Trojan.DownLoader9.50441

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Classes\Shareman.xpart\shell\open\command] '' = '%PROGRAM_FILES%\Shareman\Shareman.exe "%1"'
[<HKLM>\SOFTWARE\Classes\Shareman.Track\shell\open\command] '' = '%PROGRAM_FILES%\Shareman\Shareman.exe "%1"'

Вредоносные функции:

Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\Shareman\Shareman.exe' = '%PROGRAM_FILES%\Shareman\Shareman.exe:*:Enabled:Shareman'

Создает и запускает на исполнение:

'%PROGRAM_FILES%\Shareman\Shareman.exe'

Изменения в файловой системе:

Создает следующие файлы:

%HOMEPATH%\Desktop\Shareman.lnk
%HOMEPATH%\Start Menu\Shareman.lnk
%PROGRAM_FILES%\Shareman\smiles\_approval.zip
%PROGRAM_FILES%\Shareman\smiles\bw.gif
%PROGRAM_FILES%\Shareman\smiles\_define.ini
%APPDATA%\Shareman\Catalog\errmsg.sys
%APPDATA%\Shareman\Catalog\db\db.opt
%APPDATA%\Shareman\Catalog\cp1251.xml
%PROGRAM_FILES%\Shareman\Shareman.upgrade.exe
%APPDATA%\Shareman\Catalog\Index.xml
%PROGRAM_FILES%\Shareman\smiles\bp.gif
%PROGRAM_FILES%\Shareman\smiles\bq.gif
%PROGRAM_FILES%\Shareman\smiles\bo.gif
%PROGRAM_FILES%\Shareman\smiles\bm.gif
%PROGRAM_FILES%\Shareman\smiles\bn.gif
%PROGRAM_FILES%\Shareman\smiles\bu.gif
%PROGRAM_FILES%\Shareman\smiles\bv.gif
%PROGRAM_FILES%\Shareman\smiles\bt.gif
%PROGRAM_FILES%\Shareman\smiles\br.gif
%PROGRAM_FILES%\Shareman\smiles\bs.gif
%APPDATA%\Shareman\Catalog\db\list.MYI
%APPDATA%\Shareman\Catalog\db\message.frm
%APPDATA%\Shareman\Catalog\db\list.frm
%APPDATA%\Shareman\Catalog\db\param.frm
%APPDATA%\Shareman\Catalog\db\param.MYI
%APPDATA%\Shareman\Catalog\db\param.MYD
%APPDATA%\Shareman\Shareman.ClientKey.reg
%APPDATA%\Shareman\Catalog\db\operation.MYI
%APPDATA%\Shareman\Catalog\db\message.MYI
%APPDATA%\Shareman\Catalog\db\operation.frm
%APPDATA%\Shareman\Catalog\db\unit.MYI
%APPDATA%\Shareman\Catalog\db\ihash.frm
%APPDATA%\Shareman\Catalog\db\unit.frm
%APPDATA%\Shareman\Catalog\db\title.frm
%APPDATA%\Shareman\Catalog\db\title.MYI
%APPDATA%\Shareman\Catalog\db\ppart.frm
%APPDATA%\Shareman\Catalog\db\ppart.MYI
%APPDATA%\Shareman\Catalog\db\phash.MYI
%APPDATA%\Shareman\Catalog\db\ihash.MYI
%APPDATA%\Shareman\Catalog\db\phash.frm
%PROGRAM_FILES%\Shareman\smiles\al.gif
%PROGRAM_FILES%\Shareman\smiles\am.gif
%PROGRAM_FILES%\Shareman\smiles\ak.gif
%PROGRAM_FILES%\Shareman\smiles\ai.gif
%PROGRAM_FILES%\Shareman\smiles\aj.gif
%PROGRAM_FILES%\Shareman\smiles\aq.gif
%PROGRAM_FILES%\Shareman\smiles\ar.gif
%PROGRAM_FILES%\Shareman\smiles\ap.gif
%PROGRAM_FILES%\Shareman\smiles\an.gif
%PROGRAM_FILES%\Shareman\smiles\ao.gif
%PROGRAM_FILES%\Shareman\smiles\ab.gif
%PROGRAM_FILES%\Shareman\smiles\ac.gif
%PROGRAM_FILES%\Shareman\smiles\aa.gif
%PROGRAM_FILES%\Shareman\catalog.dll
%PROGRAM_FILES%\Shareman\Shareman.exe
%PROGRAM_FILES%\Shareman\smiles\ag.gif
%PROGRAM_FILES%\Shareman\smiles\ah.gif
%PROGRAM_FILES%\Shareman\smiles\af.gif
%PROGRAM_FILES%\Shareman\smiles\ad.gif
%PROGRAM_FILES%\Shareman\smiles\ae.gif
%PROGRAM_FILES%\Shareman\smiles\bf.gif
%PROGRAM_FILES%\Shareman\smiles\bg.gif
%PROGRAM_FILES%\Shareman\smiles\be.gif
%PROGRAM_FILES%\Shareman\smiles\bc.gif
%PROGRAM_FILES%\Shareman\smiles\bd.gif
%PROGRAM_FILES%\Shareman\smiles\bk.gif
%PROGRAM_FILES%\Shareman\smiles\bl.gif
%PROGRAM_FILES%\Shareman\smiles\bj.gif
%PROGRAM_FILES%\Shareman\smiles\bh.gif
%PROGRAM_FILES%\Shareman\smiles\bi.gif
%PROGRAM_FILES%\Shareman\smiles\av.gif
%PROGRAM_FILES%\Shareman\smiles\aw.gif
%PROGRAM_FILES%\Shareman\smiles\au.gif
%PROGRAM_FILES%\Shareman\smiles\as.gif
%PROGRAM_FILES%\Shareman\smiles\at.gif
%PROGRAM_FILES%\Shareman\smiles\ba.gif
%PROGRAM_FILES%\Shareman\smiles\bb.gif
%PROGRAM_FILES%\Shareman\smiles\az.gif
%PROGRAM_FILES%\Shareman\smiles\ax.gif
%PROGRAM_FILES%\Shareman\smiles\ay.gif

Удаляет следующие файлы:

%PROGRAM_FILES%\Shareman\Shareman.upgrade.exe

Перемещает следующие файлы:

%PROGRAM_FILES%\Shareman\Shareman.upgrade.exe в %PROGRAM_FILES%\Shareman\Shareman.exe
%PROGRAM_FILES%\Shareman\Shareman.exe в %PROGRAM_FILES%\Shareman\Shareman.upgrade.exe

Сетевая активность:

Подключается к: