Trojan.DownLoader11.22594

Техническая информация

Для обеспечения автозапуска и распространения:

Изменяет следующие исполняемые системные файлы:

<SYSTEM32>\msvcr100.dll
<SYSTEM32>\msvcr100d.dll
<SYSTEM32>\msvcp100.dll
<SYSTEM32>\msvcp100d.dll

Заражает следующие исполняемые файлы:

<SYSTEM32>\msvcr100.dll
<SYSTEM32>\msvcr100d.dll
<SYSTEM32>\msvcp100.dll
<SYSTEM32>\msvcp100d.dll

Вредоносные функции:

Создает и запускает на исполнение:

'%PROGRAM_FILES%\Iran-nofilter\NovinSoft.exe'

Завершает или пытается завершить

следующие пользовательские процессы:

firefox.exe

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\Iran-nofilter\PrxDrvPE.dll
%PROGRAM_FILES%\Iran-nofilter\PrxDrvPE64.dll
%PROGRAM_FILES%\Iran-nofilter\Proxifier.exe
%PROGRAM_FILES%\Iran-nofilter\ProxyChecker.exe
%PROGRAM_FILES%\Iran-nofilter\Settings.dll
%PROGRAM_FILES%\Iran-nofilter\pc2nl\ssleay32.dll
%PROGRAM_FILES%\Iran-nofilter\pc2nl\stunnel.conf
%PROGRAM_FILES%\Iran-nofilter\Settings.ini
%PROGRAM_FILES%\Iran-nofilter\OPENVPN1\app\bin\ssleay32.dll
%PROGRAM_FILES%\Iran-nofilter\PM9.exe
%PROGRAM_FILES%\Iran-nofilter\pc2nl\padlock.dll
%PROGRAM_FILES%\Iran-nofilter\paiamopenvpn.jpg
%PROGRAM_FILES%\Iran-nofilter\OPENVPN1\app\bin\openvpnserv.exe
%PROGRAM_FILES%\Iran-nofilter\p
%PROGRAM_FILES%\Iran-nofilter\paiampm9.jpg
%PROGRAM_FILES%\Iran-nofilter\paiamzbd.jpg
%PROGRAM_FILES%\Iran-nofilter\pc2nl\pc2nl.exe
%PROGRAM_FILES%\Iran-nofilter\paiamstunnel.jpg
%PROGRAM_FILES%\Iran-nofilter\paiamvpn.jpg
%HOMEPATH%\Start Menu\Programs\Iran-nofilter\Iran-nofilter Uninstaller.lnk
%HOMEPATH%\Desktop\Iran-nofilter.lnk
%PROGRAM_FILES%\Iran-nofilter\zbd.dll
%PROGRAM_FILES%\Iran-nofilter\pc2nl\zlib1.dll
%HOMEPATH%\Start Menu\Programs\Iran-nofilter\Iran-nofilter.lnk
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\update[1].txt
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\serverlist[1].txt
%WINDIR%\Iran-nofilter Uninstaller.exe
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\prefs1.js
%PROGRAM_FILES%\Iran-nofilter\xmllite.dll
%PROGRAM_FILES%\Iran-nofilter\OPENVPN1\app\driver\win32\tap0901.cat
%PROGRAM_FILES%\Iran-nofilter\OPENVPN1\app\driver\win32\tap0901.sys
%PROGRAM_FILES%\Iran-nofilter\pc2nl\sureware.dll
%PROGRAM_FILES%\Iran-nofilter\OPENVPN1\app\driver\win64\tap0901.cat
%PROGRAM_FILES%\Iran-nofilter\OPENVPN1\app\driver\win64\tap0901.sys
%PROGRAM_FILES%\Iran-nofilter\OPENVPN1\app\bin\TinyOpenVPNGui.exe
%PROGRAM_FILES%\Iran-nofilter\pc2nl\ubsec.dll
%PROGRAM_FILES%\Iran-nofilter\OPENVPN1\app\bin\tapinstallWin32.exe
%PROGRAM_FILES%\Iran-nofilter\OPENVPN1\app\bin\tapinstallWin64.exe
%PROGRAM_FILES%\Iran-nofilter\OPENVPN1\OpenVPNPortable.ini
%PROGRAM_FILES%\Iran-nofilter\pc2nl\cswift.dll
%PROGRAM_FILES%\Iran-nofilter\Profiles\Default.ppx
%PROGRAM_FILES%\Iran-nofilter\pc2nl\capi.dll
%PROGRAM_FILES%\Iran-nofilter\pc2nl\chil.dll
%PROGRAM_FILES%\Iran-nofilter\pc2nl\gmp.dll
%PROGRAM_FILES%\Iran-nofilter\OPENVPN1\data\config\information.txt
%PROGRAM_FILES%\Iran-nofilter\OPENVPN1\app\bin\libeay32.dll
%PROGRAM_FILES%\Iran-nofilter\pc2nl\gost.dll
%PROGRAM_FILES%\Iran-nofilter\Helper64.exe
%PROGRAM_FILES%\Iran-nofilter\aval
%TEMP%\aiw147187.bmp
%TEMP%\aiw147328.bmp
%TEMP%\aiw146921.bmp
%TEMP%\aiw147078.bmp
%TEMP%\aiw147421.bmp
%PROGRAM_FILES%\Iran-nofilter\pc2nl\aep.dll
%PROGRAM_FILES%\Iran-nofilter\pc2nl\atalla.dll
%TEMP%\aiw147531.EXE
%PROGRAM_FILES%\Iran-nofilter\pc2nl\4758cca.dll
%PROGRAM_FILES%\Iran-nofilter\pc2nl\nuron.dll
%PROGRAM_FILES%\Iran-nofilter\OPENVPN1\app\driver\win64\OemWin2k.inf
%PROGRAM_FILES%\Iran-nofilter\NetworkConnection.ico
%PROGRAM_FILES%\Iran-nofilter\NovinSoft.exe
%PROGRAM_FILES%\Iran-nofilter\OPENVPN1\app\driver\win32\OemWin2k.inf
%PROGRAM_FILES%\Iran-nofilter\OPENVPN1\OPENVPN.exe
%PROGRAM_FILES%\Iran-nofilter\OPENVPN1\app\bin\openvpn.exe
%PROGRAM_FILES%\Iran-nofilter\OPENVPN1\app\bin\openssl.exe
%PROGRAM_FILES%\Iran-nofilter\OPENVPN1\app\bin\openvpn-gui.exe
%PROGRAM_FILES%\Iran-nofilter\OPENVPN1\app\bin\msvcr90.dll
%PROGRAM_FILES%\Iran-nofilter\OPENVPN1\app\bin\lzo2.dll
<SYSTEM32>\MSINET.OCX
%PROGRAM_FILES%\Iran-nofilter\pc2nl\libeay32.dll
%PROGRAM_FILES%\Iran-nofilter\OPENVPN1\app\bin\libpkcs11-helper-1.dll
%PROGRAM_FILES%\Iran-nofilter\msvcp100.dll
%PROGRAM_FILES%\Iran-nofilter\msvcr100d.dll
%PROGRAM_FILES%\Iran-nofilter\pc2nl\msvcr90.dll
%PROGRAM_FILES%\Iran-nofilter\msvcp100d.dll
%PROGRAM_FILES%\Iran-nofilter\msvcr100.dll