Trojan.DownLoader11.49524

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Sam' = 'C:\Sam\SamStarter.exe'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\Administrator Control Manager] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\SamClientManager] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

'C:\Sam\SamPrintManager.exe'
'C:\Sam\AdminControl.exe'
'%PROGRAM_FILES%\SAM\Extract.exe'
'C:\Sam\CLTSERV.EXE'

Изменения в файловой системе:

Создает следующие файлы:

C:\Sam\OPACControl.ini
C:\Sam\Printers.ini
C:\Sam\ClearIE.exe
C:\Sam\Opac_Control.exe
C:\Sam\Browsers.ini
C:\Sam\APPSITE.ini
C:\Sam\Patron.ini
C:\Sam\clntinfo.ini
C:\Sam\SamFilter.exe
C:\Sam\SamLock_Esp.bmp
C:\Sam\SamLogo_Esp.bmp
C:\Sam\button1_Esp.bmp
C:\Sam\SamDefault_Esp.bmp
C:\Sam\SelfReg.exe
C:\Sam\Browser_Control.exe
C:\Sam\SamLogosmall.bmp
C:\Sam\AdminControl.exe
C:\Sam\PrintPolicy.dat
C:\Sam\LogOff.exe
C:\Sam\SamLogo.bmp
C:\Sam\SamAppSiteMetering.exe
C:\Sam\SamPrinting.exe
C:\Sam\SessionInfo.exe
C:\Sam\Policy.dat
C:\Sam\PrintDocument.exe
C:\Sam\SamLock.bmp
C:\Sam\SamUpdate.exe
C:\Sam\SamStarter.exe
C:\Sam\Applications.ini
C:\Sam\Powerby.bmp
C:\Sam\CLTSERV.EXE
C:\Sam\SamDefault.bmp
C:\Sam\SamPrintManager.exe
C:\Sam\Shortcuts.EXE
<SYSTEM32>\Pcl6.dll
<SYSTEM32>\Pcl3.dll
<SYSTEM32>\SmartCardHooks.dll
<SYSTEM32>\SessionInfoDLL.dll
%WINDIR%\system\MSVCRTD.dll
%WINDIR%\system\sehooks.dll
<SYSTEM32>\KioskCommDLL.dll
%WINDIR%\system\SCARD32.DLL
<SYSTEM32>\SmartIE.dll
<SYSTEM32>\MSVCRTD.dll
<SYSTEM32>\sehooks.dll
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\CJCTQ25G\EventLog[1].htm
<SYSTEM32>\SCARD32.DLL
<SYSTEM32>\SCInterData.dll
<SYSTEM32>\TimerManager.dll
<SYSTEM32>\agena.dll
<SYSTEM32>\HookMDesktops.dll
C:\Sam\button7_Esp.bmp
C:\Sam\button6_Esp.bmp
%WINDIR%\system\KioskCommDLL.dll
C:\Sam\button8_Esp.bmp
C:\Sam\button3_Esp.bmp
C:\Sam\button2_Esp.bmp
C:\Sam\button5_Esp.bmp
C:\Sam\button4_Esp.bmp
%WINDIR%\system\Pcl3.dll
%WINDIR%\system\SCInterData.dll
%WINDIR%\system\TimerManager.dll
%WINDIR%\system\agena.dll
%WINDIR%\system\HookMDesktops.dll
%WINDIR%\system\SessionInfoDLL.dll
%WINDIR%\system\Pcl6.dll
%WINDIR%\system\SmartIE.dll
%WINDIR%\system\SmartCardHooks.dll
C:\Sam\SCClient.exe
%PROGRAM_FILES%\SAM\Sam\Button7_Esp.bmp
%PROGRAM_FILES%\SAM\Sam\Button7.bmp
%PROGRAM_FILES%\SAM\Sam\Button8_Esp.bmp
%PROGRAM_FILES%\SAM\Sam\Button8.bmp
%PROGRAM_FILES%\SAM\Sam\Button5_Esp.bmp
%PROGRAM_FILES%\SAM\Sam\button4_Esp.bmp
%PROGRAM_FILES%\SAM\Sam\Button6_Esp.bmp
%PROGRAM_FILES%\SAM\Sam\Button6.bmp
%PROGRAM_FILES%\SAM\Sam\ClearIE.exe
%PROGRAM_FILES%\SAM\Sam\Patron.ini
%PROGRAM_FILES%\SAM\Sam\Opac_Control.exe
%PROGRAM_FILES%\SAM\Sam\Powerby.bmp
%PROGRAM_FILES%\SAM\Sam\Policy.dat
%PROGRAM_FILES%\SAM\Sam\CLTSERV.EXE
%PROGRAM_FILES%\SAM\Sam\clntinfo.ini
%PROGRAM_FILES%\SAM\Sam\OPACControl.ini
%PROGRAM_FILES%\SAM\Sam\LogOff.exe
%PROGRAM_FILES%\SAM\Sam\Applications.ini
%PROGRAM_FILES%\SAM\Sam\AdminControl.exe
%PROGRAM_FILES%\SAM\Sam\Browsers.ini
%PROGRAM_FILES%\SAM\Sam\APPSITE.INI
%TEMP%\plf1.tmp
%TEMP%\ext2.tmp
%PROGRAM_FILES%\SAM\Extract.exe
%TEMP%\pft3.tmp\pftw1.pkg
%PROGRAM_FILES%\SAM\Sam\Browser_Control.exe
%PROGRAM_FILES%\SAM\Sam\button3.bmp
%PROGRAM_FILES%\SAM\Sam\button2_Esp.bmp
%PROGRAM_FILES%\SAM\Sam\button4.bmp
%PROGRAM_FILES%\SAM\Sam\button3_Esp.bmp
%PROGRAM_FILES%\SAM\Sam\button1.bmp
%PROGRAM_FILES%\SAM\Sam\Button 5.bmp
%PROGRAM_FILES%\SAM\Sam\button2.bmp
%PROGRAM_FILES%\SAM\Sam\button1_Esp.bmp
%PROGRAM_FILES%\SAM\Windows\HookMDesktops.dll
%PROGRAM_FILES%\SAM\Windows\agena.dll
%PROGRAM_FILES%\SAM\Windows\MSVCRTD.DLL
%PROGRAM_FILES%\SAM\Windows\KioskCommDLL.dll
%PROGRAM_FILES%\SAM\Sam\SelfReg.exe
%PROGRAM_FILES%\SAM\Sam\SCClient.exe
%PROGRAM_FILES%\SAM\Sam\Shortcuts.exe
%PROGRAM_FILES%\SAM\Sam\SessionInfo.exe
%PROGRAM_FILES%\SAM\Windows\Pcl3.dll
%PROGRAM_FILES%\SAM\Windows\SmartCardHooks.dll
%PROGRAM_FILES%\SAM\Windows\SessionInfoDLL.dll
%PROGRAM_FILES%\SAM\Windows\TimerManager.dll
%PROGRAM_FILES%\SAM\Windows\SmartIE.dll
%PROGRAM_FILES%\SAM\Windows\SCARD32.DLL
%PROGRAM_FILES%\SAM\Windows\Pcl6.dll
%PROGRAM_FILES%\SAM\Windows\sehooks.dll
%PROGRAM_FILES%\SAM\Windows\SCInterData.dll
%PROGRAM_FILES%\SAM\Sam\SamDefault_Esp.bmp
%PROGRAM_FILES%\SAM\Sam\SamDefault.bmp
%PROGRAM_FILES%\SAM\Sam\SamInvoiceLogo.bmp
%PROGRAM_FILES%\SAM\Sam\SamFilter.exe
%PROGRAM_FILES%\SAM\Sam\Printers.ini
%PROGRAM_FILES%\SAM\Sam\PrintDocument.exe
%PROGRAM_FILES%\SAM\Sam\SamAppSiteMetering.exe
%PROGRAM_FILES%\SAM\Sam\PrintPolicy.dat
%PROGRAM_FILES%\SAM\Sam\SamLock.bmp
%PROGRAM_FILES%\SAM\Sam\SamPrintManager.exe
%PROGRAM_FILES%\SAM\Sam\SamPrinting.exe
%PROGRAM_FILES%\SAM\Sam\SamUpdate.exe
%PROGRAM_FILES%\SAM\Sam\SamStarter.exe
%PROGRAM_FILES%\SAM\Sam\SamLogo.bmp
%PROGRAM_FILES%\SAM\Sam\SamLock_Esp.bmp
%PROGRAM_FILES%\SAM\Sam\SamLogo_Esp.bmp
%PROGRAM_FILES%\SAM\Sam\SamLogosmall.bmp