Trojan.DownLoader12.60315

Техническая информация

Вредоносные функции:

Создает и запускает на исполнение:

'<LS_APPDATA>\Spoon\Sandbox\Total Uninstall Pro\6.13.0.300\local\stubexe\0xFC10D269F886D5C2\Tu-x86.exe'
'<LS_APPDATA>\Spoon\Sandbox\Total Uninstall Pro\6.13.0.300\local\stubexe\0x8A6B4187BD1CD80F\Tu.exe'

Ищет следующие окна с целью

обнаружения утилит для анализа:

ClassName: 'pediy06' WindowName: ''
ClassName: 'GBDYLLO' WindowName: ''
ClassName: 'OLLYDBG' WindowName: ''

Изменения в файловой системе:

Создает следующие файлы:

<LS_APPDATA>\Spoon\Sandbox\Total Uninstall Pro\6.13.0.300\roaming\meta\@APPDATACOMMON@\Martau\Total Uninstall 6\Monitored Programs.Folders.__meta__.__tmp__
%ALLUSERSPROFILE%\Application Data\Martau\Total Uninstall 6\Monitored Programs.Folders
<LS_APPDATA>\Spoon\Sandbox\Total Uninstall Pro\6.13.0.300\local\temp\@APPDATACOMMON@\Martau\Total Uninstall 6\Monitored Programs.Folders
%TEMP%\~3586451651.tmp
%WINDIR%\Q550418.log
<LS_APPDATA>\Spoon\Sandbox\Total Uninstall Pro\6.13.0.300\roaming\meta\@APPDATACOMMON@\Martau\Total Uninstall 6\Installed Programs.Folders.__meta__.__tmp__
%ALLUSERSPROFILE%\Application Data\Martau\Total Uninstall 6\Installed Programs.Folders
<LS_APPDATA>\Spoon\Sandbox\Total Uninstall Pro\6.13.0.300\local\temp\@APPDATACOMMON@\Martau\Total Uninstall 6\Installed Programs.Folders
%ALLUSERSPROFILE%\Application Data\Martau\Total Uninstall 6\Installed Programs2.Cache
%ALLUSERSPROFILE%\Application Data\Martau\Total Uninstall 6\Installed Programs3.Cache
%TEMP%\SPOON\CACHE\0x69CA3E4724AB28A2\sxs\ia64_Total Uninstall@1.0.0.0\ia64_Total Uninstall@1.0.0.0.manifest.__tmp__
%TEMP%\SPOON\CACHE\0x69CA3E4724AB28A2\sxs\ia64_Total Uninstall@1.0.0.0\Total Uninstall.manifest.__tmp__
<LS_APPDATA>\Spoon\Sandbox\Total Uninstall Pro\6.13.0.300\local\stubexe\0xFC10D269F886D5C2\Tu-x86.exe.__tmp__
<LS_APPDATA>\Spoon\Sandbox\Total Uninstall Pro\6.13.0.300\xsandbox.bin.__tmp__
<LS_APPDATA>\Spoon\Sandbox\Total Uninstall Pro\6.13.0.300\local\stubexe\0x8A6B4187BD1CD80F\Tu.exe.__tmp__
%TEMP%\SPOON\CACHE\0x69CA3E4724AB28A2\sxs\x86_Total Uninstall@1.0.0.0\x86_Total Uninstall@1.0.0.0.manifest.__tmp__
%ALLUSERSPROFILE%\Application Data\mntemp
%TEMP%\SPOON\CACHE\0x69CA3E4724AB28A2\sxs\x86_Total Uninstall@1.0.0.0\Total Uninstall.manifest.__tmp__
%TEMP%\SPOON\CACHE\0x69CA3E4724AB28A2\sxs\Manifests\Tu-amd64.exe_0x0bc659c4b3a2d7c6038c41ac01d83df8.1.manifest.__tmp__
%TEMP%\SPOON\CACHE\0x69CA3E4724AB28A2\sxs\Manifests\Tu-x86.exe_0xdda57d268d8f33d8631a8f9ee1eaec7b.1.manifest.__tmp__

Удаляет следующие файлы:

<LS_APPDATA>\Spoon\Sandbox\Total Uninstall Pro\6.13.0.300\roaming\modified\@APPDATACOMMON@\Martau\Total Uninstall 6\Installed Programs.Folders
<LS_APPDATA>\Spoon\Sandbox\Total Uninstall Pro\6.13.0.300\roaming\meta\@APPDATACOMMON@\Martau\Total Uninstall 6\Installed Programs.Folders.__meta__
<LS_APPDATA>\Spoon\Sandbox\Total Uninstall Pro\6.13.0.300\roaming\modified\@APPDATACOMMON@\Martau\Total Uninstall 6\Monitored Programs.Folders
<LS_APPDATA>\Spoon\Sandbox\Total Uninstall Pro\6.13.0.300\roaming\meta\@APPDATACOMMON@\Martau\Total Uninstall 6\Monitored Programs.Folders.__meta__

Перемещает следующие файлы:

<LS_APPDATA>\Spoon\Sandbox\Total Uninstall Pro\6.13.0.300\local\temp\@APPDATACOMMON@\Martau\Total Uninstall 6\Monitored Programs.Folders в <LS_APPDATA>\Spoon\Sandbox\Total Uninstall Pro\6.13.0.300\roaming\modified\@APPDATACOMMON@\Martau\Total Uninstall 6\Monitored Programs.Folders
%TEMP%\SPOON\CACHE\0x69CA3E4724AB28A2\sxs\x86_Total Uninstall@1.0.0.0\x86_Total Uninstall@1.0.0.0.manifest.__tmp__ в %TEMP%\SPOON\CACHE\0x69CA3E4724AB28A2\sxs\x86_Total Uninstall@1.0.0.0\x86_Total Uninstall@1.0.0.0.manifest
%TEMP%\SPOON\CACHE\0x69CA3E4724AB28A2\sxs\x86_Total Uninstall@1.0.0.0\Total Uninstall.manifest.__tmp__ в %TEMP%\SPOON\CACHE\0x69CA3E4724AB28A2\sxs\x86_Total Uninstall@1.0.0.0\Total Uninstall.manifest
<LS_APPDATA>\Spoon\Sandbox\Total Uninstall Pro\6.13.0.300\roaming\meta\@APPDATACOMMON@\Martau\Total Uninstall 6\Installed Programs.Folders.__meta__.__tmp__ в <LS_APPDATA>\Spoon\Sandbox\Total Uninstall Pro\6.13.0.300\roaming\meta\@APPDATACOMMON@\Martau\Total Uninstall 6\Installed Programs.Folders.__meta__
<LS_APPDATA>\Spoon\Sandbox\Total Uninstall Pro\6.13.0.300\local\temp\@APPDATACOMMON@\Martau\Total Uninstall 6\Installed Programs.Folders в <LS_APPDATA>\Spoon\Sandbox\Total Uninstall Pro\6.13.0.300\roaming\modified\@APPDATACOMMON@\Martau\Total Uninstall 6\Installed Programs.Folders
<LS_APPDATA>\Spoon\Sandbox\Total Uninstall Pro\6.13.0.300\roaming\meta\@APPDATACOMMON@\Martau\Total Uninstall 6\Monitored Programs.Folders.__meta__.__tmp__ в <LS_APPDATA>\Spoon\Sandbox\Total Uninstall Pro\6.13.0.300\roaming\meta\@APPDATACOMMON@\Martau\Total Uninstall 6\Monitored Programs.Folders.__meta__
%TEMP%\SPOON\CACHE\0x69CA3E4724AB28A2\sxs\Manifests\Tu-x86.exe_0xdda57d268d8f33d8631a8f9ee1eaec7b.1.manifest.__tmp__ в %TEMP%\SPOON\CACHE\0x69CA3E4724AB28A2\sxs\Manifests\Tu-x86.exe_0xdda57d268d8f33d8631a8f9ee1eaec7b.1.manifest
<LS_APPDATA>\Spoon\Sandbox\Total Uninstall Pro\6.13.0.300\local\stubexe\0xFC10D269F886D5C2\Tu-x86.exe.__tmp__ в <LS_APPDATA>\Spoon\Sandbox\Total Uninstall Pro\6.13.0.300\local\stubexe\0xFC10D269F886D5C2\Tu-x86.exe
<LS_APPDATA>\Spoon\Sandbox\Total Uninstall Pro\6.13.0.300\local\stubexe\0x8A6B4187BD1CD80F\Tu.exe.__tmp__ в <LS_APPDATA>\Spoon\Sandbox\Total Uninstall Pro\6.13.0.300\local\stubexe\0x8A6B4187BD1CD80F\Tu.exe
<LS_APPDATA>\Spoon\Sandbox\Total Uninstall Pro\6.13.0.300\xsandbox.bin.__tmp__ в <LS_APPDATA>\Spoon\Sandbox\Total Uninstall Pro\6.13.0.300\xsandbox.bin
%TEMP%\SPOON\CACHE\0x69CA3E4724AB28A2\sxs\Manifests\Tu-amd64.exe_0x0bc659c4b3a2d7c6038c41ac01d83df8.1.manifest.__tmp__ в %TEMP%\SPOON\CACHE\0x69CA3E4724AB28A2\sxs\Manifests\Tu-amd64.exe_0x0bc659c4b3a2d7c6038c41ac01d83df8.1.manifest
%TEMP%\SPOON\CACHE\0x69CA3E4724AB28A2\sxs\ia64_Total Uninstall@1.0.0.0\Total Uninstall.manifest.__tmp__ в %TEMP%\SPOON\CACHE\0x69CA3E4724AB28A2\sxs\ia64_Total Uninstall@1.0.0.0\Total Uninstall.manifest
%TEMP%\SPOON\CACHE\0x69CA3E4724AB28A2\sxs\ia64_Total Uninstall@1.0.0.0\ia64_Total Uninstall@1.0.0.0.manifest.__tmp__ в %TEMP%\SPOON\CACHE\0x69CA3E4724AB28A2\sxs\ia64_Total Uninstall@1.0.0.0\ia64_Total Uninstall@1.0.0.0.manifest