Trojan.KillProc.47104

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Classes\MSProgramGroup\Shell\Open\Command] '' = '<SYSTEM32>\grpconv.exe %1'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'GrpConv' = 'grpconv -o'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\IDMTDI] 'ImagePath' = 'system32\DRIVERS\idmtdi.sys'
[<HKLM>\SYSTEM\ControlSet001\Services\IDMTDI] 'Start' = '00000001'

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\grpconv.exe' -o
'<SYSTEM32>\runonce.exe' -r
'<SYSTEM32>\net1.exe' start IDMTDI
'<SYSTEM32>\net.exe' start IDMTDI
'%TEMP%\nst5.tmp\ns6.tmp' "%ProgramFiles%\Internet Download Manager\Uninstall.exe" -instdriv
'%CommonProgramFiles%\System\IDMs.exe' /S /EN /ND
'<SYSTEM32>\rundll32.exe' SETUPAPI.DLL,InstallHinfSection DefaultInstall 128 %ProgramFiles%\Internet Download Manager\idmtdi.inf
'%ProgramFiles%\Internet Download Manager\Uninstall.exe' -instdriv

Завершает или пытается завершить

следующие системные процессы:

<SYSTEM32>\cmd.exe

Изменения в файловой системе:

Создает следующие файлы:

%ProgramFiles%\Internet Download Manager\Languages\inst_pt.lng
%ProgramFiles%\Internet Download Manager\Languages\inst_pl.lng
%ProgramFiles%\Internet Download Manager\Languages\inst_ru.lng
%ProgramFiles%\Internet Download Manager\Languages\inst_ptbr.lng
%ProgramFiles%\Internet Download Manager\Languages\inst_my.lng
%ProgramFiles%\Internet Download Manager\Languages\inst_it.lng
%ProgramFiles%\Internet Download Manager\Languages\inst_id.lng
%ProgramFiles%\Internet Download Manager\Languages\inst_kr.lng
%ProgramFiles%\Internet Download Manager\Languages\inst_iw.lng
%ProgramFiles%\Internet Download Manager\Languages\inst_vn.lng
%ProgramFiles%\Internet Download Manager\Languages\inst_uz.lng
%ProgramFiles%\Internet Download Manager\Languages\template.lng
%ProgramFiles%\Internet Download Manager\Languages\scheduler_ru.chm
%ProgramFiles%\Internet Download Manager\Languages\inst_ua.lng
%ProgramFiles%\Internet Download Manager\Languages\inst_src.lng
%ProgramFiles%\Internet Download Manager\Languages\inst_sk.lng
%ProgramFiles%\Internet Download Manager\Languages\inst_tr.lng
%ProgramFiles%\Internet Download Manager\Languages\inst_th.lng
%ProgramFiles%\Internet Download Manager\Languages\inst_ar.lng
%ProgramFiles%\Internet Download Manager\Languages\inst_al.lng
%ProgramFiles%\Internet Download Manager\Languages\inst_chn.lng
%ProgramFiles%\Internet Download Manager\Languages\inst_bg.lng
%ProgramFiles%\Internet Download Manager\Languages\idm_ua.lng
%ProgramFiles%\Internet Download Manager\Languages\idm_ru.lng
%ProgramFiles%\Internet Download Manager\Languages\idm_ru.chm
%ProgramFiles%\Internet Download Manager\Languages\idm_tr.lng
%ProgramFiles%\Internet Download Manager\Languages\idm_th.lng
%ProgramFiles%\Internet Download Manager\Languages\inst_fr.lng
%ProgramFiles%\Internet Download Manager\Languages\inst_fa.lng
%ProgramFiles%\Internet Download Manager\Languages\inst_hu.lng
%ProgramFiles%\Internet Download Manager\Languages\inst_gr.lng
%ProgramFiles%\Internet Download Manager\Languages\inst_es.lng
%ProgramFiles%\Internet Download Manager\Languages\inst_cz.lng
%ProgramFiles%\Internet Download Manager\Languages\inst_cht.lng
%ProgramFiles%\Internet Download Manager\Languages\inst_dk.lng
%ProgramFiles%\Internet Download Manager\Languages\inst_de.lng
%ProgramFiles%\Internet Download Manager\Languages\template_inst.lng
%APPDATA%\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004
%TEMP%\nst5.tmp\ns6.tmp
%APPDATA%\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
%APPDATA%\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004
%TEMP%\nst5.tmp\nsExec.dll
%ProgramFiles%\Internet Download Manager\Toolbar\3d_small_3.bmp
%ProgramFiles%\Internet Download Manager\Toolbar\3d_smallHot_3.bmp
%ProgramFiles%\Internet Download Manager\Uninstall-ME.exe
%ProgramFiles%\Internet Download Manager\Toolbar\3d_style_3.tbi
%WINDIR%\inf\oem3.inf
%TEMP%\Cab11.tmp
<DRIVERS>\SET13.tmp
%WINDIR%\inf\oem3.PNF
%TEMP%\CabF.tmp
%TEMP%\Cab9.tmp
%APPDATA%\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
%TEMP%\CabD.tmp
%TEMP%\CabB.tmp
%ProgramFiles%\Internet Download Manager\Languages\tips_nl.txt
%ProgramFiles%\Internet Download Manager\Languages\tips_it.txt
%ProgramFiles%\Internet Download Manager\Languages\tips_ptbr.txt
%ProgramFiles%\Internet Download Manager\Languages\tips_pl.txt
%ProgramFiles%\Internet Download Manager\Languages\tips_fr.txt
%ProgramFiles%\Internet Download Manager\Languages\tips_de.txt
%ProgramFiles%\Internet Download Manager\Languages\tips_ar.txt
%ProgramFiles%\Internet Download Manager\Languages\tips_fa.txt
%ProgramFiles%\Internet Download Manager\Languages\tips_es.txt
%ProgramFiles%\Internet Download Manager\Toolbar\3d_largeHot_3_hdpi15.bmp
%ProgramFiles%\Internet Download Manager\Toolbar\3d_largeHot_3.bmp
%ProgramFiles%\Internet Download Manager\Toolbar\3d_large_3_hdpi15.bmp
%ProgramFiles%\Internet Download Manager\Toolbar\3d_large_3.bmp
%ProgramFiles%\Internet Download Manager\Languages\tut_ru.chm
%ProgramFiles%\Internet Download Manager\Languages\tips_th.txt
%ProgramFiles%\Internet Download Manager\Languages\tips_ru.txt
%ProgramFiles%\Internet Download Manager\Languages\tips_ua.txt
%ProgramFiles%\Internet Download Manager\Languages\tips_tr.txt
%ProgramFiles%\Internet Download Manager\IEGetVL.htm
%ProgramFiles%\Internet Download Manager\IEGetAll.htm
%ProgramFiles%\Internet Download Manager\IEMonitor.exe
%ProgramFiles%\Internet Download Manager\IEGetVL2.htm
%ProgramFiles%\Internet Download Manager\IEExt.htm
%ProgramFiles%\Internet Download Manager\IDMShellExt.dll
%ProgramFiles%\Internet Download Manager\IDMNetMon64.dll
%ProgramFiles%\Internet Download Manager\IDMan.exe
%ProgramFiles%\Internet Download Manager\IDMShellExt64.dll
%ProgramFiles%\Internet Download Manager\idmBroker.exe
%ProgramFiles%\Internet Download Manager\grabber.chm
%ProgramFiles%\Internet Download Manager\idmantypeinfo.tlb
%ProgramFiles%\Internet Download Manager\idman.chm
%ProgramFiles%\Internet Download Manager\downlWithIDM64.dll
%ProgramFiles%\Internet Download Manager\Uninstall.exe
%ProgramFiles%\Internet Download Manager\MediumILStart.exe
%ProgramFiles%\Internet Download Manager\downlWithIDM.dll
%ProgramFiles%\Internet Download Manager\defexclist.txt
%TEMP%\nst5.tmp\System.dll
%TEMP%\nsy4.tmp
%ProgramFiles%\Internet Download Manager\IDMFType.dat
%ProgramFiles%\Internet Download Manager\Cleanup.cmd
%CommonProgramFiles%\System\IDMs.exe
%TEMP%\cyhyewk
%TEMP%\aut1.tmp
%TEMP%\aut2.tmp
%TEMP%\icon.ico
%ProgramFiles%\Internet Download Manager\IDMIECC64.dll
%ProgramFiles%\Internet Download Manager\IDMIECC.dll
%ProgramFiles%\Internet Download Manager\IDMNetMon.dll
%ProgramFiles%\Internet Download Manager\IDMIntegrator64.exe
%ProgramFiles%\Internet Download Manager\IDMGrHlp.exe
%ProgramFiles%\Internet Download Manager\IDMGCExt.crx
%ProgramFiles%\Internet Download Manager\IDMFType64.dll
%ProgramFiles%\Internet Download Manager\IDMGetAll64.dll
%ProgramFiles%\Internet Download Manager\IDMGetAll.dll
%ProgramFiles%\Internet Download Manager\idmbrbtn.dll
%ProgramFiles%\Internet Download Manager\tips.txt
%ProgramFiles%\Internet Download Manager\scheduler.chm
%ProgramFiles%\Internet Download Manager\Languages\grabber_ru.chm
%ProgramFiles%\Internet Download Manager\tutor.chm
%ProgramFiles%\Internet Download Manager\idmwfp64.sys
%ProgramFiles%\Internet Download Manager\idmwfp.cat
%ProgramFiles%\Internet Download Manager\idmvs.dll
%ProgramFiles%\Internet Download Manager\idmwfp32.sys
%ProgramFiles%\Internet Download Manager\idmwfp.inf
%ProgramFiles%\Internet Download Manager\Languages\idm_nl.lng
%ProgramFiles%\Internet Download Manager\Languages\idm_it.lng
%ProgramFiles%\Internet Download Manager\Languages\idm_ptbr.lng
%ProgramFiles%\Internet Download Manager\Languages\idm_pl.lng
%ProgramFiles%\Internet Download Manager\Languages\idm_fr.lng
%ProgramFiles%\Internet Download Manager\Languages\idm_de.lng
%ProgramFiles%\Internet Download Manager\Languages\idm_ar.lng
%ProgramFiles%\Internet Download Manager\Languages\idm_fa.lng
%ProgramFiles%\Internet Download Manager\Languages\idm_es.lng
%ProgramFiles%\Internet Download Manager\idmftype.dll
%ProgramFiles%\Internet Download Manager\idmfsa.dll
%ProgramFiles%\Internet Download Manager\idmmkb.dll
%ProgramFiles%\Internet Download Manager\idmindex.dll
%ProgramFiles%\Internet Download Manager\idmcchandler7_64.dll
%ProgramFiles%\Internet Download Manager\idmcchandler2.dll
%ProgramFiles%\Internet Download Manager\idmbrbtn64.dll
%ProgramFiles%\Internet Download Manager\idmcchandler7.dll
%ProgramFiles%\Internet Download Manager\idmcchandler2_64.dll
%ProgramFiles%\Internet Download Manager\idmtdi32.sys
%ProgramFiles%\Internet Download Manager\idmtdi.inf
%ProgramFiles%\Internet Download Manager\idmvconv.dll
%ProgramFiles%\Internet Download Manager\idmtdi64.sys
%ProgramFiles%\Internet Download Manager\idmtdi.cat
%ProgramFiles%\Internet Download Manager\idmmzcc2.xpi
%ProgramFiles%\Internet Download Manager\idmmzcc.xpi
%ProgramFiles%\Internet Download Manager\idmmzcc7_64.dll
%ProgramFiles%\Internet Download Manager\idmmzcc7.dll

Удаляет следующие файлы:

%TEMP%\CabD.tmp
%TEMP%\CabB.tmp
%TEMP%\Cab11.tmp
%TEMP%\CabF.tmp
%TEMP%\Cab9.tmp
%TEMP%\cyhyewk
%TEMP%\aut1.tmp
%TEMP%\aut2.tmp
%TEMP%\icon.ico

Перемещает следующие файлы:

<DRIVERS>\SET13.tmp в <DRIVERS>\idmtdi.sys

Сетевая активность:

Подключается к:

'www.download.windowsupdate.com':80
'wp#d':80

TCP:

Запросы HTTP GET:

http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt
http://11#.#11.111.1/wpad.dat via wp#d

UDP:

DNS ASK www.download.windowsupdate.com
DNS ASK wp#d

Другое:

Ищет следующие окна:

ClassName: 'Shell_TrayWnd' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней