PROGRAM_FILES%\Win32Games\2xi.vbs
%PROGRAM_FILES%\Win32Games\2xi.ico
%PROGRAM_FILES%\Win32Games\bb.tmp
%PROGRAM_FILES%\Win32Games\baidu.ico
%PROGRAM_FILES%\Win32Games\Config.ini
%PROGRAM_FILES%\Win32Games\bookmarks.dat
%PROGRAM_FILES%\Win32Games\bingfeng.ico
%PROGRAM_FILES%\Win32Games\syspowerues.dll
%PROGRAM_FILES%\Win32Games\doset.bat
%PROGRAM_FILES%\Win32Games\aaa.bat
%PROGRAM_FILES%\Win32Games\zhuoyue.ico
%TEMP%\is-KQ5LV.tmp\setup1.tmp
%TEMP%\is-FTML7.tmp\_isetup\_RegDLL.tmp
<SYSTEM32>\helpme.vbs
<SYSTEM32>\sysurl.dll
%PROGRAM_FILES%\Win32Games\Thumbs.db
%PROGRAM_FILES%\Win32Games\taobao.vbs
%PROGRAM_FILES%\Win32Games\taobao.ico
%PROGRAM_FILES%\Win32Games\URL.dll
%PROGRAM_FILES%\Win32Games\Xianjian.ico
%PROGRAM_FILES%\Win32Games\wingames.exe
%PROGRAM_FILES%\Win32Games\url.txt

Удаляет следующие файлы:

%TEMP%\is-KQ5LV.tmp\setup1.tmp
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Intenet Exploer.ink
%HOMEPATH%\Desktop\Intenet Exploer.ink
%TEMP%\is-FTML7.tmp\_isetup\_shfoldr.dll
%PROGRAM_FILES%\Win32Games\bb.tmp
%PROGRAM_FILES%\Win32Games\url.txt
%TEMP%\is-FTML7.tmp\_isetup\_RegDLL.tmp

Перемещает следующие файлы:

%PROGRAM_FILES%\·Ѕ±гїмЛЩЛСЛч\is-59SPV.tmp в %PROGRAM_FILES%\·Ѕ±гїмЛЩЛСЛч\FangBian.exe
%PROGRAM_FILES%\·Ѕ±гїмЛЩЛСЛч\is-HDQI0.tmp в %PROGRAM_FILES%\·Ѕ±гїмЛЩЛСЛч\GetMessage.dll
%PROGRAM_FILES%\·Ѕ±гїмЛЩЛСЛч\is-1QOMQ.tmp в %PROGRAM_FILES%\·Ѕ±гїмЛЩЛСЛч\unins000.exe
%PROGRAM_FILES%\Win32Games\syspowerues.dll в <SYSTEM32>\syspowerues.dll
%PROGRAM_FILES%\Win32Games\setup.exe в <SYSTEM32>\setup1.exe

Сетевая активность:

Подключается к: