Trojan.DownLoader7.35074

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Classes\VIKA\Shell\open\command] '' = '"%PROGRAM_FILES%\VIKA\vkclient.exe" "%1"'
[<HKLM>\SOFTWARE\Classes\VIKAMAGAZINE\Shell\open\command] '' = '"%PROGRAM_FILES%\VIKA\vkreader.exe" "%1"'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'VikaClient' = '"%PROGRAM_FILES%\VIKA\vkclient.exe"'
[<HKLM>\SOFTWARE\Classes\VIKA\Shell\open\command] '' = '%PROGRAM_FILES%\VIKA\vkclient.exe "%1"'
[<HKLM>\SOFTWARE\Microsoft\Internet Explorer\Extensions\{2BB49E59-100F-4ca6-9127-E0E3FF76F98E}] 'Exec' = '%PROGRAM_FILES%\VIKA\vkclient.exe.lnk'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\P4P Service] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

'%PROGRAM_FILES%\P4P\p2psvr.exe' -i
'%PROGRAM_FILES%\VIKA\vkclient.exe' -firstrun
'%PROGRAM_FILES%\P4P\skinpacker.exe' -g 00000000-0000-0000-0000-000000000000 -x
'%PROGRAM_FILES%\P4P\p2psvr.exe'
'<SYSTEM32>\sogoutb_setup_cn2342s_mini.exe' /S
'<Текущая директория>\Jsy.dat'
'%PROGRAM_FILES%\P4P\cookieimp.exe'
'<SYSTEM32>\BCNET20053432.exe' /S

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\P4P\theme\00000000-0000-0000-0000-000000000000\Plugins\3.ini
%PROGRAM_FILES%\P4P\theme\00000000-0000-0000-0000-000000000000\Plugins\2.ini
%PROGRAM_FILES%\P4P\theme\00000000-0000-0000-0000-000000000000\Plugins\1.ini
%PROGRAM_FILES%\P4P\theme\00000000-0000-0000-0000-000000000000\Plugins\8b57e939-74f3-4168-9281-67796df3a410.ico
%PROGRAM_FILES%\P4P\theme\00000000-0000-0000-0000-000000000000\Plugins\85190a08-7b40-46d1-ab1f-0436c6e906e2.ico
%PROGRAM_FILES%\P4P\theme\00000000-0000-0000-0000-000000000000\Plugins\4.ini
%PROGRAM_FILES%\P4P\00000000-0000-0000-0000-000000000000.zip
%PROGRAM_FILES%\P4P\skinpacker.exe
%ALLUSERSPROFILE%\Start Menu\ОЁїЇ.VIKA.lnk
%PROGRAM_FILES%\P4P\theme\00000000-0000-0000-0000-000000000000\2.bmp
%PROGRAM_FILES%\P4P\theme\00000000-0000-0000-0000-000000000000\1.bmp
%PROGRAM_FILES%\P4P\ToolbarTMP.DLL
%PROGRAM_FILES%\P4P\Plugins\c1ba2e53-3bfa-4426-9765-00459c0b8a25.ico
%PROGRAM_FILES%\P4P\Plugins\85190a08-7b40-46d1-ab1f-0436c6e906e2.ico
%PROGRAM_FILES%\P4P\Plugins\ec3dbd81-fe29-4312-83ab-2af6a79ca3f1.ico
%PROGRAM_FILES%\P4P\Uninstall.exe
%TEMP%\upgradeinfo.xml
%PROGRAM_FILES%\P4P\Plugins\8b57e939-74f3-4168-9281-67796df3a410.ico
%PROGRAM_FILES%\P4P\theme\00000000-0000-0000-0000-000000000000\theme.xml
%PROGRAM_FILES%\P4P\theme\00000000-0000-0000-0000-000000000000\Plugins\ec3dbd81-fe29-4312-83ab-2af6a79ca3f1.ico
%PROGRAM_FILES%\P4P\theme\00000000-0000-0000-0000-000000000000\Plugins\c1ba2e53-3bfa-4426-9765-00459c0b8a25.ico
%PROGRAM_FILES%\VIKA\InfoData\locallist.xml
%PROGRAM_FILES%\VIKA\InfoData\savepath.xml
%PROGRAM_FILES%\VIKA\Settings.xml
%PROGRAM_FILES%\P4P\ToolBar.dll
%PROGRAM_FILES%\P4P\p2psvr.exe
%PROGRAM_FILES%\P4P\cookieimp.exe
%PROGRAM_FILES%\VIKA\Oem.ini
%TEMP%\nsm5.tmp
<SYSTEM32>\BCNET20053432.exe
<SYSTEM32>\sogoutb_setup_cn2342s_mini.exe
<Текущая директория>\Jsy.dat
%TEMP%\nsb3.tmp\KillProcDLL.dll
%TEMP%\nsb3.tmp\nsSCM.dll
%TEMP%\nsg2.tmp
%PROGRAM_FILES%\VIKA\Default\res.xml
%PROGRAM_FILES%\VIKA\Default\Script.xml
%PROGRAM_FILES%\VIKA\Default\Reader.vkp
%HOMEPATH%\Desktop\ОЁїЇ.VIKA.lnk
%PROGRAM_FILES%\VIKA\Uninstall.exe
%PROGRAM_FILES%\VIKA\Default\upgradeinfo.xml
%PROGRAM_FILES%\VIKA\Default\AppSettings.xml
%PROGRAM_FILES%\VIKA\vkreader.exe
%PROGRAM_FILES%\VIKA\vkclient.exe
%PROGRAM_FILES%\VIKA\Default\Publishers.xml
%PROGRAM_FILES%\VIKA\Default\Local.vkp
%PROGRAM_FILES%\VIKA\Default\Client.vkp

Удаляет следующие файлы:

%TEMP%\nsb3.tmp\KillProcDLL.dll
%PROGRAM_FILES%\P4P\ToolbarTMP.DLL
%TEMP%\nsb3.tmp\nsSCM.dll
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\report[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\report[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\upgradeinfo[1].xml
%PROGRAM_FILES%\P4P\cookieimp.exe
%TEMP%\~DF371A.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\report[1].php
%PROGRAM_FILES%\P4P\00000000-0000-0000-0000-000000000000.zip
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\report[1].php

Сетевая активность:

Подключается к:

'localhost':1040
'www.vi#a.cn':80
'ws.#ika.cn':80
'tb.##gou.com':80

TCP:

Запросы HTTP GET:

www.vi#a.cn/vika_upgrade/upgradeinfo.xml
www.vi#a.cn/client/
ws.#ika.cn/rss/bind_magazine.xml?14########
ws.#ika.cn/report.php
ws.#ika.cn/report.php?q=################################################################
tb.##gou.com/getuid.php?ve#################################################################

UDP: