Trojan.Click3.8138

Техническая информация

Вредоносные функции:

Запускает на исполнение:

'%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE' Explorer\iexplore.exe http://www.36##.com/?sr###################
'<SYSTEM32>\attrib.exe' <SYSTEM32> -s -h

Изменения в файловой системе:

Создает следующие файлы:

%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\getdubaid[1].asp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\getmysogouid[1].asp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\wbgetip[1].asp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\3600[1]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\getsogouid[1].asp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\tjtruesql[1].asp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\getsogouid[1].asp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\3600[1]
<SYSTEM32>\mssoso.dll
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\getmysogouid[1].asp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\getsogouid[1].asp
%WINDIR%\lockie.dll.log
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\getdubaid[1].asp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\getsogouid[1].asp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\sogouinf[1].ini
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\getdubaid[1].asp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\getmysogouid[1].asp

Удаляет следующие файлы:

%WINDIR%\Media\Windows XP Start.wav
%WINDIR%\Media\Windows XP Shutdown.wav
%WINDIR%\Media\Windows XP Ringout.wav
%WINDIR%\Media\onestop.mid
%WINDIR%\Media\flourish.mid
%WINDIR%\Media\Windows XP Startup.wav
%WINDIR%\Media\Windows XP Print complete.wav
%WINDIR%\Media\Windows XP Pop-up Blocked.wav
%WINDIR%\Media\Windows XP Notify.wav
%WINDIR%\Media\Windows XP Ringin.wav
%WINDIR%\Media\Windows XP Restore.wav
%WINDIR%\Media\Windows XP Recycle.wav
%WINDIR%\Media\town.mid
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\3600[1]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\getsogouid[1].asp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\getmysogouid[1].asp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\getsogouid[1].asp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\getmysogouid[1].asp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\getdubaid[1].asp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\getsogouid[1].asp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\getmysogouid[1].asp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\getdubaid[1].asp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\wbgetip[1].asp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\getdubaid[1].asp
<SYSTEM32>\mssoso.dll
%WINDIR%\Media\tada.wav
%WINDIR%\Media\start.wav
%WINDIR%\Media\ringout.wav
%WINDIR%\Media\Windows XP Battery Low.wav
%WINDIR%\Media\Windows XP Battery Critical.wav
%WINDIR%\Media\Windows XP Balloon.wav
%WINDIR%\Media\ding.wav
%WINDIR%\Media\chord.wav
%WINDIR%\Media\chimes.wav
%WINDIR%\Media\ringin.wav
%WINDIR%\Media\recycle.wav
%WINDIR%\Media\notify.wav
%WINDIR%\Media\Windows XP Critical Stop.wav
%WINDIR%\Media\Windows XP Logoff Sound.wav
%WINDIR%\Media\Windows XP Information Bar.wav
%WINDIR%\Media\Windows XP Hardware Remove.wav
%WINDIR%\Media\Windows XP Minimize.wav
%WINDIR%\Media\Windows XP Menu Command.wav
%WINDIR%\Media\Windows XP Logon Sound.wav
%WINDIR%\Media\Windows XP Error.wav
%WINDIR%\Media\Windows XP Ding.wav
%WINDIR%\Media\Windows XP Default.wav
%WINDIR%\Media\Windows XP Hardware Insert.wav
%WINDIR%\Media\Windows XP Hardware Fail.wav
%WINDIR%\Media\Windows XP Exclamation.wav

Сетевая активность:

Подключается к:

'ch####ha.cswblm.com':80
'www.36##.com':80
'localhost':1039
'localhost':1036
'zz###o.i8cs.com':80

TCP:

Запросы HTTP GET:

ch####ha.cswblm.com/getip/wbgetip.asp
www.36##.com/?sr###################
zz###o.i8cs.com/jlsogou/tjtruesql.asp?we#################################################
zz###o.i8cs.com/zzgjzi/sogouinf.ini
zz###o.i8cs.com/jlsogou/getdubaid.asp?hi#################################
zz###o.i8cs.com/jlsogou/getmysogouid.asp?hi#################################
zz###o.i8cs.com/jlsogou/getsogouid.asp?hi#################################

UDP: