Trojan.PWS.Steam.12557

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'ywbpu' = '%HOMEPATH%\ywbpu\start.vbs'

Вредоносные функции:

Создает и запускает на исполнение:

'<SYSTEM32>\wscript.exe' "%HOMEPATH%\ywbpu\2437299.vbs"

Запускает на исполнение:

'%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' /stext "%TEMP%\logff.txt
'%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' /stext "%TEMP%\logmail.txt
'%HOMEPATH%\ywbpu\bomx.exe' 2450220.DUY
'%WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe'

Внедряет код в

следующие системные процессы:

%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Ищет ветки реестра, отвечающие за хранение паролей сторонними программами:

[<HKCU>\Software\Microsoft\Windows Live Mail]
[<HKCU>\Software\Microsoft\IdentityCRL]
[<HKCU>\Software\Microsoft\Internet Explorer\IntelliForms\Storage2]
[<HKCU>\Software\IMVU\password]
[<HKCU>\SOFTWARE\Valve\Steam]
[<HKCU>\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts]
[<HKCU>\Software\Microsoft\Internet Account Manager\Accounts]
[<HKCU>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Software\Microsoft\Internet Account Manager\Accounts]
[<HKCU>\Software\Microsoft\MSNMessenger]
[<HKCU>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts]

Изменения в файловой системе:

Создает следующие файлы:

%HOMEPATH%\ywbpu\3362.ytm
%HOMEPATH%\ywbpu\80261.flf
%HOMEPATH%\ywbpu\44800.bko
%HOMEPATH%\ywbpu\2749.jqk
%HOMEPATH%\ywbpu\98453.fso
%HOMEPATH%\ywbpu\44681.irt
%HOMEPATH%\ywbpu\33584.ifs
%HOMEPATH%\ywbpu\21903.uwr
%HOMEPATH%\ywbpu\6232.ufn
%HOMEPATH%\ywbpu\7901.ebf
%HOMEPATH%\ywbpu\42789.wwd
%HOMEPATH%\ywbpu\20827.akn
%HOMEPATH%\ywbpu\61218.khm
%HOMEPATH%\ywbpu\25382.jab
%HOMEPATH%\ywbpu\53685.vqa
%HOMEPATH%\ywbpu\28309.pcd
%HOMEPATH%\ywbpu\62301.fnn
%HOMEPATH%\ywbpu\6666.uck
%HOMEPATH%\ywbpu\28472.soz
%HOMEPATH%\ywbpu\16428.qgs
%HOMEPATH%\ywbpu\66590.qfd
%HOMEPATH%\ywbpu\41929.yso
%HOMEPATH%\ywbpu\15831.otk
%HOMEPATH%\ywbpu\57270.vwx
%HOMEPATH%\ywbpu\33645.lul
%HOMEPATH%\ywbpu\46101.nal
%HOMEPATH%\ywbpu\17814.bph
%HOMEPATH%\ywbpu\50959.ame
%HOMEPATH%\ywbpu\40383.uai
%HOMEPATH%\ywbpu\93430.boc
%HOMEPATH%\ywbpu\12757.cnu
%HOMEPATH%\ywbpu\36103.uas
%HOMEPATH%\ywbpu\86564.wqt
%HOMEPATH%\ywbpu\66587.bph
%HOMEPATH%\ywbpu\87039.cez
%HOMEPATH%\ywbpu\45112.yvs
%HOMEPATH%\ywbpu\73894.nxy
%HOMEPATH%\ywbpu\3228.gmg
%HOMEPATH%\ywbpu\14262.nfr
%HOMEPATH%\ywbpu\79321.ivh
%HOMEPATH%\ywbpu\14897.gnp
%HOMEPATH%\ywbpu\97750.bay
%HOMEPATH%\ywbpu\66675.jps
%HOMEPATH%\ywbpu\39329.yic
%HOMEPATH%\ywbpu\30737.xuq
%HOMEPATH%\ywbpu\9271.rno
%HOMEPATH%\ywbpu\59139.cce
%HOMEPATH%\ywbpu\98856.ywt
%HOMEPATH%\ywbpu\41481.qmq
%HOMEPATH%\ywbpu\55921.zth
%HOMEPATH%\ywbpu\34771.lcf
%HOMEPATH%\ywbpu\85610.kpv
%HOMEPATH%\ywbpu\57178.omn
%HOMEPATH%\ywbpu\73107.pjy
%HOMEPATH%\ywbpu\83740.azx
%HOMEPATH%\ywbpu\75794.iqu
%HOMEPATH%\ywbpu\19122.efc
%HOMEPATH%\ywbpu\35081.ffj
%HOMEPATH%\ywbpu\start.cmd
%HOMEPATH%\ywbpu\62925.rdi
%HOMEPATH%\ywbpu\start.vbs
%TEMP%\logmail.txt
%TEMP%\logff.txt
%HOMEPATH%\ywbpu\61502.yes
%HOMEPATH%\ywbpu\79127.syx
%HOMEPATH%\ywbpu\28943.yax
%HOMEPATH%\ywbpu\75869.rtp
%HOMEPATH%\ywbpu\6771.vey
%HOMEPATH%\ywbpu\84733.yjc
%HOMEPATH%\ywbpu\41212.rrv
%HOMEPATH%\ywbpu\83973.tce
%HOMEPATH%\ywbpu\3612.tbx
%HOMEPATH%\ywbpu\2732.dtf
%HOMEPATH%\ywbpu\31172.kee
%HOMEPATH%\ywbpu\82792.don
%HOMEPATH%\ywbpu\63393.rbn
%HOMEPATH%\ywbpu\14908.yic
%HOMEPATH%\ywbpu\23363.akk
%HOMEPATH%\ywbpu\26514.bfc
%HOMEPATH%\ywbpu\56971.xcg
%HOMEPATH%\ywbpu\85709.vft
%HOMEPATH%\ywbpu\26632.jix
%HOMEPATH%\ywbpu\20471.fgb
%HOMEPATH%\ywbpu\81690.ded
%HOMEPATH%\ywbpu\73025.sbc
%HOMEPATH%\ywbpu\41596.muc
%HOMEPATH%\ywbpu\40345.fms
%HOMEPATH%\ywbpu\25552.oay
%HOMEPATH%\ywbpu\77517.est
%HOMEPATH%\ywbpu\97037.iqs
%HOMEPATH%\ywbpu\39558.vip
%HOMEPATH%\ywbpu\76394.eqn
%HOMEPATH%\ywbpu\65690.sfv
%HOMEPATH%\ywbpu\22605.ikn
%HOMEPATH%\ywbpu\2474.jly
%HOMEPATH%\ywbpu\97719.ndq
%HOMEPATH%\ywbpu\91268.tca
%HOMEPATH%\ywbpu\99885.hdd
%HOMEPATH%\ywbpu\94773.sox
%HOMEPATH%\ywbpu\63032.kjd
%HOMEPATH%\ywbpu\15648.twx
%HOMEPATH%\ywbpu\23909.khr
%HOMEPATH%\ywbpu\61937.skt
%HOMEPATH%\ywbpu\3838.egt
%HOMEPATH%\ywbpu\20181.eju
%HOMEPATH%\ywbpu\38310.lcw
%HOMEPATH%\ywbpu\78893.jzh
%HOMEPATH%\ywbpu\90565.eay
%HOMEPATH%\ywbpu\8821.uqo
%HOMEPATH%\ywbpu\31690.cte
%HOMEPATH%\ywbpu\63612.zbl
%HOMEPATH%\ywbpu\2113.kke
%HOMEPATH%\ywbpu\32014.yqm
%HOMEPATH%\ywbpu\93911.vkg
%HOMEPATH%\ywbpu\35096.vga
%HOMEPATH%\ywbpu\66432.slj
%HOMEPATH%\ywbpu\10316.uki
%HOMEPATH%\ywbpu\14311.fni
%HOMEPATH%\ywbpu\65350.eiq
%HOMEPATH%\ywbpu\5157.nqg
%HOMEPATH%\ywbpu\78924.zcp
%HOMEPATH%\ywbpu\bomx.exe
%HOMEPATH%\ywbpu\12212.UOZ
%HOMEPATH%\ywbpu\2437299.vbs
%HOMEPATH%\ywbpu\58348.FWT
%HOMEPATH%\ywbpu\2450220.DUY
%HOMEPATH%\ywbpu\85370.jha
%HOMEPATH%\ywbpu\30184.syq
%HOMEPATH%\ywbpu\57052.cpf
%HOMEPATH%\ywbpu\63746.kiv
%HOMEPATH%\ywbpu\89490.bow
%HOMEPATH%\ywbpu\99001.eay
%HOMEPATH%\ywbpu\19751.jhv
%HOMEPATH%\ywbpu\4148.kcs
%HOMEPATH%\ywbpu\45711.mmg
%HOMEPATH%\ywbpu\42412.hwh
%HOMEPATH%\ywbpu\11398.stl
%HOMEPATH%\ywbpu\39667.ibj
%HOMEPATH%\ywbpu\2244.mil
%HOMEPATH%\ywbpu\32904.rsd
%HOMEPATH%\ywbpu\60560.yto
%HOMEPATH%\ywbpu\17322.jut
%HOMEPATH%\ywbpu\24655.jrd
%HOMEPATH%\ywbpu\28514.tmk
%HOMEPATH%\ywbpu\49311.bwg
%HOMEPATH%\ywbpu\70737.apd
%HOMEPATH%\ywbpu\36264.cse
%HOMEPATH%\ywbpu\88354.lkk
%HOMEPATH%\ywbpu\35977.dyf
%HOMEPATH%\ywbpu\4655.ivk
%HOMEPATH%\ywbpu\74178.xho
%HOMEPATH%\ywbpu\11299.yjm
%HOMEPATH%\ywbpu\53119.aqc
%HOMEPATH%\ywbpu\16392.yzy
%HOMEPATH%\ywbpu\14023.dum
%HOMEPATH%\ywbpu\15393.cmz
%HOMEPATH%\ywbpu\17141.yjx
%HOMEPATH%\ywbpu\49339.bja
%HOMEPATH%\ywbpu\76230.odm
%HOMEPATH%\ywbpu\89021.ulj
%HOMEPATH%\ywbpu\84637.eba
%HOMEPATH%\ywbpu\67434.wrw
%HOMEPATH%\ywbpu\44911.beb
%HOMEPATH%\ywbpu\41911.bam
%HOMEPATH%\ywbpu\30967.xtc
%HOMEPATH%\ywbpu\15329.ben
%HOMEPATH%\ywbpu\99856.fsh
%HOMEPATH%\ywbpu\72603.now
%HOMEPATH%\ywbpu\21183.aco
%HOMEPATH%\ywbpu\24515.xse
%HOMEPATH%\ywbpu\49863.ioa
%HOMEPATH%\ywbpu\45097.gbs
%HOMEPATH%\ywbpu\58324.bmf
%HOMEPATH%\ywbpu\95203.php
%HOMEPATH%\ywbpu\88203.sio
%HOMEPATH%\ywbpu\92315.mkx
%HOMEPATH%\ywbpu\72123.hjy
%HOMEPATH%\ywbpu\60142.osh
%HOMEPATH%\ywbpu\54847.gjo
%HOMEPATH%\ywbpu\57566.ggl
%HOMEPATH%\ywbpu\9764.gnm
%HOMEPATH%\ywbpu\54188.kcn
%HOMEPATH%\ywbpu\48148.xqi
%HOMEPATH%\ywbpu\3751.rnu

Присваивает атрибут 'скрытый' для следующих файлов:

%HOMEPATH%\ywbpu\3362.ytm
%HOMEPATH%\ywbpu\80261.flf
%HOMEPATH%\ywbpu\44800.bko
%HOMEPATH%\ywbpu\2749.jqk
%HOMEPATH%\ywbpu\98453.fso
%HOMEPATH%\ywbpu\44681.irt
%HOMEPATH%\ywbpu\33584.ifs
%HOMEPATH%\ywbpu\21903.uwr
%HOMEPATH%\ywbpu\6232.ufn
%HOMEPATH%\ywbpu\7901.ebf
%HOMEPATH%\ywbpu\42789.wwd
%HOMEPATH%\ywbpu\25382.jab
%HOMEPATH%\ywbpu\6666.uck
%HOMEPATH%\ywbpu\61218.khm
%HOMEPATH%\ywbpu\62301.fnn
%HOMEPATH%\ywbpu\53685.vqa
%HOMEPATH%\ywbpu\41929.yso
%HOMEPATH%\ywbpu\16428.qgs
%HOMEPATH%\ywbpu\20827.akn
%HOMEPATH%\ywbpu\28472.soz
%HOMEPATH%\ywbpu\15831.otk
%HOMEPATH%\ywbpu\66590.qfd
%HOMEPATH%\ywbpu\14262.nfr
%HOMEPATH%\ywbpu\57270.vwx
%HOMEPATH%\ywbpu\33645.lul
%HOMEPATH%\ywbpu\46101.nal
%HOMEPATH%\ywbpu\17814.bph
%HOMEPATH%\ywbpu\50959.ame
%HOMEPATH%\ywbpu\40383.uai
%HOMEPATH%\ywbpu\93430.boc
%HOMEPATH%\ywbpu\12757.cnu
%HOMEPATH%\ywbpu\36103.uas
%HOMEPATH%\ywbpu\86564.wqt
%HOMEPATH%\ywbpu\66587.bph
%HOMEPATH%\ywbpu\73894.nxy
%HOMEPATH%\ywbpu\14897.gnp
%HOMEPATH%\ywbpu\45112.yvs
%HOMEPATH%\ywbpu\79321.ivh
%HOMEPATH%\ywbpu\3228.gmg
%HOMEPATH%\ywbpu\30737.xuq
%HOMEPATH%\ywbpu\66675.jps
%HOMEPATH%\ywbpu\87039.cez
%HOMEPATH%\ywbpu\97750.bay
%HOMEPATH%\ywbpu\9271.rno
%HOMEPATH%\ywbpu\39329.yic
%HOMEPATH%\ywbpu\98856.ywt
%HOMEPATH%\ywbpu\85610.kpv
%HOMEPATH%\ywbpu\59139.cce
%HOMEPATH%\ywbpu\34771.lcf
%HOMEPATH%\ywbpu\41481.qmq
%HOMEPATH%\ywbpu\75794.iqu
%HOMEPATH%\ywbpu\73107.pjy
%HOMEPATH%\ywbpu\73025.sbc
%HOMEPATH%\ywbpu\57178.omn
%HOMEPATH%\ywbpu\19122.efc
%HOMEPATH%\ywbpu\83740.azx
%HOMEPATH%\ywbpu\61502.yes
%HOMEPATH%\ywbpu\6771.vey
%HOMEPATH%\ywbpu\62925.rdi
%HOMEPATH%\ywbpu\start.cmd
%HOMEPATH%\ywbpu\start.vbs
%HOMEPATH%\ywbpu\84733.yjc
%HOMEPATH%\ywbpu\35081.ffj
%HOMEPATH%\ywbpu\55921.zth
%HOMEPATH%\ywbpu\28943.yax
%HOMEPATH%\ywbpu\75869.rtp
%HOMEPATH%\ywbpu\79127.syx
%HOMEPATH%\ywbpu\41596.muc
%HOMEPATH%\ywbpu\83973.tce
%HOMEPATH%\ywbpu\82792.don
%HOMEPATH%\ywbpu\41212.rrv
%HOMEPATH%\ywbpu\31172.kee
%HOMEPATH%\ywbpu\3612.tbx
%HOMEPATH%\ywbpu\26514.bfc
%HOMEPATH%\ywbpu\14908.yic
%HOMEPATH%\ywbpu\28309.pcd
%HOMEPATH%\ywbpu\63393.rbn
%HOMEPATH%\ywbpu\56971.xcg
%HOMEPATH%\ywbpu\23363.akk
%HOMEPATH%\ywbpu\40345.fms
%HOMEPATH%\ywbpu\39558.vip
%HOMEPATH%\ywbpu\20471.fgb
%HOMEPATH%\ywbpu\81690.ded
%HOMEPATH%\ywbpu\26632.jix
%HOMEPATH%\ywbpu\76394.eqn
%HOMEPATH%\ywbpu\85709.vft
%HOMEPATH%\ywbpu\2732.dtf
%HOMEPATH%\ywbpu\77517.est
%HOMEPATH%\ywbpu\97037.iqs
%HOMEPATH%\ywbpu\25552.oay
%HOMEPATH%\ywbpu\16392.yzy
%HOMEPATH%\ywbpu\2474.jly
%HOMEPATH%\ywbpu\65690.sfv
%HOMEPATH%\ywbpu\91268.tca
%HOMEPATH%\ywbpu\3838.egt
%HOMEPATH%\ywbpu\97719.ndq
%HOMEPATH%\ywbpu\22605.ikn
%HOMEPATH%\ywbpu\15648.twx
%HOMEPATH%\ywbpu\94773.sox
%HOMEPATH%\ywbpu\61937.skt
%HOMEPATH%\ywbpu\99885.hdd
%HOMEPATH%\ywbpu\23909.khr
%HOMEPATH%\ywbpu\20181.eju
%HOMEPATH%\ywbpu\38310.lcw
%HOMEPATH%\ywbpu\78893.jzh
%HOMEPATH%\ywbpu\90565.eay
%HOMEPATH%\ywbpu\8821.uqo
%HOMEPATH%\ywbpu\31690.cte
%HOMEPATH%\ywbpu\63612.zbl
%HOMEPATH%\ywbpu\2113.kke
%HOMEPATH%\ywbpu\32014.yqm
%HOMEPATH%\ywbpu\93911.vkg
%HOMEPATH%\ywbpu\35096.vga
%HOMEPATH%\ywbpu\63032.kjd
%HOMEPATH%\ywbpu\14311.fni
%HOMEPATH%\ywbpu\66432.slj
%HOMEPATH%\ywbpu\5157.nqg
%HOMEPATH%\ywbpu\85370.jha
%HOMEPATH%\ywbpu\65350.eiq
%HOMEPATH%\ywbpu\10316.uki
%HOMEPATH%\ywbpu\bomx.exe
%HOMEPATH%\ywbpu\12212.UOZ
%HOMEPATH%\ywbpu\2437299.vbs
%HOMEPATH%\ywbpu\78924.zcp
%HOMEPATH%\ywbpu\2450220.DUY
%HOMEPATH%\ywbpu\30184.syq
%HOMEPATH%\ywbpu\57052.cpf
%HOMEPATH%\ywbpu\63746.kiv
%HOMEPATH%\ywbpu\89490.bow
%HOMEPATH%\ywbpu\99001.eay
%HOMEPATH%\ywbpu\19751.jhv
%HOMEPATH%\ywbpu\4148.kcs
%HOMEPATH%\ywbpu\45711.mmg
%HOMEPATH%\ywbpu\42412.hwh
%HOMEPATH%\ywbpu\11398.stl
%HOMEPATH%\ywbpu\39667.ibj
%HOMEPATH%\ywbpu\2244.mil
%HOMEPATH%\ywbpu\32904.rsd
%HOMEPATH%\ywbpu\60560.yto
%HOMEPATH%\ywbpu\17322.jut
%HOMEPATH%\ywbpu\24655.jrd
%HOMEPATH%\ywbpu\28514.tmk
%HOMEPATH%\ywbpu\49311.bwg
%HOMEPATH%\ywbpu\70737.apd
%HOMEPATH%\ywbpu\36264.cse
%HOMEPATH%\ywbpu\88354.lkk
%HOMEPATH%\ywbpu\35977.dyf
%HOMEPATH%\ywbpu\11299.yjm
%HOMEPATH%\ywbpu\15393.cmz
%HOMEPATH%\ywbpu\74178.xho
%HOMEPATH%\ywbpu\14023.dum
%HOMEPATH%\ywbpu\53119.aqc
%HOMEPATH%\ywbpu\89021.ulj
%HOMEPATH%\ywbpu\49339.bja
%HOMEPATH%\ywbpu\4655.ivk
%HOMEPATH%\ywbpu\17141.yjx
%HOMEPATH%\ywbpu\84637.eba
%HOMEPATH%\ywbpu\76230.odm
%HOMEPATH%\ywbpu\72123.hjy
%HOMEPATH%\ywbpu\67434.wrw
%HOMEPATH%\ywbpu\44911.beb
%HOMEPATH%\ywbpu\41911.bam
%HOMEPATH%\ywbpu\30967.xtc
%HOMEPATH%\ywbpu\15329.ben
%HOMEPATH%\ywbpu\99856.fsh
%HOMEPATH%\ywbpu\72603.now
%HOMEPATH%\ywbpu\21183.aco
%HOMEPATH%\ywbpu\24515.xse
%HOMEPATH%\ywbpu\49863.ioa
%HOMEPATH%\ywbpu\45097.gbs
%HOMEPATH%\ywbpu\88203.sio
%HOMEPATH%\ywbpu\54847.gjo
%HOMEPATH%\ywbpu\95203.php
%HOMEPATH%\ywbpu\60142.osh
%HOMEPATH%\ywbpu\92315.mkx
%HOMEPATH%\ywbpu\48148.xqi
%HOMEPATH%\ywbpu\9764.gnm
%HOMEPATH%\ywbpu\58324.bmf
%HOMEPATH%\ywbpu\57566.ggl
%HOMEPATH%\ywbpu\3751.rnu
%HOMEPATH%\ywbpu\54188.kcn

Удаляет следующие файлы:

%TEMP%\logmail.txt
%TEMP%\logff.txt

Сетевая активность:

Подключается к:

'sm##.gmail.com':587
'www.my#p.ru':80
'wp#d':80

TCP:

Запросы HTTP GET:

http://www.my#p.ru/en-EN/index.php
http://11#.#11.111.1/wpad.dat via wp#d

UDP:

DNS ASK sm##.gmail.com
DNS ASK www.my#p.ru
DNS ASK wp#d

Другое:

Ищет следующие окна:

ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: 'EDIT' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней