Trojan.DownLoader46.2376

Техническая информация

Вредоносные функции

Создает и запускает на исполнение

'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' -noautoupdate --ran-launcher -- http://www.chrisqueen.com/cb/LAYANDWIN/program
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' -noautoupdate --ran-launcher -- http://www.chrisqueen.com/cb/LAYANDWIN/program /crash-reporter-parent-id=2308
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=gpu-process --channel="2308.0.1107795938\515516841" --enable-proprietary-media-types-playback --supports-dual-gpus=false --gpu-driver-bug-workarounds=1,19,42 --gpu-vendor-id=0x0000 --gpu...
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=renderer --alt-high-dpi-setting=96 --disable-direct-npapi-requests --enable-deferred-image-decoding --lang=en-US --enable-proprietary-media-types-playback --disable-client-side-phishing-...
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=renderer --alt-high-dpi-setting=96 --disable-direct-npapi-requests --enable-deferred-image-decoding --lang=en-US --enable-proprietary-media-types-playback --extension-process --enable-we...
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2308.4.535744260\1158400759" --lang=en-US --no-sandbox --enable-proprietary-media-types-playback /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2308.5.1395254500\2012944071" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2308.6.229907473\2028635966" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2308.7.1577570317\1348557377" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2308.8.163622036\554735896" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2308.9.2104335336\1575727566" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' --type=utility --channel="2308.4.535744260\1158400759" --lang=en-US --no-sandbox --enable-proprietary-media-types-playback /prefetch:-645351001 /crash-reporter-parent-id=1284
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2308.10.515216583\932368530" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2308.11.720935945\1698740982" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2308.12.1894610165\160421274" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2308.15.413491611\694616149" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001

Изменения в файловой системе

Создает следующие файлы

%TEMP%\etilqs_okvmuctjjmjk0ix
%TEMP%\etilqs_hn7jnbug8ujqqyt
%TEMP%\etilqs_b1hqzlk89hpjnua
%TEMP%\etilqs_xrqaywuq1fygfvz
%TEMP%\etilqs_talavkn1l5tprj9
%TEMP%\etilqs_ki9745nyet78kqz
%TEMP%\etilqs_h0n66sderfl269k
%TEMP%\etilqs_nzhaqdbzsndqgcy
%TEMP%\etilqs_acnji42mwfqhsve
%TEMP%\etilqs_scw3aa11cj54jra
%TEMP%\8473.tmp
%TEMP%\9b5a.tmp

Удаляет следующие файлы

%TEMP%\8473.tmp
%TEMP%\9b5a.tmp

Сетевая активность

Подключается к

'au######te.geo.opera.com':80
'fa###ook.com':80
'ch###queen.com':80
'do#####d3.operacdn.com':443
'ya###.opera.com':80
're###.opera.com':80
'si#####ck2.opera.com':80
'en.###ipedia.org':443
'bl#####st.rkn.gov.ru':80
'se####.yahoo.com':443
'en.###ipedia.org':80
'bing.com':80
'am##on.com':80
'du###uckgo.com':443
'se####.yahoo.com':80
'google.com':80
'au######te.geo.opera.com':443
'am##on.com':443
'bl#####st.rkn.gov.ru':443

TCP

Запросы HTTP GET

http://au######te.geo.opera.com/geolocation/
http://www.google.com/favicon.ico
http://se####.yahoo.com/favicon.ico
http://www.am##on.com/favicon.ico
http://www.bing.com/s/a/bing_p.ico
http://en.###ipedia.org/favicon.ico
http://si#####ck2.opera.com/?ho###################################################
http://re###.opera.com/www.opera.com/firstrun/
http://si#####ck2.opera.com/?ho######################################################
http://ya###.opera.com/favicon.ico
http://www.ch###queen.com/cb/LAYANDWIN/program
http://re###.opera.com/speeddials/partner/facebook
http://www.fa###ook.com/campaign/landing.php?ca#########################
http://bl#####st.rkn.gov.ru/