Trojan.DownLoader6.11888

Техническая информация

Вредоносные функции:

Создает и запускает на исполнение:

%WINDIR%\iexplorer.exe /pid=3472
%WINDIR%\iexplorer.exe /pid=5524
%WINDIR%\iexplorer.exe /pid=5668
%WINDIR%\iexplorer.exe /pid=6724
%WINDIR%\iexplorer.exe /pid=2644
%WINDIR%\iexplorer.exe /pid=3744
%WINDIR%\iexplorer.exe /pid=5588
%WINDIR%\iexplorer.exe /pid=5048
%WINDIR%\iexplorer.exe /pid=5272
%WINDIR%\iexplorer.exe /pid=6120
%WINDIR%\iexplorer.exe /pid=5972
%WINDIR%\iexplorer.exe /pid=5828
%WINDIR%\iexplorer.exe /pid=6996
%WINDIR%\iexplorer.exe /pid=7348
%WINDIR%\iexplorer.exe /pid=7684
%WINDIR%\iexplorer.exe /pid=7564
%WINDIR%\iexplorer.exe /pid=7636
%WINDIR%\iexplorer.exe /pid=7584
%WINDIR%\iexplorer.exe /pid=7340
%WINDIR%\iexplorer.exe /pid=7156
%WINDIR%\iexplorer.exe /pid=7004
%WINDIR%\iexplorer.exe /pid=7060
%WINDIR%\iexplorer.exe /pid=7624
%WINDIR%\iexplorer.exe /pid=7308
%WINDIR%\iexplorer.exe /pid=7116
%WINDIR%\iexplorer.exe -A "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.0.3705; .NET CLR 1.1.4322)" --header "Accept-Language: en-US" --header "Accept: */*" --header "Accept-Encoding: gzip, deflate" -o data.tmp http://68###.ibet888.net/StreamingSchedule.aspx
%WINDIR%\iexplorer.exe -A "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 1.1.4322)" --header "Accept-Language: en-US" --header "Accept: */*" --header "Accept-Encoding: gzip, deflate" -o data.tmp http://68###.ibet888.net/StreamingSchedule.aspx
%WINDIR%\iexplorer.exe -A "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; YTB720; GTB6; .NET CLR 1.1.4322)" --header "Accept-Language: en-US" --header "Accept: */*" --header "Accept-Encoding: gzip, deflate" -o data.tmp http://68###.ibet888.net/StreamingSchedule.aspx
%WINDIR%\iexplorer.exe /pid=5136
%WINDIR%\iexplorer.exe /pid=2300
%WINDIR%\iexplorer.exe -A "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; GTB6; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.0.30618; .NET CLR 3.5.30729)" --header "Accept-Language: en-US" --header "Accept: */*" --header "Accept-Encoding: gzip, deflate" -o data.tmp http://68###.ibet888.net/StreamingSchedule.aspx
%WINDIR%\iexplorer.exe -A "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322; MS-RTC LM 8)" --header "Accept-Language: en-US" --header "Accept: */*" --header "Accept-Encoding: gzip, deflate" -o data.tmp http://68###.ibet888.net/commJS/menu/menu.js
%WINDIR%\iexplorer.exe -A "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)" --header "Accept-Language: en-US" --header "Accept: */*" --header "Accept-Encoding: gzip, deflate" -o data.tmp http://68###.ibet888.net/menu/Menu_Tmpl.aspx
%WINDIR%\iexplorer.exe -A "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4321)" --header "Accept-Language: en-US" --header "Accept: */*" --header "Accept-Encoding: gzip, deflate" -o data.tmp http://68###.ibet888.net/menu/Menu_Tmpl.aspx
%WINDIR%\iexplorer.exe -A "Mozilla/5.0 (Windows; U; Windows NT 6.0; en-GB; rv:1.9.0.4)" --header "Accept-Language: en-US" --header "Accept: */*" --header "Accept-Encoding: gzip, deflate" -o data.tmp http://68###.ibet888.net/StreamingSchedule.aspx
%WINDIR%\iexplorer.exe -A "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)" --header "Accept-Language: en-US" --header "Accept: */*" --header "Accept-Encoding: gzip, deflate" -o data.tmp http://68###.ibet888.net/StreamingSchedule.aspx
%WINDIR%\iexplorer.exe -A "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Maxthon)" --header "Accept-Language: en-US" --header "Accept: */*" --header "Accept-Encoding: gzip, deflate" -o data.tmp http://68###.ibet888.net/commJS/menu/menu.js
%WINDIR%\iexplorer.exe /pid=5064
%WINDIR%\iexplorer.exe /pid=5788
%WINDIR%\iexplorer.exe /pid=6096
%WINDIR%\iexplorer.exe /pid=5336
%WINDIR%\iexplorer.exe /pid=5940
%WINDIR%\iexplorer.exe /pid=2272
%WINDIR%\iexplorer.exe /pid=5256
%WINDIR%\iexplorer.exe /pid=5548
%WINDIR%\iexplorer.exe /pid=5248
%WINDIR%\iexplorer.exe /pid=5820
%WINDIR%\iexplorer.exe /pid=5804
%WINDIR%\iexplorer.exe /pid=5580
%WINDIR%\iexplorer.exe (загружен из сети Интернет)