Техническая информация
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\DllHost.exe' /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\ish506535\images\Close_gray.png
- %TEMP%\ish506535\images\Close_Hover.png
- %TEMP%\ish506535\images\BG_gray.gif
- %TEMP%\ish506535\images\Close.png
- %TEMP%\ish506535\images\Close_Hover_gray.png
- %TEMP%\ish506535\images\Color_Button_Hover.png
- %TEMP%\ish506535\images\Color_Button_Hover_gray.png
- %TEMP%\ish506535\images\Color_Button.png
- %TEMP%\ish506535\images\Color_Button_gray.png
- %TEMP%\ish506535\images\BG.gif
- %TEMP%\ish506535\css\sdk-ui\images\button-bg.png
- %TEMP%\ish506535\css\sdk-ui\images\progress-bg-corner.png
- %TEMP%\ish506535\css\sdk-ui\button.css
- %TEMP%\ish506535\css\sdk-ui\checkbox.css
- %TEMP%\ish506535\css\sdk-ui\images\progress-bg.png
- %TEMP%\ish506535\csshover3.htc
- %TEMP%\ish506535\DAT\upd.DAT
- %TEMP%\ish506535\css\sdk-ui\images\progress-bg2.png
- %TEMP%\ish506535\css\sdk-ui\progress-bar.css
- %PROGRAM_FILES%\is514881.log
- %TEMP%\0007FB2F.log
- %TEMP%\ish506535\locale\EN.locale
- %TEMP%\ish506535\bootstrap_5853.html
- %TEMP%\0007FB3F.log
- %HOMEPATH%\Desktop\Continue Mipony Download Manager Installation.lnk
- %TEMP%\ICReinstall_<Имя вируса>.exe
- %TEMP%\0007FB8D.log
- %TEMP%\ish506535\images\xxProgressBar.png
- %TEMP%\ish506535\images\icon.png
- %TEMP%\ish506535\images\icon_gray.png
- %TEMP%\ish506535\images\Grey_Button.png
- %TEMP%\ish506535\images\Grey_Button_Hover.png
- %TEMP%\ish506535\images\Loader.gif
- %TEMP%\ish506535\images\ssClose_Hover.png
- %TEMP%\ish506535\images\xxClose.png
- %TEMP%\ish506535\images\Progress.png
- %TEMP%\ish506535\images\ProgressBar.png
- %TEMP%\ish506535\css\sdk-ui\browse.css
- %TEMP%\ish504335\DAT\upd.DAT
- %TEMP%\ish504335\images\BG.gif
- %TEMP%\ish504335\css\sdk-ui\progress-bar.css
- %TEMP%\ish504335\csshover3.htc
- %TEMP%\ish504335\images\BG_gray.gif
- %TEMP%\ish504335\images\Close_Hover.png
- %TEMP%\ish504335\images\Close_Hover_gray.png
- %TEMP%\ish504335\images\Close.png
- %TEMP%\ish504335\images\Close_gray.png
- %TEMP%\ish504335\css\sdk-ui\images\progress-bg2.png
- %TEMP%\ish504335\css\main.css
- %TEMP%\ish504335\css\sdk-ui\browse.css
- %TEMP%\0007B1F0.log
- %TEMP%\ish504335\css\ie6_main.css
- %TEMP%\ish504335\css\sdk-ui\button.css
- %TEMP%\ish504335\css\sdk-ui\images\progress-bg-corner.png
- %TEMP%\ish504335\css\sdk-ui\images\progress-bg.png
- %TEMP%\ish504335\css\sdk-ui\checkbox.css
- %TEMP%\ish504335\css\sdk-ui\images\button-bg.png
- %TEMP%\ish504335\images\xxClose.png
- %TEMP%\ish504335\images\xxProgressBar.png
- %TEMP%\ish504335\images\ProgressBar.png
- %TEMP%\ish504335\images\ssClose_Hover.png
- %TEMP%\ish504335\locale\EN.locale
- %TEMP%\ish506535\css\ie6_main.css
- %TEMP%\ish506535\css\main.css
- %TEMP%\0007B856.log
- %TEMP%\0007BA97.log
- %TEMP%\ish504335\images\Progress.png
- %TEMP%\ish504335\images\Color_Button_Hover.png
- %TEMP%\ish504335\images\Color_Button_Hover_gray.png
- %TEMP%\ish504335\images\Color_Button.png
- %TEMP%\ish504335\images\Color_Button_gray.png
- %TEMP%\ish504335\images\Grey_Button.png
- %TEMP%\ish504335\images\icon_gray.png
- %TEMP%\ish504335\images\Loader.gif
- %TEMP%\ish504335\images\Grey_Button_Hover.png
- %TEMP%\ish504335\images\icon.png
Удаляет следующие файлы:
- %TEMP%\ish504335\images\icon_gray.png
- %TEMP%\ish504335\images\icon.png
- %TEMP%\ish504335\images\Loader.gif
- %TEMP%\ish504335\images\ProgressBar.png
- %TEMP%\ish504335\images\Progress.png
- %TEMP%\ish504335\images\Color_Button_Hover.png
- %TEMP%\ish504335\images\Color_Button_gray.png
- %TEMP%\ish504335\images\Color_Button_Hover_gray.png
- %TEMP%\ish504335\images\Grey_Button_Hover.png
- %TEMP%\ish504335\images\Grey_Button.png
- %TEMP%\0007FB2F.log
- %PROGRAM_FILES%\is514881.log
- %TEMP%\0007FB3F.log
- %TEMP%\ish506535\bootstrap_5853.html
- %TEMP%\0007FB8D.log
- %TEMP%\ish504335\images\xxClose.png
- %TEMP%\ish504335\images\ssClose_Hover.png
- %TEMP%\ish504335\images\xxProgressBar.png
- %TEMP%\0007BA97.log
- %TEMP%\ish504335\locale\EN.locale
- %TEMP%\ish504335\images\Color_Button.png
- %TEMP%\ish504335\css\sdk-ui\checkbox.css
- %TEMP%\ish504335\css\sdk-ui\button.css
- %TEMP%\ish504335\css\sdk-ui\images\button-bg.png
- %TEMP%\ish504335\css\sdk-ui\images\progress-bg.png
- %TEMP%\ish504335\css\sdk-ui\images\progress-bg-corner.png
- %TEMP%\0007B856.log
- %TEMP%\0007B1F0.log
- %TEMP%\ish504335\css\ie6_main.css
- %TEMP%\ish504335\css\sdk-ui\browse.css
- %TEMP%\ish504335\css\main.css
- %TEMP%\ish504335\images\Close.png
- %TEMP%\ish504335\images\BG_gray.gif
- %TEMP%\ish504335\images\Close_gray.png
- %TEMP%\ish504335\images\Close_Hover_gray.png
- %TEMP%\ish504335\images\Close_Hover.png
- %TEMP%\ish504335\css\sdk-ui\progress-bar.css
- %TEMP%\ish504335\css\sdk-ui\images\progress-bg2.png
- %TEMP%\ish504335\csshover3.htc
- %TEMP%\ish504335\images\BG.gif
- %TEMP%\ish504335\DAT\upd.DAT
Сетевая активность:
Подключается к:
- 'rp.######downloadmanager.com':80
- 'cd###.###rimdownloadmanager.com':80
- 'os#####.##trimdownloadmanager.com':80
TCP:
Запросы HTTP GET:
- cd###.###rimdownloadmanager.com/app/Cmp/DownloadManagerV2.cis
Запросы HTTP POST:
- rp.######downloadmanager.com/?pc#############
- rp.######downloadmanager.com/?pc############
- os#####.##trimdownloadmanager.com/CM/?v=################
UDP:
- DNS ASK os#.#####mdownloadmanager.com
- DNS ASK dn#.##ftncsi.com
- DNS ASK rp.######downloadmanager.com
- DNS ASK os#####.##trimdownloadmanager.com
- DNS ASK cd###.###rimdownloadmanager.com
Другое:
Ищет следующие окна:
- ClassName: 'OleMainThreadWndClass' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
- ClassName: 'MS_WebCheckMonitor' WindowName: '(null)'
