Trojan.Click3.4726

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'Bluetooth Software' = '"%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\BtvStack.exe"'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'CTFMon' = '"%CommonProgramFiles%\Microsoft Shared\MSInfo\ctfmon.exe"'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Apple Push' = '"%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\places\APSDaemon.exe"'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'RDP Clip Monitor' = '"%APPDATA%\Microsoft\Windows\rdpclip.exe"'

Создает или изменяет следующие файлы:

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\schtasks.exe' /CREATE /F /RL HIGHEST /SC MINUTE /MO 25 /TN "RDP Clip Monitor" /TR "\"%APPDATA%\Microsoft\Windows\rdpclip.exe\""
'<SYSTEM32>\schtasks.exe' /CREATE /F /RL HIGHEST /SC MINUTE /MO 14 /TN "Apple Push" /TR "\"%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\places\APSDaemon.exe\""
'<SYSTEM32>\schtasks.exe' /CREATE /F /RL HIGHEST /SC MINUTE /MO 34 /TN "Bluetooth Software" /TR "\"%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\BtvStack.exe\""
'%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE' -u node.bot5 -p x -o http://yp###.net:8083 -t 2 -m8
'<SYSTEM32>\schtasks.exe' /CREATE /F /RL HIGHEST /SC MINUTE /MO 27 /TN "CTFMon" /TR "\"%CommonProgramFiles%\Microsoft Shared\MSInfo\ctfmon.exe\""
'<SYSTEM32>\schtasks.exe' /CREATE /F /RL HIGHEST /SC MINUTE /MO 27 /TN "RDP Clip Monitor" /TR "\"%APPDATA%\Microsoft\Windows\rdpclip.exe\""
'<SYSTEM32>\schtasks.exe' /CREATE /F /RL HIGHEST /SC MINUTE /MO 9 /TN "Apple Push" /TR "\"%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\places\APSDaemon.exe\""
'<SYSTEM32>\schtasks.exe' /CREATE /F /RL HIGHEST /SC MINUTE /MO 30 /TN "Bluetooth Software" /TR "\"%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\BtvStack.exe\""
'<SYSTEM32>\schtasks.exe' /CREATE /F /SC ONLOGON /TN "Windows Desktop Gadgets" /TR "\"%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\sidebar.exe\""
'<SYSTEM32>\schtasks.exe' /CREATE /F /RL HIGHEST /SC MINUTE /MO 6 /TN "CTFMon" /TR "\"%CommonProgramFiles%\Microsoft Shared\MSInfo\ctfmon.exe\""

Изменения в файловой системе:

Создает следующие файлы:

%APPDATA%\Microsoft\Windows\~xrwiens.tmp
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\~awzwtbj.tmp
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\places\~tvnpska.tmp
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\media\~uhstqnm.tmp
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\media\commh32.exe
%CommonProgramFiles%\Microsoft Shared\MSInfo\~kzzirhz.tmp
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\drivetable.txt
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\_filelst.cfg
%APPDATA%\Mozilla\Firefox\msvcr110.dll
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\~mztfeap.tmp
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\media\~ikhdggu.tmp
%APPDATA%\Microsoft\Windows\~bougtgx.tmp
%APPDATA%\Microsoft\Windows\rdpclip.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\places\APSDaemon.exe
%APPDATA%\Mozilla\Firefox\plugin-container.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\places\~vnstygr.tmp
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\~cqyfpht.tmp
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\~xpqzalz.tmp
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\sidebar.exe
%CommonProgramFiles%\Microsoft Shared\MSInfo\ctfmon.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\BtvStack.exe
%CommonProgramFiles%\Microsoft Shared\MSInfo\~beabrql.tmp

Удаляет следующие файлы:

%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\places\~tvnpska.tmp
%APPDATA%\Microsoft\Windows\~xrwiens.tmp
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\media\commh32.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\sidebar.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\media\~uhstqnm.tmp
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\media\~ikhdggu.tmp
<SYSTEM32>\Restore\MachineGuid.txt
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\~mztfeap.tmp
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\~awzwtbj.tmp
%CommonProgramFiles%\Microsoft Shared\MSInfo\~kzzirhz.tmp
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\~xpqzalz.tmp
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\places\APSDaemon.exe
%APPDATA%\Microsoft\Windows\~bougtgx.tmp
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\places\~vnstygr.tmp
%APPDATA%\Mozilla\Firefox\plugin-container.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Startup\plugin-container.exe
%CommonProgramFiles%\Microsoft Shared\MSInfo\~beabrql.tmp
%CommonProgramFiles%\Microsoft Shared\MSInfo\ctfmon.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\BtvStack.exe
%APPDATA%\Microsoft\Windows\rdpclip.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\~cqyfpht.tmp