Trojan.DownLoader11.37477

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '5425de41972c15c94c80e6c49c85e305' = '"%APPDATA%\firfox.exe" ..'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '5425de41972c15c94c80e6c49c85e305' = '"%APPDATA%\firfox.exe" ..'

Вредоносные функции:

Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%APPDATA%\firfox.exe' = '%APPDATA%\firfox.exe:*:Enabled:firfox.exe'

Создает и запускает на исполнение:

'C:\Extracted\Pro Webcam Hack v 1.0 2013.exe'
'%TEMP%\ir_ext_temp_0\autorun.exe' "SFXSOURCE:C:\Extracted\Pro Webcam Hack v 1.0 2013.exe"
'C:\Extracted\server4.exe'
'%APPDATA%\firfox.exe'

Запускает на исполнение:

'<SYSTEM32>\netsh.exe' firewall add allowedprogram "%APPDATA%\firfox.exe" "firfox.exe" ENABLE

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\ir_ext_temp_0\AutoPlay\Images\today501.jpg
%TEMP%\ir_ext_temp_0\AutoPlay\Images\Untitled 2.bmp
%TEMP%\ir_ext_temp_0\AutoPlay\Images\Rockstar-announces-GTA-IV-DLC-1.jpg
%TEMP%\ir_ext_temp_0\AutoPlay\Images\Thumbs.db
%TEMP%\ir_ext_temp_0\AutoPlay\Images\Untitled 2_1.bmp
%TEMP%\ir_ext_temp_0\AutoPlay\Images\Untitled 3_1.bmp
%TEMP%\ir_ext_temp_0\AutoPlay\Images\Untitled 5.bmp
%TEMP%\ir_ext_temp_0\AutoPlay\Images\Untitled 222.bmp
%TEMP%\ir_ext_temp_0\AutoPlay\Images\Untitled 3.bmp
%TEMP%\ir_ext_temp_0\AutoPlay\Images\logo hacker.png
%TEMP%\ir_ext_temp_0\AutoPlay\Images\logo2.gif
%TEMP%\ir_ext_temp_0\AutoPlay\Images\lock-and-key-icon-thumb355812.jpg
%TEMP%\ir_ext_temp_0\AutoPlay\Images\lock-and-key-icon-thumb355812_1.jpg
%TEMP%\ir_ext_temp_0\AutoPlay\Images\mgs4_boss_ladies.jpg
%TEMP%\ir_ext_temp_0\AutoPlay\Images\pirate-girls-black-skirt.jpg
%TEMP%\ir_ext_temp_0\AutoPlay\Images\ppp.png
%TEMP%\ir_ext_temp_0\AutoPlay\Images\new-picture-21.png
%TEMP%\ir_ext_temp_0\AutoPlay\Images\noctis.png
%TEMP%\ir_ext_temp_0\AutoPlay\Images\Untitled 6.bmp
%TEMP%\ir_ext_temp_0\AutoPlay\Plugins\WINBUTTON\WINBUTTON.APO
%TEMP%\ir_ext_temp_0\AutoPlay\Videos\Thumbs.db
%TEMP%\ir_ext_temp_0\AutoPlay\Plugins\vt_Euro.png
%TEMP%\ir_ext_temp_0\AutoPlay\Plugins\vt_Windows OS.png
%TEMP%\ir_ext_temp_0\autorun.exe
%TEMP%\_ir_tmpfnt_1\Pieces of Eight.TFT
%TEMP%\_ir_tmpfnt_1\Segoe Print.TFT
%TEMP%\ir_ext_temp_0\Hardware-Webcam.ico
%TEMP%\_ir_tmpfnt_1\Calligraph421 BT.TFT
%TEMP%\ir_ext_temp_0\AutoPlay\Images\Untitled3.jpg
%TEMP%\ir_ext_temp_0\AutoPlay\Images\Untitled3_1.jpg
%TEMP%\ir_ext_temp_0\AutoPlay\Images\Untitled 7.bmp
%TEMP%\ir_ext_temp_0\AutoPlay\Images\Untitled1.jpg
%TEMP%\ir_ext_temp_0\AutoPlay\Images\Webcam_logo.png
%TEMP%\ir_ext_temp_0\AutoPlay\Images\Yahoo-Messenger-icon.png
%TEMP%\ir_ext_temp_0\AutoPlay\Plugins\sb_Euro.png
%TEMP%\ir_ext_temp_0\AutoPlay\Images\WindowsLive.png
%TEMP%\ir_ext_temp_0\AutoPlay\Images\Windows-Messenger-icon.png
%TEMP%\ir_ext_temp_0\AutoPlay\Images\lightning-character-art-from-final-fantasy-13.jpg
%TEMP%\ir_ext_temp_0\AutoPlay\Flash\indigo_clouds.swf
%TEMP%\ir_ext_temp_0\AutoPlay\Flash\indigo_i.swf
%TEMP%\ir_ext_temp_0\AutoPlay\Buttons\green_pill.btn
%TEMP%\ir_ext_temp_0\AutoPlay\Flash\hackwebcam.swf
%TEMP%\ir_ext_temp_0\AutoPlay\Flash\sayfe.swf
%TEMP%\ir_ext_temp_0\AutoPlay\Flash\Untitled_3.swf
%TEMP%\ir_ext_temp_0\AutoPlay\Flash\Untitled_4.swf
%TEMP%\ir_ext_temp_0\AutoPlay\Flash\Untitled.swf
%TEMP%\ir_ext_temp_0\AutoPlay\Flash\Untitled_2.swf
C:\Extracted\Pro Webcam Hack v 1.0 2013.exe
%APPDATA%\firfox.exe
%TEMP%\sfx.ini
C:\Extracted\server4.exe
%TEMP%\ir_ext_temp_0\AutoPlay\Audio\Boop.ogg
%TEMP%\ir_ext_temp_0\AutoPlay\Audio\Squisher.ogg
%TEMP%\ir_ext_temp_0\AutoPlay\autorun.cdd
%TEMP%\ir_ext_temp_0\AutoPlay\Audio\Click1.ogg
%TEMP%\ir_ext_temp_0\AutoPlay\Audio\High1.ogg
%TEMP%\ir_ext_temp_0\AutoPlay\Flash\Untitled2.swf
%TEMP%\ir_ext_temp_0\AutoPlay\Images\Final_Fantasy_XIII_Lightning-1.jpg
%TEMP%\ir_ext_temp_0\AutoPlay\Images\Flower02.png
%TEMP%\ir_ext_temp_0\AutoPlay\Images\e3223ccccdd1.gif
%TEMP%\ir_ext_temp_0\AutoPlay\Images\feature-peace-walker.jpg
%TEMP%\ir_ext_temp_0\AutoPlay\Images\Flowers.png
%TEMP%\ir_ext_temp_0\AutoPlay\Images\images.jpg
%TEMP%\ir_ext_temp_0\AutoPlay\Images\KeyLogoSmallInverted.gif
%TEMP%\ir_ext_temp_0\AutoPlay\Images\hacker2.png
%TEMP%\ir_ext_temp_0\AutoPlay\Images\help_icon.jpg
%TEMP%\ir_ext_temp_0\AutoPlay\Flash\Untitled20000_2.swf
%TEMP%\ir_ext_temp_0\AutoPlay\Flash\Untitled222.wfs.swf
%TEMP%\ir_ext_temp_0\AutoPlay\Flash\Untitled20000.swf
%TEMP%\ir_ext_temp_0\AutoPlay\Flash\Untitled20000_1.swf
%TEMP%\ir_ext_temp_0\AutoPlay\Flash\Untitled2222.swf
%TEMP%\ir_ext_temp_0\AutoPlay\Images\Border02.gif
%TEMP%\ir_ext_temp_0\AutoPlay\Images\Dark-Skull-38806.jpg
%TEMP%\ir_ext_temp_0\AutoPlay\Icons\Hardware-Webcam.ico
%TEMP%\ir_ext_temp_0\AutoPlay\Images\007-gun-logo.png