Trojan.DownLoader9.48293

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'google' = '<LS_APPDATA>\contray.exe'

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\ipconfig.exe' /pid=3992
'<SYSTEM32>\ipconfig.exe' /pid=4052
'<SYSTEM32>\ipconfig.exe' /pid=2412
'<SYSTEM32>\ipconfig.exe' /pid=2856
'<SYSTEM32>\ipconfig.exe' /pid=3864
'<SYSTEM32>\ipconfig.exe' /pid=2792
'<SYSTEM32>\ipconfig.exe'
'<SYSTEM32>\ipconfig.exe' /pid=3140
'<SYSTEM32>\ipconfig.exe' %USERNAME%

Внедряет код в

следующие системные процессы:

<SYSTEM32>\svchost.exe
<SYSTEM32>\cmd.exe

Изменения в файловой системе:

Создает следующие файлы:

%WINDIR%\system\317187.txt
%WINDIR%\system\307390.txt
%WINDIR%\system\306875.txt
%WINDIR%\system\326328.txt
%WINDIR%\system\325796.txt
%WINDIR%\system\317750.txt
%WINDIR%\system\297828.txt
%WINDIR%\system\280078.txt
%WINDIR%\system\279562.txt
%WINDIR%\system\271859.txt
%WINDIR%\system\297265.txt
%WINDIR%\system\288750.txt
%WINDIR%\system\288234.txt
%WINDIR%\system\334765.txt
%WINDIR%\system\379609.txt
%WINDIR%\system\371031.txt
%WINDIR%\system\369500.txt
%WINDIR%\system\388968.txt
%WINDIR%\system\388437.txt
%WINDIR%\system\380125.txt
%WINDIR%\system\360984.txt
%WINDIR%\system\343546.txt
%WINDIR%\system\343031.txt
%WINDIR%\system\335281.txt
%WINDIR%\system\360453.txt
%WINDIR%\system\352468.txt
%WINDIR%\system\351921.txt
%WINDIR%\system\185937.txt
%WINDIR%\system\185453.txt
%WINDIR%\system\177125.txt
%WINDIR%\system\202468.txt
%WINDIR%\system\194281.txt
%WINDIR%\system\193781.txt
%WINDIR%\system\176640.txt
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\crnjeufu[1].txt
%WINDIR%\system\info.txt
<LS_APPDATA>\~temp.dat
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\crnjeufu[1].txt
%WINDIR%\system\168687.txt
%WINDIR%\system\168187.txt
%WINDIR%\system\203031.txt
%WINDIR%\system\255125.txt
%WINDIR%\system\254625.txt
%WINDIR%\system\245156.txt
%WINDIR%\system\271359.txt
%WINDIR%\system\263218.txt
%WINDIR%\system\262718.txt
%WINDIR%\system\244609.txt
%WINDIR%\system\220328.txt
%WINDIR%\system\211281.txt
%WINDIR%\system\210687.txt
%WINDIR%\system\230875.txt
%WINDIR%\system\228656.txt
%WINDIR%\system\220843.txt

Удаляет следующие файлы:

%WINDIR%\system\317750.txt
%WINDIR%\system\317187.txt
%WINDIR%\system\307390.txt
%WINDIR%\system\334765.txt
%WINDIR%\system\326328.txt
%WINDIR%\system\325796.txt
%WINDIR%\system\306875.txt
%WINDIR%\system\288234.txt
%WINDIR%\system\280078.txt
%WINDIR%\system\279562.txt
%WINDIR%\system\297828.txt
%WINDIR%\system\297265.txt
%WINDIR%\system\288750.txt
%WINDIR%\system\379609.txt
%WINDIR%\system\371031.txt
%WINDIR%\system\369500.txt
%WINDIR%\system\388968.txt
%WINDIR%\system\388437.txt
%WINDIR%\system\380125.txt
%WINDIR%\system\360984.txt
%WINDIR%\system\343546.txt
%WINDIR%\system\343031.txt
%WINDIR%\system\335281.txt
%WINDIR%\system\360453.txt
%WINDIR%\system\352468.txt
%WINDIR%\system\351921.txt
%WINDIR%\system\271859.txt
%WINDIR%\system\193781.txt
%WINDIR%\system\185937.txt
%WINDIR%\system\185453.txt
%WINDIR%\system\203031.txt
%WINDIR%\system\202468.txt
%WINDIR%\system\194281.txt
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\crnjeufu[1].txt
%WINDIR%\system\info.txt
%WINDIR%\system\168687.txt
%WINDIR%\system\168187.txt
%WINDIR%\system\177125.txt
%WINDIR%\system\176640.txt
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\crnjeufu[1].txt
%WINDIR%\system\255125.txt
%WINDIR%\system\254625.txt
%WINDIR%\system\245156.txt
%WINDIR%\system\271359.txt
%WINDIR%\system\263218.txt
%WINDIR%\system\262718.txt
%WINDIR%\system\244609.txt
%WINDIR%\system\220328.txt
%WINDIR%\system\211281.txt
%WINDIR%\system\210687.txt
%WINDIR%\system\230875.txt
%WINDIR%\system\228656.txt
%WINDIR%\system\220843.txt