Trojan.KeyLogger.25025

Техническая информация

Для обеспечения автозапуска и распространения:

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\SKLProService] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

'%PROGRAM_FILES%\ProKAward\wap.exe'
'%TEMP%\is-J2RC9.tmp\ConQuer2014.tmp' /SL5="$300DE,3765716,56832,%TEMP%\1.tmp\ConQuer2014.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
'%TEMP%\1.tmp\ConQuer2014.exe' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-

Запускает на исполнение:

'<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\ProKAward\wap.dll"
'%WINDIR%\regedit.exe' /e "%PROGRAM_FILES%\ProKAward\Data\RegUninst.reg" "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Conquer_is1"
'<SYSTEM32>\regsvr32.exe' /s "<SYSTEM32>\ATL.DLL"
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\1.tmp\setup.bat" "<Текущая директория>\""
'<SYSTEM32>\regsvr32.exe' /s "<SYSTEM32>\mfc42.dll"

Устанавливает процедуры перхвата сообщений

о нажатии клавиш клавиатуры:

Библиотека-обработчик для всех процессов: %PROGRAM_FILES%\ProKAward\wap.dll

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\ProKAward\driver\2000\is-2P6O2.tmp
%PROGRAM_FILES%\ProKAward\driver\2000\is-C12K2.tmp
%PROGRAM_FILES%\ProKAward\driver\Win7\is-GM8FA.tmp
%PROGRAM_FILES%\ProKAward\driver\Win7\is-PCU37.tmp
%PROGRAM_FILES%\ProKAward\driver\is-H5193.tmp
%PROGRAM_FILES%\ProKAward\images\is-2GGG3.tmp
%PROGRAM_FILES%\ProKAward\driver\2000\is-A61IU.tmp
%PROGRAM_FILES%\ProKAward\driver\2000\is-16CHB.tmp
<SYSTEM32>\E302AF636FDE.ini
%PROGRAM_FILES%\ProKAward\unins000.dat
%PROGRAM_FILES%\ProKAward\Data\RegUninst.reg
%PROGRAM_FILES%\ProKAward\wap.ini
%PROGRAM_FILES%\ProKAward\driver\XP\is-715JQ.tmp
%PROGRAM_FILES%\ProKAward\driver\Win7\is-I2GH1.tmp
%PROGRAM_FILES%\ProKAward\driver\XP\is-P9VAR.tmp
%PROGRAM_FILES%\ProKAward\driver\XP\is-13N4U.tmp
<SYSTEM32>\is-KQ9AA.tmp
%PROGRAM_FILES%\ProKAward\is-GGM9P.tmp
<SYSTEM32>\is-C5PN6.tmp
<SYSTEM32>\is-VF3R8.tmp
%TEMP%\1.tmp\ConQuer2014.exe
%TEMP%\1.tmp\setup.bat
%TEMP%\is-LAE54.tmp\_isetup\_shfoldr.dll
%TEMP%\is-J2RC9.tmp\ConQuer2014.tmp
%PROGRAM_FILES%\ProKAward\images\is-5H8D4.tmp
%PROGRAM_FILES%\ProKAward\is-UU969.tmp
%PROGRAM_FILES%\ProKAward\images\is-P2QHU.tmp
%PROGRAM_FILES%\ProKAward\images\is-MTAEI.tmp
%PROGRAM_FILES%\ProKAward\is-31TBU.tmp
%PROGRAM_FILES%\ProKAward\is-DF573.tmp
%PROGRAM_FILES%\ProKAward\is-5QECI.tmp
%PROGRAM_FILES%\ProKAward\is-2GNEE.tmp

Перемещает следующие файлы:

%PROGRAM_FILES%\ProKAward\driver\2000\is-A61IU.tmp в %PROGRAM_FILES%\ProKAward\driver\2000\netsf.inf
%PROGRAM_FILES%\ProKAward\driver\2000\is-C12K2.tmp в %PROGRAM_FILES%\ProKAward\driver\2000\netsf_m.inf
%PROGRAM_FILES%\ProKAward\driver\2000\is-2P6O2.tmp в %PROGRAM_FILES%\ProKAward\driver\2000\snetcfg.exe
%PROGRAM_FILES%\ProKAward\images\is-2GGG3.tmp в %PROGRAM_FILES%\ProKAward\images\r-pressed.png
%PROGRAM_FILES%\ProKAward\driver\is-H5193.tmp в %PROGRAM_FILES%\ProKAward\driver\snetcfg.exe
%PROGRAM_FILES%\ProKAward\driver\2000\is-16CHB.tmp в %PROGRAM_FILES%\ProKAward\driver\2000\aswebr.sys
%PROGRAM_FILES%\ProKAward\driver\XP\is-715JQ.tmp в %PROGRAM_FILES%\ProKAward\driver\XP\aswebr.sys
%PROGRAM_FILES%\ProKAward\driver\XP\is-13N4U.tmp в %PROGRAM_FILES%\ProKAward\driver\XP\netsf.inf
%PROGRAM_FILES%\ProKAward\driver\XP\is-P9VAR.tmp в %PROGRAM_FILES%\ProKAward\driver\XP\netsf_m.inf
%PROGRAM_FILES%\ProKAward\driver\Win7\is-PCU37.tmp в %PROGRAM_FILES%\ProKAward\driver\Win7\aswebr.sys
%PROGRAM_FILES%\ProKAward\driver\Win7\is-GM8FA.tmp в %PROGRAM_FILES%\ProKAward\driver\Win7\netsf.inf
%PROGRAM_FILES%\ProKAward\driver\Win7\is-I2GH1.tmp в %PROGRAM_FILES%\ProKAward\driver\Win7\netsf_m.inf
<SYSTEM32>\is-C5PN6.tmp в <SYSTEM32>\wbhelp2.dll
%PROGRAM_FILES%\ProKAward\is-DF573.tmp в %PROGRAM_FILES%\ProKAward\wap.dll
%PROGRAM_FILES%\ProKAward\is-31TBU.tmp в %PROGRAM_FILES%\ProKAward\wap.ini
%PROGRAM_FILES%\ProKAward\is-GGM9P.tmp в %PROGRAM_FILES%\ProKAward\unins000.exe
<SYSTEM32>\is-KQ9AA.tmp в <SYSTEM32>\anim.dll
<SYSTEM32>\is-VF3R8.tmp в <SYSTEM32>\unicows.dll
%PROGRAM_FILES%\ProKAward\images\is-5H8D4.tmp в %PROGRAM_FILES%\ProKAward\images\r-disabled.png
%PROGRAM_FILES%\ProKAward\images\is-MTAEI.tmp в %PROGRAM_FILES%\ProKAward\images\r-hover.png
%PROGRAM_FILES%\ProKAward\images\is-P2QHU.tmp в %PROGRAM_FILES%\ProKAward\images\r-normal.png
%PROGRAM_FILES%\ProKAward\is-2GNEE.tmp в %PROGRAM_FILES%\ProKAward\wap.exe
%PROGRAM_FILES%\ProKAward\is-5QECI.tmp в %PROGRAM_FILES%\ProKAward\wap.exe.manifest
%PROGRAM_FILES%\ProKAward\is-UU969.tmp в %PROGRAM_FILES%\ProKAward\rsasws.exe