Trojan.DownLoader10.25492

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Clients\StartMenuInternet\BlueView.exe\shell\open\command] '' = '"%PROGRAM_FILES%\BlueView\BlueView.exe"'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'BlueSoft' = '%PROGRAM_FILES%\BlueSoft\BlueSoft.exe silent'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\Brmas] 'Start' = '00000001'

Вредоносные функции:

Создает и запускает на исполнение:

'%APPDATA%\BlueSoft\C86DA4AD-186C-4dc2-A540-02E7B075F714\blueview_silent[bsxkeb].exe' /norestart
'%PROGRAM_FILES%\Brmas\bin\Brmas.exe'
'%PROGRAM_FILES%\BlueView\BlueView.exe' setdefault:1
'%TEMP%\is-377H8.tmp\blueview_silent[bsxkeb].tmp' /SL5="$400EC,663518,83456,%APPDATA%\BlueSoft\C86DA4AD-186C-4dc2-A540-02E7B075F714\blueview_silent[bsxkeb].exe" /norestart
'%PROGRAM_FILES%\222\222\down_s_66_62073.exe' /down_s_66_62073.exe
'%PROGRAM_FILES%\222\222\bluesoft_gho_bsxkeb_inst.exe' /bluesoft_gho_bsxkeb_inst.exe
'%APPDATA%\BlueSoft\C86DA4AD-186C-4dc2-A540-02E7B075F714\brmas_pc[bsxkeb].exe'
'%PROGRAM_FILES%\BlueSoft\BlueSoft.exe' autoinstall

Перехватывает следующие функции в SSDT (System Service Descriptor Table):

NtQuerySystemInformation, драйвер-обработчик: Brmas.sys
NtQueryInformationProcess, драйвер-обработчик: Brmas.sys
NtOpenProcess, драйвер-обработчик: Brmas.sys
NtSetValueKey, драйвер-обработчик: Brmas.sys
NtReadFile, драйвер-обработчик: Brmas.sys
NtQueryValueKey, драйвер-обработчик: Brmas.sys
NtDeleteValueKey, драйвер-обработчик: Brmas.sys
NtDeleteKey, драйвер-обработчик: Brmas.sys
NtCreateKey, драйвер-обработчик: Brmas.sys
NtOpenKey, драйвер-обработчик: Brmas.sys
NtEnumerateValueKey, драйвер-обработчик: Brmas.sys
NtEnumerateKey, драйвер-обработчик: Brmas.sys

Изменения в файловой системе:

Создает следующие файлы:

%APPDATA%\BlueView\icon\is-9OLMA.tmp
%APPDATA%\BlueView\icon\is-9K81G.tmp
%APPDATA%\BlueView\icon\is-QJM9O.tmp
%APPDATA%\BlueView\icon\is-0VKB2.tmp
%APPDATA%\BlueView\icon\is-HU26F.tmp
%APPDATA%\BlueView\icon\is-RD5KN.tmp
%APPDATA%\BlueView\icon\is-EL244.tmp
%APPDATA%\BlueView\icon\is-6ISPV.tmp
%APPDATA%\BlueView\icon\is-A5NMJ.tmp
%APPDATA%\BlueView\icon\is-ADP0T.tmp
%APPDATA%\BlueView\icon\is-O9RUA.tmp
%APPDATA%\BlueView\icon\is-SLUGH.tmp
%APPDATA%\BlueView\icon\is-RTQNT.tmp
%TEMP%\is-DOPK3.tmp\setup_logo2.bmp
%TEMP%\is-DOPK3.tmp\setup_btn.bmp
%TEMP%\is-DOPK3.tmp\top_bk.bmp
%TEMP%\is-DOPK3.tmp\install.ico
%TEMP%\is-DOPK3.tmp\mainbk.bmp
%TEMP%\is-DOPK3.tmp\setup_logo.bmp
%TEMP%\is-DOPK3.tmp\StretchLine.bmp
%PROGRAM_FILES%\BlueView\is-Q776A.tmp
%APPDATA%\BlueView\is-BER51.tmp
%APPDATA%\BlueView\icon\is-OLFSQ.tmp
%TEMP%\is-DOPK3.tmp\changeDir_btn.bmp
%TEMP%\is-DOPK3.tmp\setup_btn2.bmp
%PROGRAM_FILES%\BlueView\is-3SMOE.tmp
%PROGRAM_FILES%\BlueView\uninstall\is-6SM9C.tmp
%PROGRAM_FILES%\BlueView\uninstall\is-DR0CA.tmp
%ALLUSERSPROFILE%\Start Menu\Programs\А¶№вдЇААЖч\А¶№вдЇААЖч.lnk
%PROGRAM_FILES%\BlueView\uninstall\is-2FMKU.tmp
%PROGRAM_FILES%\BlueView\uninstall\is-9L39B.tmp
%PROGRAM_FILES%\BlueView\uninstall\is-236QK.tmp
%ALLUSERSPROFILE%\Start Menu\А¶№вдЇААЖч.lnk
%PROGRAM_FILES%\BlueView\unins000.msg
%PROGRAM_FILES%\BlueView\unins000.dat
%APPDATA%\BlueView\setting.ini
%ALLUSERSPROFILE%\Start Menu\Programs\А¶№вдЇААЖч\Р¶ФШ А¶№вдЇААЖч.lnk
%ALLUSERSPROFILE%\Desktop\А¶№вдЇААЖч.lnk
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\А¶№вдЇААЖч.lnk
%APPDATA%\BlueView\icon\is-74JFB.tmp
%APPDATA%\BlueView\icon\is-8QJ7U.tmp
%APPDATA%\BlueView\icon\is-7Q5O2.tmp
%APPDATA%\BlueView\icon\is-TADSN.tmp
%APPDATA%\BlueView\icon\is-EG5H1.tmp
%APPDATA%\BlueView\icon\is-EEG4S.tmp
%APPDATA%\BlueView\icon\is-GDCIU.tmp
%PROGRAM_FILES%\BlueView\uninstall\is-EL2EG.tmp
%PROGRAM_FILES%\BlueView\uninstall\is-M20TF.tmp
%PROGRAM_FILES%\BlueView\uninstall\is-8QG4G.tmp
%APPDATA%\BlueView\icon\is-OAACK.tmp
%APPDATA%\BlueView\icon\is-J6HD8.tmp
%APPDATA%\BlueView\icon\is-GLMHO.tmp
%TEMP%\is-DOPK3.tmp\_isetup\_shfoldr.dll
%PROGRAM_FILES%\BlueSoft\Uninstall.exe
%APPDATA%\BlueSoft\setting.ini
%ALLUSERSPROFILE%\Start Menu\Programs\А¶№вИнјюѕ«СЎ\А¶№вИнјюѕ«СЎ.lnk
%APPDATA%\BlueSoft\ExeIcon\hao123.ico
%APPDATA%\BlueSoft\ExeIcon\jingdong.ico
%APPDATA%\BlueSoft\ExeIcon\taobao.ico
%ALLUSERSPROFILE%\Start Menu\Programs\А¶№вИнјюѕ«СЎ\Р¶ФШ А¶№вИнјюѕ«СЎ.lnk
%TEMP%\nsm5.tmp\System.dll
%PROGRAM_FILES%\Brmas\bin\Brmas.exe
<LS_APPDATA>\liebao\Bootsetup\2.1.11.3341\66\boot_setup.pack.tmp
%TEMP%\nsg4.tmp
%TEMP%\CheckList.dll
%TEMP%\nss2.tmp\ioSpecial.ini
%TEMP%\nss2.tmp\modern-wizard.bmp
%PROGRAM_FILES%\BlueSoft\BlueSoft.exe
%PROGRAM_FILES%\222\222\bluesoft_gho_bsxkeb_inst.exe
%PROGRAM_FILES%\222\222\down_s_66_62073.exe
%TEMP%\nss2.tmp\System.dll
%TEMP%\send_b34.gz
%APPDATA%\BlueSoft\ExeIcon\baidu.ico
%APPDATA%\BlueSoft\ExeIcon\blueview.ico
%APPDATA%\BlueSoft\ExeIcon\brmas.ico
%APPDATA%\BlueSoft\softlist.xml
%APPDATA%\BlueSoft\C86DA4AD-186C-4dc2-A540-02E7B075F714\blueview_silent.exe
%APPDATA%\BlueSoft\C86DA4AD-186C-4dc2-A540-02E7B075F714\brmas_pc.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\homepageset[1].7889
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\iecafe[1].7889
%PROGRAM_FILES%\Brmas\bin\brmas\db2.brmas
%PROGRAM_FILES%\Brmas\bin\ProtConfig.dat
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\update.u.gsie[1].1&softid=0&hid=11000000000000000001&macadd=00-00-00-00-00-01&md5=4273f608373eeb68f61e32e0a463ad5c&rand=203390
%APPDATA%\BlueSoft\UpdateSet.xml
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\updateset[1].7889
%PROGRAM_FILES%\Brmas\bin\brmas\db4.brmas
%TEMP%\is-377H8.tmp\blueview_silent[bsxkeb].tmp
%TEMP%\is-DOPK3.tmp\_isetup\_RegDLL.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\install[1].7889&mac_add=00-00-00-00-00-01&hid=11000000000000000001&md5=ec66584feea538eb13d0f80a74cff3df&rand=223187
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\update.safe.my.iedun[1].7889&mac_add=00-00-00-00-00-01&hid=11000000000000000001&locked=no&url=&md5=ec66584feea538eb13d0f80a74cff3df&rand=224718
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\fav[1].7889&fav_update_time=&hid=11000000000000000001&rand=226156
%PROGRAM_FILES%\Brmas\bin\stat.dll
%PROGRAM_FILES%\Brmas\bin\brmas\db0.brmas
%PROGRAM_FILES%\Brmas\bin\brmas\db1.brmas
%PROGRAM_FILES%\Brmas\bin\Brmas.sys
%PROGRAM_FILES%\Brmas\bin\Brmas.dll
%PROGRAM_FILES%\Brmas\bin\BrowserMgr.dll
%PROGRAM_FILES%\Brmas\bin\brmas\db3.brmas
%HOMEPATH%\Start Menu\Programs\浏览器修复大师\卸载浏览器修复大师.lnk
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\install[1].1&softid=0&hid=11000000000000000001&macadd=00-00-00-00-00-01&md5=4273f608373eeb68f61e32e0a463ad5c&rand=191734
%PROGRAM_FILES%\Brmas\bin\iexplore.lnk
%PROGRAM_FILES%\Brmas\bin\uninst.exe
%PROGRAM_FILES%\Brmas\setting.ini
%HOMEPATH%\Start Menu\Programs\浏览器修复大师\浏览器修复大师.lnk

Удаляет следующие файлы:

%TEMP%\is-DOPK3.tmp\setup_logo.bmp
%TEMP%\is-DOPK3.tmp\setup_logo2.bmp
%TEMP%\is-DOPK3.tmp\setup_btn.bmp
%TEMP%\is-DOPK3.tmp\setup_btn2.bmp
%TEMP%\is-DOPK3.tmp\StretchLine.bmp
%TEMP%\is-DOPK3.tmp\_isetup\_shfoldr.dll
%TEMP%\is-377H8.tmp\blueview_silent[bsxkeb].tmp
%TEMP%\is-DOPK3.tmp\top_bk.bmp
%TEMP%\is-DOPK3.tmp\_isetup\_RegDLL.tmp
%TEMP%\is-DOPK3.tmp\mainbk.bmp
%TEMP%\nss2.tmp\System.dll
<LS_APPDATA>\liebao\Bootsetup\2.1.11.3341\66\boot_setup.pack
%TEMP%\nss2.tmp\ioSpecial.ini
%TEMP%\nss2.tmp\modern-wizard.bmp
%TEMP%\CheckList.dll
%TEMP%\is-DOPK3.tmp\changeDir_btn.bmp
%TEMP%\is-DOPK3.tmp\install.ico
%TEMP%\nsm5.tmp\System.dll
%TEMP%\send_b34.gz

Перемещает следующие файлы:

%APPDATA%\BlueView\icon\is-7Q5O2.tmp в %APPDATA%\BlueView\icon\www.sohu.com.ico
%APPDATA%\BlueView\icon\is-8QJ7U.tmp в %APPDATA%\BlueView\icon\www.sina.com.cn.ico
%APPDATA%\BlueView\icon\is-OAACK.tmp в %APPDATA%\BlueView\icon\www.tmall.com.ico
%APPDATA%\BlueView\icon\is-GDCIU.tmp в %APPDATA%\BlueView\icon\www.taobao.com.ico
%APPDATA%\BlueView\icon\is-74JFB.tmp в %APPDATA%\BlueView\icon\www.qq.com.ico
%APPDATA%\BlueView\icon\is-TADSN.tmp в %APPDATA%\BlueView\icon\www.kaixin001.com.ico
%APPDATA%\BlueView\icon\is-ADP0T.tmp в %APPDATA%\BlueView\icon\www.jd.com.ico
%APPDATA%\BlueView\icon\is-EEG4S.tmp в %APPDATA%\BlueView\icon\www.microsoft.com.ico
%APPDATA%\BlueView\icon\is-EG5H1.tmp в %APPDATA%\BlueView\icon\www.meituan.com.ico
%APPDATA%\BlueView\icon\is-J6HD8.tmp в %APPDATA%\BlueView\icon\www.vancl.com.ico
%PROGRAM_FILES%\BlueView\uninstall\is-236QK.tmp в %PROGRAM_FILES%\BlueView\uninstall\close_btn.bmp
%PROGRAM_FILES%\BlueView\uninstall\is-9L39B.tmp в %PROGRAM_FILES%\BlueView\uninstall\cancel_btn.bmp
%PROGRAM_FILES%\BlueView\uninstall\is-DR0CA.tmp в %PROGRAM_FILES%\BlueView\uninstall\unsetup_logo2.bmp
%PROGRAM_FILES%\BlueView\uninstall\is-6SM9C.tmp в %PROGRAM_FILES%\BlueView\uninstall\unsetup_logo.bmp
%PROGRAM_FILES%\BlueView\uninstall\is-2FMKU.tmp в %PROGRAM_FILES%\BlueView\uninstall\unsetup_btn.bmp
%PROGRAM_FILES%\BlueView\uninstall\is-EL2EG.tmp в %PROGRAM_FILES%\BlueView\uninstall\mainbk.bmp
%APPDATA%\BlueView\icon\is-GLMHO.tmp в %APPDATA%\BlueView\icon\www.youku.com.ico
%PROGRAM_FILES%\BlueView\uninstall\is-8QG4G.tmp в %PROGRAM_FILES%\BlueView\uninstall\StretchLine.bmp
%PROGRAM_FILES%\BlueView\uninstall\is-M20TF.tmp в %PROGRAM_FILES%\BlueView\uninstall\top_bk.bmp
%APPDATA%\BlueView\icon\is-OLFSQ.tmp в %APPDATA%\BlueView\icon\baidu.gsie.cn.ico
%APPDATA%\BlueView\is-BER51.tmp в %APPDATA%\BlueView\setting.ini
%APPDATA%\BlueView\icon\is-HU26F.tmp в %APPDATA%\BlueView\icon\baidu.lvseie.com.ico
%APPDATA%\BlueView\icon\is-0VKB2.tmp в %APPDATA%\BlueView\icon\baidu.iblueview.com.ico
%PROGRAM_FILES%\BlueView\is-Q776A.tmp в %PROGRAM_FILES%\BlueView\BlueView.exe
%APPDATA%\BlueSoft\C86DA4AD-186C-4dc2-A540-02E7B075F714\brmas_pc.exe в %APPDATA%\BlueSoft\C86DA4AD-186C-4dc2-A540-02E7B075F714\brmas_pc[bsxkeb].exe
%APPDATA%\BlueSoft\C86DA4AD-186C-4dc2-A540-02E7B075F714\blueview_silent.exe в %APPDATA%\BlueSoft\C86DA4AD-186C-4dc2-A540-02E7B075F714\blueview_silent[bsxkeb].exe
%PROGRAM_FILES%\BlueView\is-3SMOE.tmp в %PROGRAM_FILES%\BlueView\unins000.exe
<LS_APPDATA>\liebao\Bootsetup\2.1.11.3341\66\boot_setup.pack.tmp в <LS_APPDATA>\liebao\Bootsetup\2.1.11.3341\66\boot_setup.pack
%APPDATA%\BlueView\icon\is-RD5KN.tmp в %APPDATA%\BlueView\icon\game.gsie.cn.ico
%APPDATA%\BlueView\icon\is-RTQNT.tmp в %APPDATA%\BlueView\icon\www.dianping.com.ico
%APPDATA%\BlueView\icon\is-SLUGH.tmp в %APPDATA%\BlueView\icon\www.dangdang.com.ico
%APPDATA%\BlueView\icon\is-A5NMJ.tmp в %APPDATA%\BlueView\icon\www.hao123.com.ico
%APPDATA%\BlueView\icon\is-6ISPV.tmp в %APPDATA%\BlueView\icon\www.google.com.hk.ico
%APPDATA%\BlueView\icon\is-O9RUA.tmp в %APPDATA%\BlueView\icon\www.baidu.com.ico
%APPDATA%\BlueView\icon\is-9K81G.tmp в %APPDATA%\BlueView\icon\weibo.com.ico
%APPDATA%\BlueView\icon\is-9OLMA.tmp в %APPDATA%\BlueView\icon\pindao.huoban.taobao.com.ico
%APPDATA%\BlueView\icon\is-EL244.tmp в %APPDATA%\BlueView\icon\www.2345.com.ico
%APPDATA%\BlueView\icon\is-QJM9O.tmp в %APPDATA%\BlueView\icon\www.163.com.ico

Сетевая активность:

Подключается к:

'wp#d':80
'localhost':1046
'localhost':1050
'up####.safe.my.iedun.cn':80
'up####.u.gsie.cn':80
'lb####.tj.ijinshan.com':80
'lb##.##ion.ijinshan.com':80
'localhost':1043
'12#.#25.114.144':80

TCP:

Запросы HTTP GET:

up####.safe.my.iedun.cn/home1/updateset/updateset/?co########################
up####.safe.my.iedun.cn/home1/iecafe/iecafe/?co########################
up####.safe.my.iedun.cn/install/?us###############################################################################################################################
up####.safe.my.iedun.cn/home1/fav/?us###############################################################################################################
up####.safe.my.iedun.cn/?us##############################################################################################################################################
up####.u.gsie.cn/install/?ve########################################################################################################################################
lb##.##ion.ijinshan.com/?pi###############################
up####.u.gsie.cn/?ve########################################################################################################################################
up####.safe.my.iedun.cn/home1/homepageset/?co########################
wp#d/wpad.dat

Запросы HTTP POST:

lb####.tj.ijinshan.com/data/

UDP:

DNS ASK www.download.windowsupdate.com
DNS ASK up####.safe.my.iedun.cn
DNS ASK www.ib###view.com
DNS ASK up####.iblueview.com
DNS ASK sa##.#y.iedun.cn
DNS ASK lb####.tj.ijinshan.com
DNS ASK lb##.##ion.ijinshan.com
DNS ASK www.ba##u.com
DNS ASK wp#d
DNS ASK up####.u.gsie.cn

Другое:

Ищет следующие окна:

ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
ClassName: 'BVIE_MainWnd' WindowName: '(null)'
ClassName: '85AD02CF-F95D-4f2c-8BCA-BDA546A35E63' WindowName: '(null)'
ClassName: 'EDIT' WindowName: '(null)'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'BlueSoft_MainWnd' WindowName: '(null)'

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней