Trojan.PWS.Tibia.2625

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Optimizer Pro' = '%PROGRAM_FILES%\Optimizer Pro\OptProLauncher.exe'

Вредоносные функции:

Создает и запускает на исполнение:

'%TEMP%\is-4QF1C.tmp\optprosetup.tmp' /SL5="$10108,5312022,115200,%TEMP%\optprosetup.exe" /VERYSILENT /verysilent
'%TEMP%\optprosetup.exe' /VERYSILENT /verysilent
'%TEMP%\RarSFX0\OptimizerPro2.exe' /verysilent

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\Optimizer Pro\is-7POGK.tmp
%PROGRAM_FILES%\Optimizer Pro\is-1H6OC.tmp
%PROGRAM_FILES%\Optimizer Pro\is-QCJBO.tmp
%PROGRAM_FILES%\Optimizer Pro\is-228D4.tmp
%PROGRAM_FILES%\Optimizer Pro\is-VGJ5J.tmp
%PROGRAM_FILES%\Optimizer Pro\is-CCP4A.tmp
%PROGRAM_FILES%\Optimizer Pro\is-8NT4I.tmp
%PROGRAM_FILES%\Optimizer Pro\is-4HE99.tmp
%PROGRAM_FILES%\Optimizer Pro\is-F7N19.tmp
%ALLUSERSPROFILE%\Start Menu\Programs\Optimizer Pro v3.2\Check updates.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Optimizer Pro v3.2\Uninstall Optimizer Pro.lnk
%PROGRAM_FILES%\Optimizer Pro\unins000.dat
%PROGRAM_FILES%\Optimizer Pro\unins000.msg
%ALLUSERSPROFILE%\Start Menu\Programs\Optimizer Pro v3.2\Optimizer Pro on the Web.lnk
%HOMEPATH%\Desktop\Optimizer Pro.lnk
%PROGRAM_FILES%\Optimizer Pro\is-CNRM5.tmp
%ALLUSERSPROFILE%\Start Menu\Programs\Optimizer Pro v3.2\Help.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Optimizer Pro v3.2\Optimizer Pro.lnk
%TEMP%\is-DQEES.tmp\OptProCrash.dll
%TEMP%\is-DQEES.tmp\OptProHelper.dll
%PROGRAM_FILES%\Optimizer Pro\is-Q060O.tmp
%PROGRAM_FILES%\Optimizer Pro\is-I6SAQ.tmp
%TEMP%\is-DQEES.tmp\itdownload.dll
%TEMP%\optprosetup.exe
%TEMP%\RarSFX0\OptimizerPro2.exe
%TEMP%\is-DQEES.tmp\_isetup\_shfoldr.dll
%TEMP%\is-4QF1C.tmp\optprosetup.tmp
%PROGRAM_FILES%\Optimizer Pro\is-8KH76.tmp
%PROGRAM_FILES%\Optimizer Pro\is-VMS4U.tmp
%PROGRAM_FILES%\Optimizer Pro\is-F7K39.tmp
%PROGRAM_FILES%\Optimizer Pro\is-PG0KL.tmp
%PROGRAM_FILES%\Optimizer Pro\is-I10QB.tmp
%PROGRAM_FILES%\Optimizer Pro\is-AFM6V.tmp
%PROGRAM_FILES%\Optimizer Pro\is-COK1O.tmp
%PROGRAM_FILES%\Optimizer Pro\is-CRRH3.tmp
%PROGRAM_FILES%\Optimizer Pro\is-URL29.tmp

Перемещает следующие файлы:

%PROGRAM_FILES%\Optimizer Pro\is-4HE99.tmp в %PROGRAM_FILES%\Optimizer Pro\OptimizerPro.chm
%PROGRAM_FILES%\Optimizer Pro\is-VGJ5J.tmp в %PROGRAM_FILES%\Optimizer Pro\file_id.diz
%PROGRAM_FILES%\Optimizer Pro\is-F7N19.tmp в %PROGRAM_FILES%\Optimizer Pro\English.ini
%PROGRAM_FILES%\Optimizer Pro\is-8NT4I.tmp в %PROGRAM_FILES%\Optimizer Pro\OptProLauncher.exe
%PROGRAM_FILES%\Optimizer Pro\is-CCP4A.tmp в %PROGRAM_FILES%\Optimizer Pro\OptProUninstaller.exe
%PROGRAM_FILES%\Optimizer Pro\is-QCJBO.tmp в %PROGRAM_FILES%\Optimizer Pro\OptProHelper.dll
%PROGRAM_FILES%\Optimizer Pro\is-CNRM5.tmp в %PROGRAM_FILES%\Optimizer Pro\itdownload.dll
%PROGRAM_FILES%\Optimizer Pro\is-228D4.tmp в %PROGRAM_FILES%\Optimizer Pro\cancel.bmp
%PROGRAM_FILES%\Optimizer Pro\is-1H6OC.tmp в %PROGRAM_FILES%\Optimizer Pro\HomePage.url
%PROGRAM_FILES%\Optimizer Pro\is-7POGK.tmp в %PROGRAM_FILES%\Optimizer Pro\bg_new3.bmp
%PROGRAM_FILES%\Optimizer Pro\is-F7K39.tmp в %PROGRAM_FILES%\Optimizer Pro\OptProSchedule.exe
%PROGRAM_FILES%\Optimizer Pro\is-AFM6V.tmp в %PROGRAM_FILES%\Optimizer Pro\scan.gif
%PROGRAM_FILES%\Optimizer Pro\is-URL29.tmp в %PROGRAM_FILES%\Optimizer Pro\StartupList.txt
%PROGRAM_FILES%\Optimizer Pro\is-COK1O.tmp в %PROGRAM_FILES%\Optimizer Pro\sqlite3.dll
%PROGRAM_FILES%\Optimizer Pro\is-I6SAQ.tmp в %PROGRAM_FILES%\Optimizer Pro\unins000.exe
%PROGRAM_FILES%\Optimizer Pro\is-Q060O.tmp в %PROGRAM_FILES%\Optimizer Pro\OptimizerPro.exe
%PROGRAM_FILES%\Optimizer Pro\is-8KH76.tmp в %PROGRAM_FILES%\Optimizer Pro\OptProSmartScan.exe
%PROGRAM_FILES%\Optimizer Pro\is-PG0KL.tmp в %PROGRAM_FILES%\Optimizer Pro\OptProGuard.exe
%PROGRAM_FILES%\Optimizer Pro\is-VMS4U.tmp в %PROGRAM_FILES%\Optimizer Pro\OptProReminder.exe
%PROGRAM_FILES%\Optimizer Pro\is-CRRH3.tmp в %PROGRAM_FILES%\Optimizer Pro\CookiesException.txt
%PROGRAM_FILES%\Optimizer Pro\is-I10QB.tmp в %PROGRAM_FILES%\Optimizer Pro\OptProStart.exe

Сетевая активность:

Подключается к:

'15#.#66.255.19':80
'op##ro.info':80
'op###izepro.biz':80

TCP:

Запросы HTTP GET:

op###izepro.biz/inst?si#######################################################
op###izepro.biz/inst?hi#############################################################################################################################################################

Запросы HTTP POST: