Trojan.DownLoader11.6787

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '1a0e77551a3b9600ca4e30fa048efeb3' = '"%WINDIR%\systems.exe" ..'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '1a0e77551a3b9600ca4e30fa048efeb3' = '"%WINDIR%\systems.exe" ..'

Вредоносные функции:

Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%WINDIR%\systems.exe' = '%WINDIR%\systems.exe:*:Enabled:systems.exe'

Создает и запускает на исполнение:

'%TEMP%\ir_ext_temp_0\autorun.exe' "SFXSOURCE:%TEMP%\beIN SPORT.exe"
'%WINDIR%\systems.exe'
'%HOMEPATH%\Local Settings\Tempserver.exe'
'%TEMP%\StreamBeiN-HD.exe'
'%TEMP%\beIN SPORT.exe'

Запускает на исполнение:

'<SYSTEM32>\netsh.exe' firewall add allowedprogram "%WINDIR%\systems.exe" "systems.exe" ENABLE

Изменения в файловой системе:

Создает следующие файлы:

%HOMEPATH%\Local Settings\Tempserver.exe
%TEMP%\ir_ext_temp_0\AutoPlay\Images\1394463675_bein-sport103-10-14-37-43.jpg
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\rtmpdump.exe
%TEMP%\ir_ext_temp_0\AutoPlay\Icons\daz-logo4 (1).ico
%TEMP%\ir_ext_temp_0\AutoPlay\Images\BEIN-Sport-25.jpg
%TEMP%\ir_ext_temp_0\AutoPlay\Images\daz-logo4 (1).PNG
%TEMP%\ir_ext_temp_0\AutoPlay\Images\3.png
%TEMP%\ir_ext_temp_0\AutoPlay\Images\bein.png
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\9_1.bat
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\6_1.bat
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\7.bat
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\5_1.bat
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\6.bat
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\8_1.bat
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\9.bat
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\7_1.bat
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\8.bat
%TEMP%\ir_ext_temp_0\autorun.exe
%TEMP%\ir_ext_temp_0\daz-logo4 (1).ico
%TEMP%\ir_ext_temp_0\AutoPlay\Images\sortie-icone-4146-64.png
%TEMP%\ir_ext_temp_0\AutoPlay\Images\vlc_alt.png
%TEMP%\_ir_tmpfnt_1\Buxton Sketch.TFT
%WINDIR%\systems.exe
%TEMP%\ir_ext_temp_0\lua5.1.dll
%TEMP%\ir_ext_temp_0\lua51.dll
%TEMP%\ir_ext_temp_0\AutoPlay\Images\navigateur-internet-explorer-microsoft-icone-8158-128.png
%TEMP%\ir_ext_temp_0\AutoPlay\Images\firefox-mozilla-icone-4431-128.png
%TEMP%\ir_ext_temp_0\AutoPlay\Images\Flag of Algeria14-10-2010-11-12-12.png
%TEMP%\ir_ext_temp_0\AutoPlay\Images\Earth-icon.png
%TEMP%\ir_ext_temp_0\AutoPlay\Images\f08c23da-3c6a-467a-af5a-b29a86ca6107.jpg
%TEMP%\ir_ext_temp_0\AutoPlay\Images\loi.png
%TEMP%\ir_ext_temp_0\AutoPlay\Images\navigateur-chrome-google-icone-8608-128.png
%TEMP%\ir_ext_temp_0\AutoPlay\Images\Flag of Morocco14-10-2010-11-4-7.png
%TEMP%\ir_ext_temp_0\AutoPlay\Images\images (1).jpg
%TEMP%\ir_ext_temp_0\AutoPlay\Buttons\1041_0001.btn
%TEMP%\ir_ext_temp_0\AutoPlay\Buttons\1044_0001.btn
%TEMP%\ir_ext_temp_0\AutoPlay\Audio\Squisher.ogg
%TEMP%\ir_ext_temp_0\AutoPlay\autorun.cdd
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\10.bat
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\10_1.bat
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\1.bat
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\1_1.bat
%TEMP%\ir_ext_temp_0\AutoPlay\Audio\Note.ogg
%TEMP%\aut2.tmp
%TEMP%\beIN SPORT.exe
%TEMP%\aut1.tmp
%TEMP%\StreamBeiN-HD.exe
%TEMP%\ir_ext_temp_0\AutoPlay\Audio\Cut.ogg
%TEMP%\ir_ext_temp_0\AutoPlay\Audio\High1.ogg
%TEMP%\ir_ext_temp_0\AutoPlay\Audio\Boop.ogg
%TEMP%\ir_ext_temp_0\AutoPlay\Audio\Click1.ogg
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\2_1.bat
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\3.bat
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\15_1.bat
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\2.bat
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\4_1.bat
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\5.bat
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\3_1.bat
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\4.bat
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\15.bat
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\12.bat
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\12_1.bat
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\11.bat
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\11_1.bat
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\14.bat
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\14_1.bat
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\13.bat
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\13_1.bat