Trojan.KillFiles.21585

Техническая информация

Вредоносные функции:

Создает и запускает на исполнение:

'%TEMP%\is-GJE9R.tmp\DesktopIconToy.tmp' /SL5="$100E8,378892,141824,%TEMP%\_ir_sf_temp_0\DesktopIconToy.exe" /VERYSILENT
'%TEMP%\_ir_sf_temp_0\DesktopIconToy.exe' /VERYSILENT
'%TEMP%\_ir_sf_temp_0\irsetup.exe' __IRAOFF:1740146 "__IRAFN:<Полный путь к вирусу>" "__IRCT:0" "__IRTSS:0" "__IRSID:S-1-5-21-2052111302-484763869-725345543-1003"

Запускает на исполнение:

'<SYSTEM32>\wbem\wmiadap.exe' /R /T
'<SYSTEM32>\mode.com' con cols=70 lines=8
'<SYSTEM32>\cmd.exe' /c %TEMP%\_ir_sf_temp_0\start.bat

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\Desktop Icon Toy\is-MJS1B.tmp
%PROGRAM_FILES%\Desktop Icon Toy\Language\is-7V0IC.tmp
%PROGRAM_FILES%\Desktop Icon Toy\is-NSEES.tmp
%PROGRAM_FILES%\Desktop Icon Toy\is-IKUAC.tmp
%PROGRAM_FILES%\Desktop Icon Toy\Language\is-BLNBJ.tmp
%PROGRAM_FILES%\Desktop Icon Toy\Language\is-J2DQK.tmp
%PROGRAM_FILES%\Desktop Icon Toy\Language\is-10T18.tmp
%PROGRAM_FILES%\Desktop Icon Toy\Language\is-PJ42L.tmp
%PROGRAM_FILES%\Desktop Icon Toy\is-VBUPH.tmp
%PROGRAM_FILES%\Desktop Icon Toy\unins000.dat
%ALLUSERSPROFILE%\Start Menu\Programs\Desktop Icon Toy\Desktop Icon Toy.lnk
%ALLUSERSPROFILE%\Desktop\Unattended Soft.url
%TEMP%\www.softpir.com Setup Log.txt
%PROGRAM_FILES%\Desktop Icon Toy\is-26KIS.tmp
%PROGRAM_FILES%\Desktop Icon Toy\is-V7MK1.tmp
%ALLUSERSPROFILE%\Start Menu\Programs\Desktop Icon Toy\Uninstall Desktop Icon Toy.lnk
%PROGRAM_FILES%\Desktop Icon Toy\is-88KGA.tmp
%TEMP%\_ir_sf_temp_0\DesktopIconToy.exe
%TEMP%\_ir_sf_temp_0\IRIMG2.JPG
%TEMP%\_ir_sf_temp_0\start.bat
%TEMP%\_ir_sf_temp_0\DesktopIconToyX64.exe
%TEMP%\_ir_sf_temp_0\lua5.1.dll
%TEMP%\_ir_sf_temp_0\irsetup.exe
%TEMP%\_ir_sf_temp_0\IRIMG1.JPG
%TEMP%\_ir_sf_temp_0\irsetup.dat
%TEMP%\is-GJE9R.tmp\DesktopIconToy.tmp
%PROGRAM_FILES%\Desktop Icon Toy\Language\is-LU9K2.tmp
%PROGRAM_FILES%\Desktop Icon Toy\Language\is-9UBIH.tmp
%PROGRAM_FILES%\Desktop Icon Toy\Language\is-MSA6M.tmp
%PROGRAM_FILES%\Desktop Icon Toy\Language\is-2VJ1U.tmp
%PROGRAM_FILES%\Desktop Icon Toy\is-K9LFV.tmp
%TEMP%\is-JSBUA.tmp\_isetup\_shfoldr.dll
%PROGRAM_FILES%\Desktop Icon Toy\is-SH8IF.tmp
%PROGRAM_FILES%\Desktop Icon Toy\is-L40IG.tmp

Удаляет следующие файлы:

%TEMP%\_ir_sf_temp_0\IRIMG2.JPG
%TEMP%\_ir_sf_temp_0\IRIMG1.JPG
%TEMP%\_ir_sf_temp_0\DesktopIconToy.exe
%TEMP%\_ir_sf_temp_0\start.bat
%TEMP%\_ir_sf_temp_0\DesktopIconToyX64.exe
%TEMP%\is-JSBUA.tmp\_isetup\_shfoldr.dll
%TEMP%\_ir_sf_temp_0\irsetup.dat
%TEMP%\is-GJE9R.tmp\DesktopIconToy.tmp
<SYSTEM32>\PerfStringBackup.TMP
<SYSTEM32>\wbem\Performance\WmiApRpl.ini

Перемещает следующие файлы:

%PROGRAM_FILES%\Desktop Icon Toy\is-MJS1B.tmp в %PROGRAM_FILES%\Desktop Icon Toy\help.html
%PROGRAM_FILES%\Desktop Icon Toy\is-IKUAC.tmp в %PROGRAM_FILES%\Desktop Icon Toy\license.txt
%PROGRAM_FILES%\Desktop Icon Toy\Language\is-10T18.tmp в %PROGRAM_FILES%\Desktop Icon Toy\Language\Russian.ini
%PROGRAM_FILES%\Desktop Icon Toy\Language\is-7V0IC.tmp в %PROGRAM_FILES%\Desktop Icon Toy\Language\Spanish.ini
%PROGRAM_FILES%\Desktop Icon Toy\is-NSEES.tmp в %PROGRAM_FILES%\Desktop Icon Toy\help_de.html
%PROGRAM_FILES%\Desktop Icon Toy\is-26KIS.tmp в %PROGRAM_FILES%\Desktop Icon Toy\Empty.ico
%PROGRAM_FILES%\Desktop Icon Toy\is-88KGA.tmp в %PROGRAM_FILES%\Desktop Icon Toy\main.css
%PROGRAM_FILES%\Desktop Icon Toy\is-VBUPH.tmp в %PROGRAM_FILES%\Desktop Icon Toy\license_de.txt
%PROGRAM_FILES%\Desktop Icon Toy\is-V7MK1.tmp в %PROGRAM_FILES%\Desktop Icon Toy\help_es.html
%PROGRAM_FILES%\Desktop Icon Toy\Language\is-PJ42L.tmp в %PROGRAM_FILES%\Desktop Icon Toy\Language\Portuguse.ini
%PROGRAM_FILES%\Desktop Icon Toy\is-SH8IF.tmp в %PROGRAM_FILES%\Desktop Icon Toy\HookManager.dll
%PROGRAM_FILES%\Desktop Icon Toy\Language\is-9UBIH.tmp в %PROGRAM_FILES%\Desktop Icon Toy\Language\English.ini
%PROGRAM_FILES%\Desktop Icon Toy\is-K9LFV.tmp в %PROGRAM_FILES%\Desktop Icon Toy\unins000.exe
%PROGRAM_FILES%\Desktop Icon Toy\is-L40IG.tmp в %PROGRAM_FILES%\Desktop Icon Toy\DesktopIconToy.exe
%PROGRAM_FILES%\Desktop Icon Toy\Language\is-LU9K2.tmp в %PROGRAM_FILES%\Desktop Icon Toy\Language\Farsi.ini
%PROGRAM_FILES%\Desktop Icon Toy\Language\is-J2DQK.tmp в %PROGRAM_FILES%\Desktop Icon Toy\Language\Indonesia.ini
%PROGRAM_FILES%\Desktop Icon Toy\Language\is-BLNBJ.tmp в %PROGRAM_FILES%\Desktop Icon Toy\Language\Polski.ini
%PROGRAM_FILES%\Desktop Icon Toy\Language\is-2VJ1U.tmp в %PROGRAM_FILES%\Desktop Icon Toy\Language\French.ini
%PROGRAM_FILES%\Desktop Icon Toy\Language\is-MSA6M.tmp в %PROGRAM_FILES%\Desktop Icon Toy\Language\German.ini