Trojan.Hosts.50324

Техническая информация

Изменения в файловой системе

Создает следующие файлы

%TEMP%\is-fl50t.tmp\<Имя файла>.tmp
%TEMP%\is-mkgh6.tmp\secure_eraser\is-fvk08.tmp
%TEMP%\is-mkgh6.tmp\secure_eraser\is-k3ms8.tmp
%TEMP%\is-mkgh6.tmp\secure_eraser\is-o9ksd.tmp
%TEMP%\is-mkgh6.tmp\secure_eraser\is-2r12d.tmp
%TEMP%\is-mkgh6.tmp\secure_eraser\is-j1kqo.tmp
%TEMP%\is-mkgh6.tmp\secure_eraser\is-2jhnm.tmp
%TEMP%\is-mkgh6.tmp\secure_eraser\is-jqsmb.tmp
%TEMP%\is-mkgh6.tmp\secure_eraser\is-qccom.tmp
%TEMP%\is-mkgh6.tmp\secure_eraser\is-skpjo.tmp
%TEMP%\is-mkgh6.tmp\secure_eraser\is-sg0rn.tmp
%TEMP%\is-mkgh6.tmp\secure_eraser\is-rhcfr.tmp
%TEMP%\is-mkgh6.tmp\secure_eraser\adminpack\is-dajhl.tmp
%TEMP%\is-mkgh6.tmp\secure_eraser\adminpack\is-l9vd1.tmp
%TEMP%\is-mkgh6.tmp\secure_eraser\adminpack\is-77dh3.tmp
%TEMP%\is-mkgh6.tmp\secure_eraser\is-pl5j8.tmp
%TEMP%\is-mkgh6.tmp\secure_eraser\is-2vh5n.tmp
%TEMP%\is-mkgh6.tmp\secure_eraser\is-9brkk.tmp
%TEMP%\is-mkgh6.tmp\secure_eraser\is-2eu6h.tmp
%TEMP%\is-mkgh6.tmp\secure_eraser\is-j6q5v.tmp
%TEMP%\is-psrdt.tmp\_isetup\_shfoldr.dll
%TEMP%\is-psrdt.tmp\_isetup\_isdecmp.dll
%TEMP%\is-r725h.tmp\<Имя файла>.tmp
%TEMP%\is-mkgh6.tmp\_isetup\_setup64.tmp
%TEMP%\is-mkgh6.tmp\_isetup\_shfoldr.dll
%TEMP%\is-mkgh6.tmp\_isetup\_isdecmp.dll
<DRIVERS>\etc\hosts.backup
%TEMP%\is-mkgh6.tmp\secure_eraser\is-1tgeq.tmp
%TEMP%\is-mkgh6.tmp\secure_eraser\is-ir7p6.tmp
%TEMP%\is-mkgh6.tmp\secure_eraser\is-0nkhr.tmp
%TEMP%\is-mkgh6.tmp\secure_eraser\is-09jfd.tmp
%TEMP%\is-mkgh6.tmp\secure_eraser\is-ofd4e.tmp
%TEMP%\is-mkgh6.tmp\secure_eraser\is-9hgjq.tmp
%TEMP%\is-mkgh6.tmp\secure_eraser\is-53q02.tmp
%TEMP%\is-mkgh6.tmp\secure_eraser\is-pd8pg.tmp
%TEMP%\is-psrdt.tmp\_isetup\_setup64.tmp
%TEMP%\is-mkgh6.tmp\secure_eraser\is-6cgic.tmp
<DRIVERS>\etc\hosts.rollback

Удаляет следующие файлы

%TEMP%\is-psrdt.tmp\_isetup\_isdecmp.dll
%TEMP%\is-psrdt.tmp\_isetup\_setup64.tmp
%TEMP%\is-psrdt.tmp\_isetup\_shfoldr.dll
%TEMP%\is-fl50t.tmp\<Имя файла>.tmp

Перемещает следующие файлы

%TEMP%\is-mkgh6.tmp\secure_eraser\is-ir7p6.tmp в %TEMP%\is-mkgh6.tmp\secure_eraser\arabic.ini
%TEMP%\is-mkgh6.tmp\secure_eraser\adminpack\is-dajhl.tmp в %TEMP%\is-mkgh6.tmp\secure_eraser\adminpack\elevate guide.html
%TEMP%\is-mkgh6.tmp\secure_eraser\is-rhcfr.tmp в %TEMP%\is-mkgh6.tmp\secure_eraser\turkish.ini
%TEMP%\is-mkgh6.tmp\secure_eraser\is-sg0rn.tmp в %TEMP%\is-mkgh6.tmp\secure_eraser\seraser.exe
%TEMP%\is-mkgh6.tmp\secure_eraser\is-skpjo.tmp в %TEMP%\is-mkgh6.tmp\secure_eraser\secureeraserportable.iss
%TEMP%\is-mkgh6.tmp\secure_eraser\is-1tgeq.tmp в %TEMP%\is-mkgh6.tmp\secure_eraser\russian.ini
%TEMP%\is-mkgh6.tmp\secure_eraser\is-qccom.tmp в %TEMP%\is-mkgh6.tmp\secure_eraser\portuguese.ini
%TEMP%\is-mkgh6.tmp\secure_eraser\is-2jhnm.tmp в %TEMP%\is-mkgh6.tmp\secure_eraser\polish.ini
%TEMP%\is-mkgh6.tmp\secure_eraser\is-j1kqo.tmp в %TEMP%\is-mkgh6.tmp\secure_eraser\nederlands.ini
%TEMP%\is-mkgh6.tmp\secure_eraser\is-2r12d.tmp в %TEMP%\is-mkgh6.tmp\secure_eraser\mftutils.dll
%TEMP%\is-mkgh6.tmp\secure_eraser\is-o9ksd.tmp в %TEMP%\is-mkgh6.tmp\secure_eraser\korean.ini
%TEMP%\is-mkgh6.tmp\secure_eraser\is-k3ms8.tmp в %TEMP%\is-mkgh6.tmp\secure_eraser\italiano.ini
%TEMP%\is-mkgh6.tmp\secure_eraser\is-fvk08.tmp в %TEMP%\is-mkgh6.tmp\secure_eraser\icon.ico
%TEMP%\is-mkgh6.tmp\secure_eraser\is-2vh5n.tmp в %TEMP%\is-mkgh6.tmp\secure_eraser\hungarian.ini
%TEMP%\is-mkgh6.tmp\secure_eraser\is-pl5j8.tmp в %TEMP%\is-mkgh6.tmp\secure_eraser\greek.ini
%TEMP%\is-mkgh6.tmp\secure_eraser\is-9brkk.tmp в %TEMP%\is-mkgh6.tmp\secure_eraser\giveaway.txt
%TEMP%\is-mkgh6.tmp\secure_eraser\is-2eu6h.tmp в %TEMP%\is-mkgh6.tmp\secure_eraser\giveaway.png
%TEMP%\is-mkgh6.tmp\secure_eraser\is-j6q5v.tmp в %TEMP%\is-mkgh6.tmp\secure_eraser\francais.ini
%TEMP%\is-mkgh6.tmp\secure_eraser\is-pd8pg.tmp в %TEMP%\is-mkgh6.tmp\secure_eraser\espaГ±ol.ini
%TEMP%\is-mkgh6.tmp\secure_eraser\is-53q02.tmp в %TEMP%\is-mkgh6.tmp\secure_eraser\english.pdf
%TEMP%\is-mkgh6.tmp\secure_eraser\is-9hgjq.tmp в %TEMP%\is-mkgh6.tmp\secure_eraser\english.ini
%TEMP%\is-mkgh6.tmp\secure_eraser\is-ofd4e.tmp в %TEMP%\is-mkgh6.tmp\secure_eraser\deutsch.pdf
%TEMP%\is-mkgh6.tmp\secure_eraser\is-09jfd.tmp в %TEMP%\is-mkgh6.tmp\secure_eraser\deutsch.ini
%TEMP%\is-mkgh6.tmp\secure_eraser\is-0nkhr.tmp в %TEMP%\is-mkgh6.tmp\secure_eraser\czech.ini
%TEMP%\is-mkgh6.tmp\secure_eraser\is-6cgic.tmp в %TEMP%\is-mkgh6.tmp\secure_eraser\chinese.ini
%TEMP%\is-mkgh6.tmp\secure_eraser\is-jqsmb.tmp в %TEMP%\is-mkgh6.tmp\secure_eraser\bulgarian.ini
%TEMP%\is-mkgh6.tmp\secure_eraser\adminpack\is-l9vd1.tmp в %TEMP%\is-mkgh6.tmp\secure_eraser\adminpack\elevate.exe
%TEMP%\is-mkgh6.tmp\secure_eraser\adminpack\is-77dh3.tmp в %TEMP%\is-mkgh6.tmp\secure_eraser\adminpack\hosts.exe

Изменяет файл HOSTS.

Сетевая активность

Подключается к

'localhost':443

Другое

Создает и запускает на исполнение

'%TEMP%\is-fl50t.tmp\<Имя файла>.tmp' /SL5="$D0018,6255974,411648,<Полный путь к файлу>"
'%TEMP%\is-r725h.tmp\<Имя файла>.tmp' /SL5="$D022E,6255974,411648,<Полный путь к файлу>" /VERYSILENT /NORESTART /SUPPRESSMSGBOXES
'%TEMP%\is-mkgh6.tmp\secure_eraser\adminpack\hosts.exe' add 127.0.0.1 www.as##mp.de
'%TEMP%\is-mkgh6.tmp\secure_eraser\seraser.exe'
'%TEMP%\is-mkgh6.tmp\secure_eraser\adminpack\hosts.exe' add 127.0.0.1 www.as##mp.de' (со скрытым окном)
'%TEMP%\is-mkgh6.tmp\secure_eraser\seraser.exe' ' (со скрытым окном)