Trojan.KillFiles.14115

Техническая информация

Для обеспечения автозапуска и распространения:

Подменяет следующие исполняемые системные файлы:

<SYSTEM32>\msvbvm50.dll файлом <SYSTEM32>\temp.000

Вредоносные функции:

Создает и запускает на исполнение:

'%TEMP%\PMInst\setup.exe'
'%TEMP%\PMInst\checkish.exe' 0Ikernel.exe

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\InstallShield\Professional\RunTime\10\00\Intel32\ctoF.tmp
%CommonProgramFiles%\InstallShield\Professional\RunTime\10\00\Intel32\DotE.tmp
%CommonProgramFiles%\InstallShield\Professional\RunTime\10\00\Intel32\isc10.tmp
%CommonProgramFiles%\InstallShield\Professional\RunTime\IsP12.tmp
%CommonProgramFiles%\InstallShield\Professional\RunTime\10\00\Intel32\ius11.tmp
%CommonProgramFiles%\InstallShield\Professional\RunTime\10\00\Intel32\ispA.tmp\temp.000
%TEMP%\igdB.tmp
%TEMP%\_seC.tmp
%CommonProgramFiles%\InstallShield\Professional\RunTime\10\00\Intel32\iKeD.tmp
%TEMP%\isp9.tmp\temp.000
%CommonProgramFiles%\InstallShield\Professional\RunTime\IsProBE.tlb
%TEMP%\{213886FD-9A19-4A21-95B8-7DE269E82B13}\{ca2ce23e-6751-4828-af8b-66ea06e697f6}\Striaf9f.rra
%TEMP%\{213886FD-9A19-4A21-95B8-7DE269E82B13}\{ca2ce23e-6751-4828-af8b-66ea06e697f6}\Fontaf60.rra
%TEMP%\{213886FD-9A19-4A21-95B8-7DE269E82B13}\{ca2ce23e-6751-4828-af8b-66ea06e697f6}\isrtafdd.rra
%TEMP%\{213886FD-9A19-4A21-95B8-7DE269E82B13}\{ca2ce23e-6751-4828-af8b-66ea06e697f6}\_IsRb089.rra
%TEMP%\{213886FD-9A19-4A21-95B8-7DE269E82B13}\{ca2ce23e-6751-4828-af8b-66ea06e697f6}\defab05a.rra
%CommonProgramFiles%\InstallShield\Professional\RunTime\Obj13.tmp
%CommonProgramFiles%\InstallShield\Professional\RunTime\iKernel.rgs
%TEMP%\{213886FD-9A19-4A21-95B8-7DE269E82B13}\{ca2ce23e-6751-4828-af8b-66ea06e697f6}\setuae95.rra
%TEMP%\{213886FD-9A19-4A21-95B8-7DE269E82B13}\coreaf22.rra
%TEMP%\{213886FD-9A19-4A21-95B8-7DE269E82B13}\{ca2ce23e-6751-4828-af8b-66ea06e697f6}\liceaee3.rra
%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\418a7bd1a92ccda6d39d6c1e35049209_23ef5514-3059-436f-a4a7-4cefaab20eb1
%TEMP%\PMInst\temp.000
%TEMP%\PMInst\~GLH0001.TMP
%TEMP%\PMInst\~GLH0003.TMP
%TEMP%\bye5.tmp\Disk1\data1.cab
%TEMP%\ISPackFiles.ini
%TEMP%\GLK2.tmp
%TEMP%\GLC1.tmp
%TEMP%\GLG4.tmp
<SYSTEM32>\temp.000
<SYSTEM32>\~GLH0000.TMP
%TEMP%\bye5.tmp\Disk1\data1.hdr
%TEMP%\iss6.tmp\setup.ini
%TEMP%\bye5.tmp\Disk1\setup.inx
%CommonProgramFiles%\InstallShield\Professional\RunTime\10\00\Intel32\set8.tmp
%CommonProgramFiles%\InstallShield\Professional\RunTime\10\00\Intel32\isp7.tmp\temp.000
%TEMP%\bye5.tmp\Disk1\layout.bin
%TEMP%\bye5.tmp\Disk1\engine32.cab
%TEMP%\bye5.tmp\Disk1\setup.exe
%TEMP%\bye5.tmp\Disk1\setup.ini
%TEMP%\bye5.tmp\Disk1\setup.ibt

Удаляет следующие файлы:

%TEMP%\igdB.tmp
%TEMP%\_seC.tmp
%CommonProgramFiles%\InstallShield\Professional\RunTime\IsP12.tmp
%CommonProgramFiles%\InstallShield\Professional\RunTime\10\00\Intel32\set8.tmp
<SYSTEM32>\msvbvm50.dll
<SYSTEM32>\~GLH0000.TMP
%TEMP%\PMInst\~GLH0001.TMP

Перемещает следующие файлы:

%TEMP%\{213886FD-9A19-4A21-95B8-7DE269E82B13}\{ca2ce23e-6751-4828-af8b-66ea06e697f6}\setuae95.rra в %TEMP%\{213886FD-9A19-4A21-95B8-7DE269E82B13}\{ca2ce23e-6751-4828-af8b-66ea06e697f6}\setup.inx
%TEMP%\{213886FD-9A19-4A21-95B8-7DE269E82B13}\{ca2ce23e-6751-4828-af8b-66ea06e697f6}\liceaee3.rra в %TEMP%\{213886FD-9A19-4A21-95B8-7DE269E82B13}\{ca2ce23e-6751-4828-af8b-66ea06e697f6}\license.txt
%CommonProgramFiles%\InstallShield\Professional\RunTime\Obj13.tmp в %CommonProgramFiles%\InstallShield\Professional\RunTime\Objectps.dll
%CommonProgramFiles%\InstallShield\Professional\RunTime\10\00\Intel32\isc10.tmp в %CommonProgramFiles%\InstallShield\Professional\RunTime\10\00\Intel32\iscript.dll
%CommonProgramFiles%\InstallShield\Professional\RunTime\10\00\Intel32\ius11.tmp в %CommonProgramFiles%\InstallShield\Professional\RunTime\10\00\Intel32\iuser.dll
%TEMP%\{213886FD-9A19-4A21-95B8-7DE269E82B13}\coreaf22.rra в %TEMP%\{213886FD-9A19-4A21-95B8-7DE269E82B13}\corecomp.ini
%TEMP%\{213886FD-9A19-4A21-95B8-7DE269E82B13}\{ca2ce23e-6751-4828-af8b-66ea06e697f6}\defab05a.rra в %TEMP%\{213886FD-9A19-4A21-95B8-7DE269E82B13}\{ca2ce23e-6751-4828-af8b-66ea06e697f6}\default.pal
%TEMP%\{213886FD-9A19-4A21-95B8-7DE269E82B13}\{ca2ce23e-6751-4828-af8b-66ea06e697f6}\_IsRb089.rra в %TEMP%\{213886FD-9A19-4A21-95B8-7DE269E82B13}\{ca2ce23e-6751-4828-af8b-66ea06e697f6}\_IsRes.dll
%TEMP%\{213886FD-9A19-4A21-95B8-7DE269E82B13}\{ca2ce23e-6751-4828-af8b-66ea06e697f6}\isrtafdd.rra в %TEMP%\{213886FD-9A19-4A21-95B8-7DE269E82B13}\{ca2ce23e-6751-4828-af8b-66ea06e697f6}\isrt.dll
%TEMP%\{213886FD-9A19-4A21-95B8-7DE269E82B13}\{ca2ce23e-6751-4828-af8b-66ea06e697f6}\Fontaf60.rra в %TEMP%\{213886FD-9A19-4A21-95B8-7DE269E82B13}\{ca2ce23e-6751-4828-af8b-66ea06e697f6}\FontData.ini
%TEMP%\{213886FD-9A19-4A21-95B8-7DE269E82B13}\{ca2ce23e-6751-4828-af8b-66ea06e697f6}\Striaf9f.rra в %TEMP%\{213886FD-9A19-4A21-95B8-7DE269E82B13}\{ca2ce23e-6751-4828-af8b-66ea06e697f6}\StringTable-0009-English.ips
%CommonProgramFiles%\InstallShield\Professional\RunTime\10\00\Intel32\isp7.tmp\temp.000 в %CommonProgramFiles%\InstallShield\Professional\RunTime\10\00\Intel32\isp7.tmp\setup.dll
%CommonProgramFiles%\InstallShield\Professional\RunTime\10\00\Intel32\isp7.tmp\setup.dll в %CommonProgramFiles%\InstallShield\Professional\RunTime\10\00\Intel32\setup.dll
%TEMP%\PMInst\~GLH0003.TMP в %TEMP%\PMInst\setup.exe
%TEMP%\PMInst\temp.000 в %TEMP%\PMInst\~GLH0002.TMP
%TEMP%\PMInst\~GLH0002.TMP в %TEMP%\PMInst\checkish.exe
%CommonProgramFiles%\InstallShield\Professional\RunTime\10\00\Intel32\ispA.tmp\temp.000 в %CommonProgramFiles%\InstallShield\Professional\RunTime\10\00\Intel32\ispA.tmp\IGdi.dll
%CommonProgramFiles%\InstallShield\Professional\RunTime\10\00\Intel32\DotE.tmp в %CommonProgramFiles%\InstallShield\Professional\RunTime\10\00\Intel32\DotNetInstaller.exe
%CommonProgramFiles%\InstallShield\Professional\RunTime\10\00\Intel32\ctoF.tmp в %CommonProgramFiles%\InstallShield\Professional\RunTime\10\00\Intel32\ctor.dll
%CommonProgramFiles%\InstallShield\Professional\RunTime\10\00\Intel32\iKeD.tmp в %CommonProgramFiles%\InstallShield\Professional\RunTime\10\00\Intel32\iKernel.dll
%CommonProgramFiles%\InstallShield\Professional\RunTime\10\00\Intel32\ispA.tmp\IGdi.dll в %CommonProgramFiles%\InstallShield\Professional\RunTime\10\00\Intel32\iGdi.dll
%TEMP%\isp9.tmp\temp.000 в %TEMP%\isp9.tmp\_Setup.dll