Trojan.DownLoader11.17896

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Classes\goodPic\shell\open\command] '' = '"%PROGRAM_FILES%\goodPic\goodPicAp.exe" "%1"'

Вредоносные функции:

Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\goodPic\goodPic.exe' = '%PROGRAM_FILES%\goodPic\goodPic.exe:*:Enabled:Е®Йс»Іб Player'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\goodPic\goodPicAp.exe' = '%PROGRAM_FILES%\goodPic\goodPicAp.exe:*:Enabled:Е®Йс»Іб App'

Создает и запускает на исполнение:

'%TEMP%\is-N7P60.tmp\goodPic_setup_612.tmp' /SL5="$40092,2481881,117760,%TEMP%\nsk3.tmp\goodPic_setup_612.exe" /verysilent
'%PROGRAM_FILES%\goodPic\goodPicAp.exe' /setup_s
'%TEMP%\nsk3.tmp\goodpic_dae_612.exe'
'%TEMP%\nsk3.tmp\goodPic_setup_612.exe' /verysilent

Изменения в файловой системе:

Создает следующие файлы:

%ALLUSERSPROFILE%\Start Menu\Programs\goodPic\goodPic Player.lnk
%PROGRAM_FILES%\goodPic\plugins\is-QBL5L.tmp
%PROGRAM_FILES%\goodPic\plugins\is-AD77R.tmp
%PROGRAM_FILES%\goodPic\config\config.ini
%PROGRAM_FILES%\goodPic\unins000.dat
%ALLUSERSPROFILE%\Start Menu\Programs\goodPic\Uninstall їН»§¶Л.lnk
%PROGRAM_FILES%\goodPic\is-1CM23.tmp
%PROGRAM_FILES%\goodPic\is-6BHTJ.tmp
%PROGRAM_FILES%\goodPic\is-JLA9H.tmp
%PROGRAM_FILES%\goodPic\config\is-5MFAU.tmp
%PROGRAM_FILES%\goodPic\is-ID4NJ.tmp
%PROGRAM_FILES%\goodPic\is-UK8PV.tmp
%HOMEPATH%\Desktop\goodPic Player.lnk
%PROGRAM_FILES%\goodPic\config\hlib_block.db-journal
%PROGRAM_FILES%\goodPic\config\hlib_index.db
%PROGRAM_FILES%\goodPic\config\hlib_index.db-journal
%PROGRAM_FILES%\goodPic\config\hlib_pcrc.db
%PROGRAM_FILES%\goodPic\config\hlib_pcrc.db-journal
%PROGRAM_FILES%\goodPic\config\hlib_block.db
%PROGRAM_FILES%\goodPic\meinvGo.url
%PROGRAM_FILES%\goodPic\config\profile.cfg
%PROGRAM_FILES%\goodPic\config\partner.ini
%PROGRAM_FILES%\goodPic\config\CfgTmp.zip
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\cfgPicture[1].zip
%PROGRAM_FILES%\goodPic\top_box.bmp
%TEMP%\is-JKODD.tmp\MgRecommend.dll
%TEMP%\is-JKODD.tmp\jpg2bmp.dll
%TEMP%\is-JKODD.tmp\_isetup\_shfoldr.dll
%TEMP%\is-JKODD.tmp\top_box.jpg
%TEMP%\is-JKODD.tmp\left_box.bmp
%TEMP%\is-JKODD.tmp\setup.jpg
%TEMP%\nsk3.tmp\goodpic_dae_612.exe
%TEMP%\nsk3.tmp\NSISdl.dll
%TEMP%\nsp2.tmp
%TEMP%\is-JKODD.tmp\_isetup\_RegDLL.tmp
%TEMP%\is-N7P60.tmp\goodPic_setup_612.tmp
%TEMP%\nsk3.tmp\goodPic_setup_612.exe
%TEMP%\is-JKODD.tmp\setup.bmp
%PROGRAM_FILES%\goodPic\is-6CU0V.tmp
%PROGRAM_FILES%\goodPic\is-A50G8.tmp
%PROGRAM_FILES%\goodPic\is-3CDSI.tmp
%PROGRAM_FILES%\goodPic\is-32DFP.tmp
%PROGRAM_FILES%\goodPic\is-LAC69.tmp
%PROGRAM_FILES%\goodPic\is-ABRRQ.tmp
%PROGRAM_FILES%\goodPic\is-D30H8.tmp
%PROGRAM_FILES%\goodPic\is-2EFS0.tmp
%TEMP%\is-JKODD.tmp\top_box.bmp
%PROGRAM_FILES%\goodPic\is-SB60S.tmp
%PROGRAM_FILES%\goodPic\is-GIMG6.tmp
%PROGRAM_FILES%\goodPic\is-H14OM.tmp

Удаляет следующие файлы:

%TEMP%\is-JKODD.tmp\_isetup\_shfoldr.dll
%TEMP%\is-N7P60.tmp\goodPic_setup_612.tmp
%TEMP%\is-JKODD.tmp\top_box.jpg
%TEMP%\is-JKODD.tmp\_isetup\_RegDLL.tmp
%TEMP%\nsk3.tmp\goodPic_setup_612.exe
%PROGRAM_FILES%\goodPic\config\hlib_block.db-journal
%PROGRAM_FILES%\goodPic\config\hlib_pcrc.db-journal
%PROGRAM_FILES%\goodPic\config\profile.cfg
%PROGRAM_FILES%\goodPic\config\hlib_index.db-journal
%PROGRAM_FILES%\goodPic\goodPic.exe
%TEMP%\is-JKODD.tmp\jpg2bmp.dll
%TEMP%\nsk3.tmp\goodpic_dae_612.exe
%TEMP%\nsk3.tmp\NSISdl.dll
%TEMP%\is-JKODD.tmp\left_box.bmp
%TEMP%\is-JKODD.tmp\setup.jpg
%TEMP%\is-JKODD.tmp\top_box.bmp
%TEMP%\is-JKODD.tmp\MgRecommend.dll
%TEMP%\is-JKODD.tmp\setup.bmp

Перемещает следующие файлы:

%PROGRAM_FILES%\goodPic\is-1CM23.tmp в %PROGRAM_FILES%\goodPic\msvcr71.dll
%PROGRAM_FILES%\goodPic\is-UK8PV.tmp в %PROGRAM_FILES%\goodPic\ppxa.dll
%PROGRAM_FILES%\goodPic\is-6BHTJ.tmp в %PROGRAM_FILES%\goodPic\msvcr110.dll
%PROGRAM_FILES%\goodPic\is-32DFP.tmp в %PROGRAM_FILES%\goodPic\msvcp110.dll
%PROGRAM_FILES%\goodPic\is-JLA9H.tmp в %PROGRAM_FILES%\goodPic\msvcp71.dll
%PROGRAM_FILES%\goodPic\plugins\is-QBL5L.tmp в %PROGRAM_FILES%\goodPic\plugins\TransmitLayer.dll
%PROGRAM_FILES%\goodPic\config\profile.cfg.new в %PROGRAM_FILES%\goodPic\config\profile.cfg
%PROGRAM_FILES%\goodPic\plugins\is-AD77R.tmp в %PROGRAM_FILES%\goodPic\plugins\mnGLnk.dll
%PROGRAM_FILES%\goodPic\is-ID4NJ.tmp в %PROGRAM_FILES%\goodPic\sqlite3.dll
%PROGRAM_FILES%\goodPic\config\is-5MFAU.tmp в %PROGRAM_FILES%\goodPic\config\init.config.ini
%PROGRAM_FILES%\goodPic\is-GIMG6.tmp в %PROGRAM_FILES%\goodPic\goodPicAp.exe
%PROGRAM_FILES%\goodPic\is-SB60S.tmp в %PROGRAM_FILES%\goodPic\jpg2bmp.dll
%PROGRAM_FILES%\goodPic\is-H14OM.tmp в %PROGRAM_FILES%\goodPic\goodPic.exe
%PROGRAM_FILES%\goodPic\is-2EFS0.tmp в %PROGRAM_FILES%\goodPic\unins000.exe
%PROGRAM_FILES%\goodPic\is-D30H8.tmp в %PROGRAM_FILES%\goodPic\goodPic.exe
%PROGRAM_FILES%\goodPic\is-ABRRQ.tmp в %PROGRAM_FILES%\goodPic\MGIconLib.dll
%PROGRAM_FILES%\goodPic\is-LAC69.tmp в %PROGRAM_FILES%\goodPic\MgRecommend.dll
%PROGRAM_FILES%\goodPic\is-6CU0V.tmp в %PROGRAM_FILES%\goodPic\MFC71.dll
%PROGRAM_FILES%\goodPic\is-3CDSI.tmp в %PROGRAM_FILES%\goodPic\meinvGo.ico
%PROGRAM_FILES%\goodPic\is-A50G8.tmp в %PROGRAM_FILES%\goodPic\meinvGo.url