Trojan.KillProc.23547

Техническая информация

Вредоносные функции:

Запускает на исполнение:

<SYSTEM32>\reg.exe Add "HKLM\SOFTWARE\Thunder Network\ThunderOem\thunder_backwnd" /v "dir" /d "<Текущая директория>\\" /f
<SYSTEM32>\reg.exe Add "HKLM\SOFTWARE\Thunder Network\ThunderOem\thunder_backwnd" /v "instdir" /d "<Текущая директория>\\" /f
<SYSTEM32>\reg.exe Add "HKLM\SOFTWARE\Thunder Network\ThunderOem\thunder_backwnd" /v "addinsdir" /d "<Текущая директория>\Addins" /f
<SYSTEM32>\reg.exe Add "HKLM\SOFTWARE\Thunder Network\ThunderOem\thunder_backwnd" /v "Path" /d "<Текущая директория>\Program\Thunder.exe" /f
<SYSTEM32>\regsvr32.exe /s BHO\ThunderAgent.dll
<SYSTEM32>\regsvr32.exe /s BHO\XunLeiBHO.dll
<SYSTEM32>\regsvr32.exe /s BHO\LinkSimulate.dll
<SYSTEM32>\reg.exe Add "HKLM\SOFTWARE\Thunder Network\ThunderOem\thunder_backwnd" /v "Version" /d "7.2.12.3824" /f
<SYSTEM32>\reg.exe Add "HKCU\Software\Microsoft\Internet Explorer\MenuExt\╩╣╙├╤╕└╫└ы╧▀╧┬╘╪" /ve /d "<Текущая директория>\BHO\OfflineDownload.htm" /f
<SYSTEM32>\reg.exe Add "HKCU\Software\Microsoft\Internet Explorer\MenuExt\╩╣╙├╤╕└╫└ы╧▀╧┬╘╪" /v "Contexts" /t REG_DWORD /d "0x00000022" /f
<SYSTEM32>\mshta.exe VBScript:Execute("Set a=CreateObject(""WScript.Shell""):Set b=a.CreateShortcut(""%ALLUSERSPROFILE%\╫└├ц\╤╕└╫7.lnk""):b.TargetPath=""<Текущая директория>\Program\Thunder.exe"":b.WorkingDirectory=""<Текущая директория>\Program"":b.Description=""╞Ї╢п╤╕└╫7"":b.Save:close")
<SYSTEM32>\reg.exe Add "HKCU\Software\Microsoft\Internet Explorer\MenuExt\╩╣╙├╤╕└╫╧┬╘╪╚л▓┐┴┤╜╙" /v "Contexts" /t REG_DWORD /d "0x000000f3"
<SYSTEM32>\reg.exe Add "HKCU\Software\Microsoft\Internet Explorer\MenuExt\╩╣╙├╤╕└╫╧┬╘╪" /ve /d "<Текущая директория>\BHO\geturl.htm" /f
<SYSTEM32>\reg.exe Add "HKCU\Software\Microsoft\Internet Explorer\MenuExt\╩╣╙├╤╕└╫╧┬╘╪" /v "Contexts" /t REG_DWORD /d "0x00000022"
<SYSTEM32>\reg.exe Add "HKCU\Software\Microsoft\Internet Explorer\MenuExt\╩╣╙├╤╕└╫╧┬╘╪╚л▓┐┴┤╜╙" /ve /d "<Текущая директория>\BHO\getAllurl.htm"
<SYSTEM32>\xcopy.exe /e /y /i "%ALLUSERSPROFILE%\Application Data\XMP4" "%ALLUSERSPROFILE%\Application Data\Thunder Network\XMP4"
<SYSTEM32>\regsvr32.exe /s /u BHO\ThunderAgent.dll
<SYSTEM32>\regsvr32.exe /s /u BHO\XunLeiBHO.dll
<SYSTEM32>\regsvr32.exe /s /u BHO\LinkSimulate.dll
<SYSTEM32>\ping.exe -n 2 127.1
<SYSTEM32>\cmd.exe /c <Текущая директория>\绿化.bat
<SYSTEM32>\taskkill.exe /f /im Thunder*
<SYSTEM32>\ping.exe 127.0.0.1 -n 3
<SYSTEM32>\reg.exe Delete "HKCR\Software\thunder" /f
<SYSTEM32>\reg.exe Delete "HKCU\Software\Microsoft\Internet Explorer\MenuExt\╩╣╙├╤╕└╫╧┬╘╪╚л▓┐┴┤╜╙" /f
<SYSTEM32>\reg.exe Delete "HKCU\Software\Microsoft\Internet Explorer\MenuExt\╩╣╙├╤╕└╫└ы╧▀╧┬╘╪" /f
<SYSTEM32>\attrib.exe +s +r +h Data
<SYSTEM32>\reg.exe Delete "HKCU\Software\Microsoft\Internet Explorer\MenuExt\╩╣╙├╤╕└╫╧┬╘╪" /f
<SYSTEM32>\reg.exe Delete "HKLM\Software\Thunder Network" /f
<SYSTEM32>\reg.exe Delete "HKCU\Software\Thunder Network" /f
<SYSTEM32>\reg.exe Delete "HKLM\Software\Wow6432Node\Thunder Network" /f