Trojan.DownLoader12.319

Техническая информация

Вредоносные функции:

Создает и запускает на исполнение:

'%PROGRAM_FILES%\USB Vibration\7906\setup\setup.exe'

Запускает на исполнение:

'<SYSTEM32>\wbem\wmiadap.exe' /R /T

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\iscC.tmp
%CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\ctoB.tmp
%CommonProgramFiles%\InstallShield\Professional\RunTime\IsPE.tmp
%CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\iusD.tmp
%CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\DotA.tmp
%TEMP%\_se8.tmp
%CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\isp6.tmp\temp.000
%CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\iKe9.tmp
%TEMP%\isp5.tmp\temp.000
%TEMP%\{60AD3BCB-7ADD-45D1-8538-FE8CA3BE3C63}\{4999B2F1-3E74-409A-B8B5-E94448AA9EA6}\isrtaf7b.rra
%TEMP%\{60AD3BCB-7ADD-45D1-8538-FE8CA3BE3C63}\{4999B2F1-3E74-409A-B8B5-E94448AA9EA6}\Striaf3c.rra
%TEMP%\{60AD3BCB-7ADD-45D1-8538-FE8CA3BE3C63}\{4999B2F1-3E74-409A-B8B5-E94448AA9EA6}\_IsRb036.rra
%TEMP%\{60AD3BCB-7ADD-45D1-8538-FE8CA3BE3C63}\{4999B2F1-3E74-409A-B8B5-E94448AA9EA6}\defab007.rra
%TEMP%\{60AD3BCB-7ADD-45D1-8538-FE8CA3BE3C63}\coreaecf.rra
%CommonProgramFiles%\InstallShield\Professional\RunTime\iKernel.rgs
%CommonProgramFiles%\InstallShield\Professional\RunTime\IsProBE.tlb
%TEMP%\{60AD3BCB-7ADD-45D1-8538-FE8CA3BE3C63}\{4999B2F1-3E74-409A-B8B5-E94448AA9EA6}\setuae52.rra
%CommonProgramFiles%\InstallShield\Professional\RunTime\ObjF.tmp
%PROGRAM_FILES%\USB Vibration\7906\setup\setup.exe
%PROGRAM_FILES%\USB Vibration\7906\setup\setup.boot
%PROGRAM_FILES%\USB Vibration\7906\setup\setup.inx
%PROGRAM_FILES%\USB Vibration\7906\setup\setup.ini
%PROGRAM_FILES%\USB Vibration\7906\setup\layout.bin
%PROGRAM_FILES%\USB Vibration\7906\setup\data1.hdr
%PROGRAM_FILES%\USB Vibration\7906\setup\data2.cab
%PROGRAM_FILES%\USB Vibration\7906\setup\engine32.cab
%PROGRAM_FILES%\USB Vibration\7906\setup\data1.cab
%TEMP%\_isdelet.ini
%CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\isp3.tmp\temp.000
%TEMP%\igd7.tmp
%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\7fcf070644a2444088fdd2ef01ce748c_23ef5514-3059-436f-a4a7-4cefaab20eb1
%TEMP%\set4.tmp
%TEMP%\isp1.tmp\temp.000
%TEMP%\set2.tmp
%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\bc90c0155fc904ba2efd3bc1b435425d_23ef5514-3059-436f-a4a7-4cefaab20eb1

Удаляет следующие файлы:

%CommonProgramFiles%\InstallShield\Professional\RunTime\IsPE.tmp
%TEMP%\_se8.tmp
<SYSTEM32>\PerfStringBackup.TMP
<SYSTEM32>\wbem\Performance\WmiApRpl.ini
%TEMP%\set4.tmp
%TEMP%\set2.tmp
%TEMP%\igd7.tmp
%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\bc90c0155fc904ba2efd3bc1b435425d_23ef5514-3059-436f-a4a7-4cefaab20eb1

Перемещает следующие файлы:

%CommonProgramFiles%\InstallShield\Professional\RunTime\ObjF.tmp в %CommonProgramFiles%\InstallShield\Professional\RunTime\Objectps.dll
%TEMP%\{60AD3BCB-7ADD-45D1-8538-FE8CA3BE3C63}\{4999B2F1-3E74-409A-B8B5-E94448AA9EA6}\setuae52.rra в %TEMP%\{60AD3BCB-7ADD-45D1-8538-FE8CA3BE3C63}\{4999B2F1-3E74-409A-B8B5-E94448AA9EA6}\setup.inx
%CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\iscC.tmp в %CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\iscript.dll
%CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\iusD.tmp в %CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\iuser.dll
%TEMP%\{60AD3BCB-7ADD-45D1-8538-FE8CA3BE3C63}\coreaecf.rra в %TEMP%\{60AD3BCB-7ADD-45D1-8538-FE8CA3BE3C63}\corecomp.ini
%TEMP%\{60AD3BCB-7ADD-45D1-8538-FE8CA3BE3C63}\{4999B2F1-3E74-409A-B8B5-E94448AA9EA6}\defab007.rra в %TEMP%\{60AD3BCB-7ADD-45D1-8538-FE8CA3BE3C63}\{4999B2F1-3E74-409A-B8B5-E94448AA9EA6}\default.pal
%TEMP%\{60AD3BCB-7ADD-45D1-8538-FE8CA3BE3C63}\{4999B2F1-3E74-409A-B8B5-E94448AA9EA6}\_IsRb036.rra в %TEMP%\{60AD3BCB-7ADD-45D1-8538-FE8CA3BE3C63}\{4999B2F1-3E74-409A-B8B5-E94448AA9EA6}\_IsRes.dll
%TEMP%\{60AD3BCB-7ADD-45D1-8538-FE8CA3BE3C63}\{4999B2F1-3E74-409A-B8B5-E94448AA9EA6}\Striaf3c.rra в %TEMP%\{60AD3BCB-7ADD-45D1-8538-FE8CA3BE3C63}\{4999B2F1-3E74-409A-B8B5-E94448AA9EA6}\StringTable-0009-English.ips
%TEMP%\{60AD3BCB-7ADD-45D1-8538-FE8CA3BE3C63}\{4999B2F1-3E74-409A-B8B5-E94448AA9EA6}\isrtaf7b.rra в %TEMP%\{60AD3BCB-7ADD-45D1-8538-FE8CA3BE3C63}\{4999B2F1-3E74-409A-B8B5-E94448AA9EA6}\isrt.dll
%CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\isp3.tmp\Setup.dll в %CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\Setup.dll
%CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\isp6.tmp\temp.000 в %CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\isp6.tmp\IGdi.dll
%TEMP%\isp1.tmp\temp.000 в %TEMP%\isp1.tmp\Setup.dll
%CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\isp3.tmp\temp.000 в %CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\isp3.tmp\Setup.dll
%CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\isp6.tmp\IGdi.dll в %CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\IGdi.dll
%CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\DotA.tmp в %CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\DotNetInstaller.exe
%CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\ctoB.tmp в %CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\ctor.dll
%TEMP%\isp5.tmp\temp.000 в %TEMP%\isp5.tmp\_Setup.dll
%CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\iKe9.tmp в %CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\iKernel.dll