Trojan.Hosts.30799

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'wextract_cleanup0' = 'rundll32.exe <SYSTEM32>\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"'

Вредоносные функции:

Создает и запускает на исполнение:

'%CommonProgramFiles%\InstallShield\Driver\1050\Intel 32\IDriver.exe' 32\IDriver.exe -Embedding
'%CommonProgramFiles%\InstallShield\Driver\1050\Intel 32\IDriverT.exe'
'%TEMP%\IXP000.TMP\.Download-Server.exe'
'%TEMP%\IXP000.TMP\netsim6.exe'

Запускает на исполнение:

'<SYSTEM32>\net1.exe' stop "; DNS; Client; "
'<SYSTEM32>\msiexec.exe' /V
'<SYSTEM32>\msiexec.exe' -Embedding A8B6ADDBC0B63186F671DEE933962476 C
'<SYSTEM32>\net.exe' stop wscsvc
'<SYSTEM32>\net.exe' stop "; DNS; Client; "
'<SYSTEM32>\net1.exe' stop wscsvc

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\MSI6.tmp
%TEMP%\{E783A54A-8CB7-441A-82BC-162E5BE83CFA}\String1033.txt
%TEMP%\{E783A54A-8CB7-441A-82BC-162E5BE83CFA}\_ISUSER.DLL
%TEMP%\{E783A54A-8CB7-441A-82BC-162E5BE83CFA}\eula.txt
%TEMP%\{E783A54A-8CB7-441A-82BC-162E5BE83CFA}\bosonlogo.bmp
%TEMP%\MSI7.tmp
%TEMP%\{E783A54A-8CB7-441A-82BC-162E5BE83CFA}\setup.inx
%WINDIR%\Downloaded Installations\{E7CEFED7-873E-41D4-B1B8-C666EC89D37A}\0x0409.ini
%WINDIR%\Downloaded Installations\{E7CEFED7-873E-41D4-B1B8-C666EC89D37A}\Boson NetSim for CCNP BETA 3b.msi
%TEMP%\{E783A54A-8CB7-441A-82BC-162E5BE83CFA}\_ISRES.DLL
%TEMP%\{E783A54A-8CB7-441A-82BC-162E5BE83CFA}\IsConfig.INI
%TEMP%\{E783A54A-8CB7-441A-82BC-162E5BE83CFA}\ISRT.DLL
%TEMP%\MSI8.tmp
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\rp.log
%TEMP%\MSI9.tmp
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
%CommonProgramFiles%\InstallShield\Driver\1050\Intel 32\IDriver2.exe
%TEMP%\_is2\Boson NetSim for CCNP BETA 3b.msi
%TEMP%\_is2\splash.bmp
%TEMP%\_is2\0x0409.ini
%APPDATA%\Microsoft\CryptnetUrlCache\MetaData\74BFD122C0875EC75DBE5C6DB4C59019
%WINDIR%\Installer\41d87.msi
%TEMP%\_is2\ISScript1050.Msi
%TEMP%\IXP000.TMP\kill.bat
%TEMP%\IXP000.TMP\netsim6.exe
%TEMP%\IXP000.TMP\.Download-Server.exe
%TEMP%\_is2\_ISMSIDEL.INI
%TEMP%\_is2\Setup.INI
%TEMP%\~1.tmp
%APPDATA%\Microsoft\CryptnetUrlCache\Content\74BFD122C0875EC75DBE5C6DB4C59019
%CommonProgramFiles%\InstallShield\Driver\1050\Intel 32\iGdiCnv.dll
%CommonProgramFiles%\InstallShield\Driver\1050\Intel 32\IDriver.exe
%CommonProgramFiles%\InstallShield\Driver\1050\Intel 32\_ISRES1033.dll
%CommonProgramFiles%\InstallShield\Driver\1050\Intel 32\objpscnv.dll
%CommonProgramFiles%\InstallShield\Driver\1050\Intel 32\IScrCnv.dll
%CommonProgramFiles%\InstallShield\Driver\1050\Intel 32\IUserCnv.dll
%WINDIR%\Installer\MSI3.tmp
%APPDATA%\Microsoft\CryptnetUrlCache\Content\486CC6AFD08942336C61FCD401C4A1D1
%APPDATA%\Microsoft\CryptnetUrlCache\MetaData\486CC6AFD08942336C61FCD401C4A1D1
%CommonProgramFiles%\InstallShield\Driver\1050\Intel 32\ISRT.dll
%CommonProgramFiles%\InstallShield\Driver\1050\Intel 32\IDriverT.exe
C:\Config.Msi\41d8a.rbs