Trojan.DownLoader11.54677

Техническая информация

Вредоносные функции:

Создает и запускает на исполнение:

'%PROGRAM_FILES%\USB Vibration\7906&8101\setup\setup.exe'
'<SYSTEM32>\Dualshock Drivers.exe'

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\ctoB.tmp
%CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\DotA.tmp
%CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\iusD.tmp
%CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\iscC.tmp
%CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\iKe9.tmp
%CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\isp6.tmp\temp.000
%TEMP%\igd7.tmp
%TEMP%\isp5.tmp\temp.000
%TEMP%\_se8.tmp
%CommonProgramFiles%\InstallShield\Professional\RunTime\IsPE.tmp
%TEMP%\{1D7B8D34-5038-46CA-A627-FABAB1A8AEBE}\{D3DF3D05-DE2A-476A-A384-08FCD58D9FE7}\isrt7541.rra
%TEMP%\{1D7B8D34-5038-46CA-A627-FABAB1A8AEBE}\{D3DF3D05-DE2A-476A-A384-08FCD58D9FE7}\Stri7485.rra
%TEMP%\{1D7B8D34-5038-46CA-A627-FABAB1A8AEBE}\{D3DF3D05-DE2A-476A-A384-08FCD58D9FE7}\_IsR7792.rra
%TEMP%\{1D7B8D34-5038-46CA-A627-FABAB1A8AEBE}\{D3DF3D05-DE2A-476A-A384-08FCD58D9FE7}\defa76d7.rra
%TEMP%\{1D7B8D34-5038-46CA-A627-FABAB1A8AEBE}\core73ca.rra
%CommonProgramFiles%\InstallShield\Professional\RunTime\iKernel.rgs
%CommonProgramFiles%\InstallShield\Professional\RunTime\IsProBE.tlb
%TEMP%\{1D7B8D34-5038-46CA-A627-FABAB1A8AEBE}\{D3DF3D05-DE2A-476A-A384-08FCD58D9FE7}\setu7214.rra
%CommonProgramFiles%\InstallShield\Professional\RunTime\ObjF.tmp
%PROGRAM_FILES%\USB Vibration\7906&8101\setup\layout.bin
%PROGRAM_FILES%\USB Vibration\7906&8101\setup\engine32.cab
%PROGRAM_FILES%\USB Vibration\7906&8101\setup\setup.exe
%PROGRAM_FILES%\USB Vibration\7906&8101\setup\setup.boot
%PROGRAM_FILES%\USB Vibration\7906&8101\setup\data2.cab
<SYSTEM32>\1.exe
<SYSTEM32>\Dualshock Drivers.exe
%PROGRAM_FILES%\USB Vibration\7906&8101\setup\data1.hdr
%PROGRAM_FILES%\USB Vibration\7906&8101\setup\data1.cab
%PROGRAM_FILES%\USB Vibration\7906&8101\setup\setup.ini
%CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\isp3.tmp\temp.000
%TEMP%\set4.tmp
%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\7b851142bd50397d931326dbd3bcce71_23ef5514-3059-436f-a4a7-4cefaab20eb1
%TEMP%\_isdelet.ini
%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\16ef076aee1bd3bc2eed169ae40473b0_23ef5514-3059-436f-a4a7-4cefaab20eb1
%TEMP%\set2.tmp
%PROGRAM_FILES%\USB Vibration\7906&8101\setup\setup.inx
%TEMP%\isp1.tmp\temp.000

Удаляет следующие файлы:

%TEMP%\igd7.tmp
%TEMP%\_se8.tmp
%CommonProgramFiles%\InstallShield\Professional\RunTime\IsPE.tmp
%TEMP%\set2.tmp
%TEMP%\set4.tmp
%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\16ef076aee1bd3bc2eed169ae40473b0_23ef5514-3059-436f-a4a7-4cefaab20eb1

Перемещает следующие файлы:

%CommonProgramFiles%\InstallShield\Professional\RunTime\ObjF.tmp в %CommonProgramFiles%\InstallShield\Professional\RunTime\Objectps.dll
%TEMP%\{1D7B8D34-5038-46CA-A627-FABAB1A8AEBE}\{D3DF3D05-DE2A-476A-A384-08FCD58D9FE7}\setu7214.rra в %TEMP%\{1D7B8D34-5038-46CA-A627-FABAB1A8AEBE}\{D3DF3D05-DE2A-476A-A384-08FCD58D9FE7}\setup.inx
%CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\iscC.tmp в %CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\iscript.dll
%CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\iusD.tmp в %CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\iuser.dll
%TEMP%\{1D7B8D34-5038-46CA-A627-FABAB1A8AEBE}\core73ca.rra в %TEMP%\{1D7B8D34-5038-46CA-A627-FABAB1A8AEBE}\corecomp.ini
%TEMP%\{1D7B8D34-5038-46CA-A627-FABAB1A8AEBE}\{D3DF3D05-DE2A-476A-A384-08FCD58D9FE7}\defa76d7.rra в %TEMP%\{1D7B8D34-5038-46CA-A627-FABAB1A8AEBE}\{D3DF3D05-DE2A-476A-A384-08FCD58D9FE7}\default.pal
%TEMP%\{1D7B8D34-5038-46CA-A627-FABAB1A8AEBE}\{D3DF3D05-DE2A-476A-A384-08FCD58D9FE7}\_IsR7792.rra в %TEMP%\{1D7B8D34-5038-46CA-A627-FABAB1A8AEBE}\{D3DF3D05-DE2A-476A-A384-08FCD58D9FE7}\_IsRes.dll
%TEMP%\{1D7B8D34-5038-46CA-A627-FABAB1A8AEBE}\{D3DF3D05-DE2A-476A-A384-08FCD58D9FE7}\Stri7485.rra в %TEMP%\{1D7B8D34-5038-46CA-A627-FABAB1A8AEBE}\{D3DF3D05-DE2A-476A-A384-08FCD58D9FE7}\StringTable-0009-English.ips
%TEMP%\{1D7B8D34-5038-46CA-A627-FABAB1A8AEBE}\{D3DF3D05-DE2A-476A-A384-08FCD58D9FE7}\isrt7541.rra в %TEMP%\{1D7B8D34-5038-46CA-A627-FABAB1A8AEBE}\{D3DF3D05-DE2A-476A-A384-08FCD58D9FE7}\isrt.dll
%CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\isp3.tmp\Setup.dll в %CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\Setup.dll
%CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\isp6.tmp\temp.000 в %CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\isp6.tmp\IGdi.dll
%TEMP%\isp1.tmp\temp.000 в %TEMP%\isp1.tmp\Setup.dll
%CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\isp3.tmp\temp.000 в %CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\isp3.tmp\Setup.dll
%CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\isp6.tmp\IGdi.dll в %CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\IGdi.dll
%CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\DotA.tmp в %CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\DotNetInstaller.exe
%CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\ctoB.tmp в %CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\ctor.dll
%TEMP%\isp5.tmp\temp.000 в %TEMP%\isp5.tmp\_Setup.dll
%CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\iKe9.tmp в %CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\iKernel.dll