Trojan.DownLoader11.39715

Техническая информация

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\taskkill.exe' /F /IM HttpAnalyzerStdV7.exe
'<SYSTEM32>\taskkill.exe' /F /IM HttpAnalyzerStdV6.exe
'<SYSTEM32>\taskkill.exe' /F /IM HttpAnalyzerStdV5.exe

Ищет следующие окна с целью

обнаружения утилит для анализа:

ClassName: 'FilemonClass' WindowName: ''
ClassName: 'PROCMON_WINDOW_CLASS' WindowName: ''
ClassName: 'RegmonClass' WindowName: ''
ClassName: 'OLLYDBG' WindowName: ''
ClassName: 'GBDYLLO' WindowName: ''
ClassName: 'pediy06' WindowName: ''

Изменения в файловой системе:

Создает следующие файлы:

<Текущая директория>\Inferno SYSTEM FILES\SYSTEM\irreplaceable.txt

Сетевая активность:

Подключается к:

'pu##fd.ru':80

TCP:

Запросы HTTP GET:

pu##fd.ru/Inferno/cd1hwid.txt

UDP:

DNS ASK pu##fd.ru

Другое:

Ищет следующие окна:

ClassName: '' WindowName: 'wpepro'
ClassName: '' WindowName: 'MyDEBUG'
ClassName: '' WindowName: 'HTTP Analyzer V9 (Unregistered Version)'
ClassName: '' WindowName: 'PuL9'
ClassName: '' WindowName: 'IDA'
ClassName: '' WindowName: 'Wireshark'
ClassName: '' WindowName: 'OllyDbg'
ClassName: '' WindowName: 'HTTP Analyzer V5 (Unregistered Version)'
ClassName: '' WindowName: 'HTTP Analyzer V6 (Unregistered Version)'
ClassName: '' WindowName: 'HTTP Analyzer V7 (Unregistered Version)'
ClassName: '' WindowName: 'HTTP Analyzer V4 (Unregistered Version)'
ClassName: '' WindowName: 'HTTP Analyzer V8 (Unregistered Version)'
ClassName: '' WindowName: 'HTTP Analyzer V2 (Unregistered Version)'
ClassName: '' WindowName: 'HTTP Analyzer V3 (Unregistered Version)'
ClassName: '' WindowName: 'DeDe'
ClassName: '' WindowName: 'CommView'
ClassName: '' WindowName: 'CommView.exe'
ClassName: '' WindowName: 'OllyDbg.exe'
ClassName: '' WindowName: 'Analyzer'
ClassName: '' WindowName: 'Analyzer.exe'
ClassName: '' WindowName: 'Cheat Engine.exe'
ClassName: '' WindowName: 'loader.exe'
ClassName: '' WindowName: ''
ClassName: '' WindowName: 'YDbg'
ClassName: '' WindowName: 'PEiD'
ClassName: '' WindowName: 'Charles 3.6'
ClassName: '' WindowName: 'Fiddler.exe'
ClassName: '' WindowName: 'Wireshark.exe'
ClassName: '' WindowName: 'httpd.exe'
ClassName: '' WindowName: 'WPE PRO'
ClassName: '' WindowName: 'cheatengine-x86_x64'
ClassName: '' WindowName: 'Cheat Engine 6.2'
ClassName: '' WindowName: 'Httpanalyzerstdv9'
ClassName: '' WindowName: 'Httpanalyzerstdv6'
ClassName: '' WindowName: 'Httpanalyzerstdv7'
ClassName: '' WindowName: 'Httpanalyzerstdv8'
ClassName: '' WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'
ClassName: '' WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
ClassName: '' WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
ClassName: '18467-41' WindowName: ''
ClassName: '' WindowName: 'Cheat Engine'
ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: 'msctls_updown32' WindowName: ''
ClassName: '' WindowName: 'Httpanalyzerstdv5'
ClassName: '' WindowName: 'HTTP Analyzer V8'
ClassName: '' WindowName: 'HTTP Analyzer V2'
ClassName: '' WindowName: 'HTTP Analyzer V3'
ClassName: '' WindowName: 'HTTP Analyzer V9'
ClassName: '' WindowName: 'Crack'
ClassName: '' WindowName: 'BruteCombineLoader'
ClassName: '' WindowName: 'Loader'
ClassName: '' WindowName: 'Httpanalyzerstdv2'
ClassName: '' WindowName: 'Httpanalyzerstdv3'
ClassName: '' WindowName: 'Httpanalyzerstdv4'
ClassName: '' WindowName: 'HTTP Analyzer V6'
ClassName: '' WindowName: 'HTTP Analyzer V4'
ClassName: '' WindowName: 'HTTP Analyzer V5'
ClassName: '' WindowName: 'HTTP Analyzer V7'