Trojan.DownLoader11.40235

Техническая информация

Вредоносные функции:

Создает и запускает на исполнение:

'%TEMP%\7zS4.tmp\MailStoreHomeSetup.exe' run-by-sfx
'%TEMP%\software.exe'
'%TEMP%\mySecureSurfer_no_chrome.exe'

Завершает или пытается завершить

следующие пользовательские процессы:

firefox.exe

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\7zS4.tmp\cs\MailStoreHomeSetup.resources.dll
%TEMP%\7zS4.tmp\nl\MailStoreHomeSetup.resources.dll
%TEMP%\7zS4.tmp\zh-hk\MailStoreHomeSetup.resources.dll
%TEMP%\7zS4.tmp\es\MailStoreHomeSetup.resources.dll
%TEMP%\7zS4.tmp\zh-cn\MailStoreHomeSetup.resources.dll
%TEMP%\7zS4.tmp\pl\MailStoreHomeSetup.resources.dll
%TEMP%\7zS4.tmp\pt\MailStoreHomeSetup.resources.dll
%TEMP%\7zS4.tmp\ko\MailStoreHomeSetup.resources.dll
%TEMP%\7zS4.tmp\hu\MailStoreHomeSetup.resources.dll
%TEMP%\7zS4.tmp\ja\MailStoreHomeSetup.resources.dll
%TEMP%\7zS4.tmp\pt\MailStoreHome.resources.dll
%TEMP%\7zS4.tmp\tr\MailStoreHome.resources.dll
%TEMP%\7zS4.tmp\pl\MailStoreHome.resources.dll
%TEMP%\7zS4.tmp\ja\MailStoreHome.resources.dll
%TEMP%\7zS4.tmp\ko\MailStoreHome.resources.dll
%TEMP%\7zS4.tmp\fr\MailStoreHomeSetup.resources.dll
%TEMP%\7zS4.tmp\it\MailStoreHomeSetup.resources.dll
%TEMP%\7zS4.tmp\de\MailStoreHomeSetup.resources.dll
%TEMP%\7zS4.tmp\ru\MailStoreHome.resources.dll
%TEMP%\7zS4.tmp\sl\MailStoreHome.resources.dll
%APPDATA%\Microsoft\CryptnetUrlCache\Content\1F356F4D07FE8C483E769E4586569404
%TEMP%\Cab7.tmp
%APPDATA%\Microsoft\CryptnetUrlCache\MetaData\1F356F4D07FE8C483E769E4586569404
%APPDATA%\Microsoft\CryptnetUrlCache\MetaData\B69D763EB21649DA26F20618312DEE70
%APPDATA%\Microsoft\CryptnetUrlCache\Content\B69D763EB21649DA26F20618312DEE70
%TEMP%\CabF.tmp
%TEMP%\Cab11.tmp
%TEMP%\CabD.tmp
%TEMP%\Cab9.tmp
%TEMP%\CabB.tmp
%TEMP%\7zS4.tmp\MailStoreResources.dll
%TEMP%\7zS4.tmp\pdftotext.dll
%TEMP%\7zS4.tmp\sl\MailStoreHomeSetup.resources.dll
%TEMP%\7zS4.tmp\tr\MailStoreHomeSetup.resources.dll
%TEMP%\7zS4.tmp\ru\MailStoreHomeSetup.resources.dll
%APPDATA%\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
%TEMP%\Cab5.tmp
%APPDATA%\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
%APPDATA%\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004
%APPDATA%\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004
%TEMP%\7zS4.tmp\hu\MailStoreHome.resources.dll
%TEMP%\7zS4.tmp\Firebird_x86\firebird.msg
%TEMP%\7zS4.tmp\Firebird_x86\gbak.exe
%TEMP%\7zS4.tmp\MailStoreHome.exe.config
%TEMP%\7zS4.tmp\Firebird_x86\intl\fbintl.conf
%TEMP%\7zS4.tmp\Firebird_x86\firebird.conf
%TEMP%\7zS4.tmp\MailStoreFilterHost_x86.exe
%TEMP%\7zS4.tmp\MailStoreHome.exe
%TEMP%\7zS4.tmp\MailStoreFilterHost_x64.exe
%TEMP%\7zS4.tmp\Firebird_x86\gfix.exe
%TEMP%\7zS4.tmp\Firebird_x86\gstat.exe
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{d64e478d-4dee-4bfb-afe4-30b84e6a3157}\icon.png
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{d64e478d-4dee-4bfb-afe4-30b84e6a3157}\icon32.png
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{d64e478d-4dee-4bfb-afe4-30b84e6a3157}\bootstrap.js
%TEMP%\mySecureSurfer_no_chrome.exe
%TEMP%\nsi3.tmp\KillProcDLL.dll
%TEMP%\7zS4.tmp\License-Freeware-de.txt
%TEMP%\7zS4.tmp\License-Freeware-en.txt
%TEMP%\software.exe
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{d64e478d-4dee-4bfb-afe4-30b84e6a3157}\install.rdf
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{d64e478d-4dee-4bfb-afe4-30b84e6a3157}\chrome\content\extension.js
%TEMP%\7zS4.tmp\fr\MailStoreHome.resources.dll
%TEMP%\7zS4.tmp\it\MailStoreHome.resources.dll
%TEMP%\7zS4.tmp\de\MailStoreHome.resources.dll
%TEMP%\7zS4.tmp\Firebird_x86\icuin30.dll
%TEMP%\7zS4.tmp\Firebird_x86\icuuc30.dll
%TEMP%\7zS4.tmp\cs\MailStoreHome.resources.dll
%TEMP%\7zS4.tmp\nl\MailStoreHome.resources.dll
%TEMP%\7zS4.tmp\zh-hk\MailStoreHome.resources.dll
%TEMP%\7zS4.tmp\es\MailStoreHome.resources.dll
%TEMP%\7zS4.tmp\zh-cn\MailStoreHome.resources.dll
%TEMP%\7zS4.tmp\MailStoreMapiClient_x86.exe
%TEMP%\7zS4.tmp\MailStorePDFReader.exe
%TEMP%\7zS4.tmp\MailStoreMapiClient_x64.exe
%TEMP%\7zS4.tmp\MailStoreHomePortable.exe
%TEMP%\7zS4.tmp\MailStoreHomeSetup.exe
%TEMP%\7zS4.tmp\Firebird_x86\ib_util.dll
%TEMP%\7zS4.tmp\Firebird_x86\icudt30.dll
%TEMP%\7zS4.tmp\Firebird_x86\intl\fbintl.dll
%TEMP%\7zS4.tmp\Firebird_x86\fbclient.dll
%TEMP%\7zS4.tmp\Firebird_x86\fbembed.dll

Удаляет следующие файлы:

%TEMP%\CabD.tmp
%TEMP%\CabB.tmp
%TEMP%\Cab11.tmp
%TEMP%\CabF.tmp
%TEMP%\Cab9.tmp
%TEMP%\mySecureSurfer_no_chrome.exe
%TEMP%\nsi3.tmp\KillProcDLL.dll
%TEMP%\Cab7.tmp
%TEMP%\Cab5.tmp

Сетевая активность:

Подключается к:

'cr#.##ertrust.com':80
'cr#.##modoca.com':80
'wp#d':80
'www.download.windowsupdate.com':80

TCP:

Запросы HTTP GET:

cr#.##ertrust.com/UTN-USERFirst-Object.crl
cr#.##modoca.com/COMODOCodeSigningCA2.crl
www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
wp#d/wpad.dat
www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt

UDP: