Trojan.DownLoader22.53344

Техническая информация

Для обеспечения автозапуска и распространения

Создает или изменяет следующие файлы

%APPDATA%\microsoft\windows\start menu\programs\startup\gicxgdhqiqgn.lnk

Вредоносные функции

Внедряет код в

следующие системные процессы:

%WINDIR%\syswow64\wscript.exe

Ищет ветки реестра, отвечающие за хранение паролей сторонними программами

[HKCU\Software\Far\Plugins\FTP\Hosts]
[HKCU\Software\SimonTatham\PuTTY\Sessions]
[HKCU\Software\LinasFTP\Site Manager]
[HKLM\SOFTWARE\Robo-FTP 3.7\Scripts]
[HKLM\SOFTWARE\Wow6432Node\Robo-FTP 3.7\Scripts]
[HKCU\SOFTWARE\Robo-FTP 3.7\Scripts]
[HKLM\SOFTWARE\Wow6432Node\Robo-FTP 3.7\FTPServers]
[HKCU\SOFTWARE\Robo-FTP 3.7\FTPServers]
[HKCU\Software\FlashPeak\BlazeFtp\Settings]
[HKLM\Software\Wow6432Node\South River Technologies\WebDrive\Connections]
[HKLM\Software\Wow6432Node\Martin Prikryl]
[HKCU\Software\CoffeeCup Software]
[HKCU\Software\Martin Prikryl]
[HKLM\Software\Wow6432Node\SoftX.org\FTPClient\Sites]
[HKCU\Software\SoftX.org\FTPClient\Sites]
[HKLM\Software\Wow6432Node\FTPClient\Sites]
[HKCU\Software\FTPClient\Sites]
[HKLM\SOFTWARE\Wow6432Node\NCH Software\Fling\Accounts]
[HKCU\SOFTWARE\NCH Software\Fling\Accounts]
[HKCU\Software\NCH Software\ClassicFTP\FTPAccounts]
[HKCU\Software\South River Technologies\WebDrive\Connections]
[HKCU\Software\BulletProof Software\BulletProof FTP Client\Options]
[HKLM\Software\Wow6432Node\CoffeeCup Software]
[HKCU\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts]
[HKLM\Software\Microsoft\Internet Account Manager]
[HKLM\Software\Wow6432Node\Microsoft\Internet Account Manager]
[HKCU\Identities\{1BBA5DCD-58F3-46AE-861D-68CF42722C36}\Software\Microsoft\Internet Account Manager\Accounts]
[HKCU\Software\Microsoft\Internet Account Manager\Accounts]
[HKLM\Software\RIT\The Bat!\Users depot]
[HKLM\Software\Wow6432Node\RIT\The Bat!\Users depot]
[HKLM\Software\RIT\The Bat!]
[HKLM\Software\Wow6432Node\RIT\The Bat!]
[HKLM\Software\Wow6432Node\NCH Software\ClassicFTP\FTPAccounts]
[HKLM\Software\Wow6432Node\SimonTatham\PuTTY\Sessions]
[HKLM\Software\RimArts\B2\Settings]
[HKLM\Software\Wow6432Node\RimArts\B2\Settings]
[HKCU\Software\RimArts\B2\Settings]
[HKCU\Software\Microsoft\Windows Mail]
[HKCU\Software\Microsoft\Windows Live Mail]
[HKLM\Software\Wow6432Node\Nico Mak Computing\WinZip\mru\jobs]
[HKCU\Software\Nico Mak Computing\WinZip\mru\jobs]
[HKLM\Software\Wow6432Node\Nico Mak Computing\WinZip\FTP]
[HKCU\Software\Nico Mak Computing\WinZip\FTP]
[HKCU\Software\RIT\The Bat!]
[HKCU\Software\MAS-Soft\FTPInfo\Setup]
[HKCU\Software\ExpanDrive\Sessions]
[HKCU\Software\Cryer\WebSitePublisher]
[HKCU\Software\VanDyke\SecureFX]
[HKLM\Software\Wow6432Node\Ghisler\Total Commander]
[HKCU\Software\FlashFXP\3]
[HKCU\Software\GlobalSCAPE\CuteFTP 9\QCToolbar]
[HKCU\Software\GlobalSCAPE\CuteFTP 8 Professional\QCToolbar]
[HKCU\Software\GlobalSCAPE\CuteFTP 8 Home\QCToolbar]
[HKCU\Software\GlobalSCAPE\CuteFTP 7 Professional\QCToolbar]
[HKCU\Software\GlobalSCAPE\CuteFTP 7 Home\QCToolbar]
[HKCU\Software\GlobalSCAPE\CuteFTP 6 Professional\QCToolbar]
[HKCU\Software\GlobalSCAPE\CuteFTP 6 Home\QCToolbar]
[HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings]
[HKLM\Software\Wow6432Node\FlashFXP\3]
[HKCU\Software\Ghisler\Total Commander]
[HKLM\Software\Ghisler\Windows Commander]
[HKLM\Software\Wow6432Node\Ghisler\Windows Commander]
[HKCU\Software\Ghisler\Windows Commander]
[HKCU\Software\Far Manager\SavedDialogHistory\FTPHost]
[HKCU\Software\Far2\SavedDialogHistory\FTPHost]
[HKCU\Software\Far\SavedDialogHistory\FTPHost]
[HKCU\Software\Far Manager\Plugins\FTP\Hosts]
[HKCU\Software\Far2\Plugins\FTP\Hosts]
[HKLM\Software\Ghisler\Total Commander]
[HKCU\Software\RIT\The Bat!\Users depot]
[HKLM\Software\FlashFXP\3]
[HKCU\Software\FileZilla]
[HKLM\Software\Wow6432Node\FlashFXP]
[HKCU\Software\FTP Explorer\Profiles]
[HKCU\Software\FTP Explorer\FTP Explorer\Workspace\MFCToolBar-224]
[HKCU\Software\FTPWare\COREFTP\Sites]
[HKCU\Software\CoffeeCup Software\Internet\Profiles]
[HKCU\Software\Sota\FFFTP\Options]
[HKCU\Software\Sota\FFFTP]
[HKLM\Software\TurboFTP]
[HKLM\Software\Wow6432Node\TurboFTP]
[HKLM\Software\FlashFXP]
[HKCU\Software\TurboFTP]
[HKCU\Software\FlashFXP]
[HKCU\Software\BPFTP\Bullet Proof FTP\Options]
[HKCU\Software\BulletProof Software\BulletProof FTP Client\Main]
[HKCU\Software\BPFTP\Bullet Proof FTP\Main]
[HKLM\Software\FileZilla Client]
[HKLM\Software\Wow6432Node\FileZilla Client]
[HKLM\Software\FileZilla]
[HKLM\Software\Wow6432Node\FileZilla]
[HKCU\Software\FileZilla Client]
[HKCU\Software\BPFTP]
[HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook]

Читает файлы, отвечающие за хранение паролей сторонними программами

%LOCALAPPDATA%\google\chrome\user data\default\web data
%LOCALAPPDATA%\google\chrome\user data\default\login data

Перебирает пароли аккаунтов ОС.

Изменения в файловой системе

Создает следующие файлы

%TEMP%\ixp000.tmp\pzlggw~1.exe
%TEMP%\autba97.tmp
%TEMP%\qoeeseo
%APPDATA%\edqk.exe
%APPDATA%\aokfy.au3
%TEMP%\1287554.bat

Присваивает атрибут 'скрытый' для следующих файлов

%HOMEPATH%\noe7m5aogmtbsmrz\aokfy.au3
%HOMEPATH%\noe7m5aogmtbsmrz\edqk.exe

Удаляет следующие файлы

%TEMP%\autba97.tmp
%TEMP%\qoeeseo
%TEMP%\ixp000.tmp\pzlggw~1.exe
%WINDIR%\syswow64\wscript.exe

Перемещает следующие файлы

%APPDATA%\aokfy.au3 в %HOMEPATH%\noe7m5aogmtbsmrz\aokfy.au3
%APPDATA%\edqk.exe в %HOMEPATH%\noe7m5aogmtbsmrz\edqk.exe

Сетевая активность

UDP

DNS ASK po###oggs.info

Другое

Создает и запускает на исполнение

'%TEMP%\ixp000.tmp\pzlggw~1.exe'
'%APPDATA%\edqk.exe' "%APPDATA%\aOKfY.au3"

Запускает на исполнение

'%WINDIR%\syswow64\wscript.exe'
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\1287554.bat" "%WINDIR%\SysWOW64\wscript.exe" " (со скрытым окном)
'%TEMP%\ixp000.tmp\pzlggw~1.exe' (со скрытым окном)