Trojan.DownLoader11.4685

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%HOMEPATH%\Start Menu\Programs\Startup\武尊.lnk

Вредоносные функции:

Создает и запускает на исполнение:

'%TEMP%\is-R2C0B.tmp\setup.tmp' /SL5="$3010A,1824301,52736,%TEMP%\setup.exe" /VERYSILENT /SP-
'%TEMP%\RarSFX0\wuzun-zm-165317-v10.exe'
'%PROGRAM_FILES%\XuanKusoso\xuankusoso.exe' installstart
'%PROGRAM_FILES%\wuzun\wuzun.exe'
'%TEMP%\setup.exe' /VERYSILENT /SP-
'%PROGRAM_FILES%\YYMusic3\2014040600\YYMusic2.exe' -tuopan
'%TEMP%\RarSFX0\setup_3059.exe'
'%TEMP%\RarSFX0\xkss_50027.exe'
'%PROGRAM_FILES%\YYMusic3\2014040600\YYSpeed2.exe'

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\is-UBK1I.tmp\InstallerDLL.dll
%PROGRAM_FILES%\XuanKusoso\is-F6C20.tmp
%PROGRAM_FILES%\wuzun\UnInstall.exe
%PROGRAM_FILES%\wuzun\wuzun.exe
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\武尊.lnk
%PROGRAM_FILES%\XuanKusoso\is-BN3D5.tmp
%PROGRAM_FILES%\XuanKusoso\is-7VFLG.tmp
%ALLUSERSPROFILE%\Desktop\武尊.lnk
%TEMP%\is-UBK1I.tmp\_isetup\_shfoldr.dll
%HOMEPATH%\Start Menu\Programs\YYMusic3\№Щ·ЅЦчТі.lnk
%HOMEPATH%\Start Menu\Programs\YYMusic3\ЕдЦГ№¤ѕЯ\Р¶ФШYYMusic3.lnk
%PROGRAM_FILES%\YYMusic3\2014040600\YYSpeed2.exe
%HOMEPATH%\Start Menu\Programs\YYMusic3\YYMusic3.lnk
%TEMP%\is-R2C0B.tmp\setup.tmp
%PROGRAM_FILES%\wuzun\install_1396773273.tmp
%PROGRAM_FILES%\YYMusic3\2014040600\Data\user2.ini
%TEMP%\setup.exe
%ALLUSERSPROFILE%\Desktop\ј«ЛЩЛСЛС.lnk
%PROGRAM_FILES%\XuanKusoso\unins000.dat
%ALLUSERSPROFILE%\Start Menu\Programs\ј«ЛЩЛСЛС\ј«ЛЩЛСЛС.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\ј«ЛЩЛСЛС\Р¶ФШ.lnk
%PROGRAM_FILES%\XuanKusoso\Malware.log
%PROGRAM_FILES%\XuanKusoso\DownLoad.ini
%TEMP%\is-R2C0B.tmp\InstallerDll.log
%PROGRAM_FILES%\XuanKusoso\XuanKusoso.log
%PROGRAM_FILES%\XuanKusoso\is-L43G8.tmp
%ALLUSERSPROFILE%\Start Menu\Programs\武尊.lnk
%PROGRAM_FILES%\XuanKusoso\is-M400F.tmp
%PROGRAM_FILES%\XuanKusoso\is-1DMIN.tmp
%PROGRAM_FILES%\XuanKusoso\is-GOGQQ.tmp
%PROGRAM_FILES%\XuanKusoso\is-U7MJ7.tmp
<LS_APPDATA>\c3c_wuzunfg.ini
%PROGRAM_FILES%\XuanKusoso\is-9DFF2.tmp
%ALLUSERSPROFILE%\Start Menu\武尊.lnk
%PROGRAM_FILES%\YYMusic3\2014040600\avutil-52.dll
%PROGRAM_FILES%\YYMusic3\2014040600\channels.xml
%TEMP%\RarSFX0\xkss_50027.exe
%PROGRAM_FILES%\YYMusic3\2014040600\SysConfig.ini
%PROGRAM_FILES%\YYMusic3\2014040600\libav.dll
%PROGRAM_FILES%\YYMusic3\2014040600\pthreadGC2.dll
%PROGRAM_FILES%\YYMusic3\2014040600\DuiLib.dll
%PROGRAM_FILES%\YYMusic3\2014040600\favorfm.xml
%TEMP%\RarSFX0\wuzun-zm-165317-v10.exe
%TEMP%\RarSFX0\haha.url
%TEMP%\RarSFX0\KXWebBox_3330_RBF.exe
%TEMP%\RarSFX0\bfcmpasetup_ff07_0.exe
%TEMP%\RarSFX0\gbox_104_sltinstall.exe
%TEMP%\RarSFX0\setup_t10089.exe
%TEMP%\RarSFX0\UUSEE_kb1003_Setup_152280.exe
%TEMP%\RarSFX0\pczh_110_155363.exe
%TEMP%\RarSFX0\setup_3059.exe
%PROGRAM_FILES%\YYMusic3\2014040600\YYMusic2.exe
%PROGRAM_FILES%\YYMusic3\2014040600\aapt.exe
%PROGRAM_FILES%\YYMusic3\2014040600\avcore.dll
%PROGRAM_FILES%\YYMusic3\2014040600\avformat-54.dll
%PROGRAM_FILES%\YYMusic3\2014040600\AdbWinUsbApi.dll
%PROGRAM_FILES%\YYMusic3\2014040600\apnews.exe
%PROGRAM_FILES%\YYMusic3\2014040600\adb.exe
%PROGRAM_FILES%\YYMusic3\2014040600\AdbWinApi.dll
%PROGRAM_FILES%\YYMusic3\2014040600\avcodec-54.dll
%PROGRAM_FILES%\YYMusic3\2014040600\Unins.exe
%PROGRAM_FILES%\YYMusic3\2014040600\Data\client.ini
%PROGRAM_FILES%\YYMusic3\2014040600\source.dll
%PROGRAM_FILES%\YYMusic3\2014040600\swresample-0.dll
%PROGRAM_FILES%\YYMusic3\2014040600\Data\version.ini
%PROGRAM_FILES%\YYMusic3\2014040600\audio.dll
%PROGRAM_FILES%\YYMusic3\2014040600\Data\dh.ini
%PROGRAM_FILES%\YYMusic3\2014040600\Data\setup.ini

Удаляет следующие файлы:

%TEMP%\is-R2C0B.tmp\setup.tmp
%PROGRAM_FILES%\wuzun\install_1396773273.tmp

Перемещает следующие файлы:

%PROGRAM_FILES%\XuanKusoso\is-9DFF2.tmp в %PROGRAM_FILES%\XuanKusoso\Malware.dll
%PROGRAM_FILES%\XuanKusoso\is-M400F.tmp в %PROGRAM_FILES%\XuanKusoso\InstallerDLL.dll
%PROGRAM_FILES%\XuanKusoso\is-L43G8.tmp в %PROGRAM_FILES%\XuanKusoso\WinService.exe
%PROGRAM_FILES%\XuanKusoso\is-U7MJ7.tmp в %PROGRAM_FILES%\XuanKusoso\UpdateFile.exe
%PROGRAM_FILES%\XuanKusoso\is-GOGQQ.tmp в %PROGRAM_FILES%\XuanKusoso\Everything.dll
%PROGRAM_FILES%\XuanKusoso\is-7VFLG.tmp в %PROGRAM_FILES%\XuanKusoso\xuankusoso.exe
%PROGRAM_FILES%\XuanKusoso\is-F6C20.tmp в %PROGRAM_FILES%\XuanKusoso\unins000.exe
%PROGRAM_FILES%\XuanKusoso\is-1DMIN.tmp в %PROGRAM_FILES%\XuanKusoso\XuanKuSearch.dat
%PROGRAM_FILES%\XuanKusoso\is-BN3D5.tmp в %PROGRAM_FILES%\XuanKusoso\Everything.ini

Сетевая активность:

Подключается к:

'ji####.shuafenba.com':80
'in#.###ol.sina.com.cn':80
'ap#.#10game.com':80
'<IP-адрес в локальной сети>':445
'up####.yinyue.fm':80

TCP:

Запросы HTTP GET:

in#.###ol.sina.com.cn/iplookup/iplookup.php
ji####.shuafenba.com/anzhuang.aspx?OU##############################################################################################################################

UDP: