Trojan.DownLoader11.18281

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,%PROGRAM_FILES%\iSafe\wpk.exe'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\SecStore] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

'<SYSTEM32>\secpro.exe'
'%PROGRAM_FILES%\iSafe\WPK.exe'
'%APPDATA%\Temps\SvcControl.exe' start SecStore
'%APPDATA%\Temps\7z.exe' e isafekeypro.7z -y
'%APPDATA%\Temps\WPKM.exe'

Запускает на исполнение:

'%WINDIR%\regedit.exe' /s "%APPDATA%\Temps\wpkreg.reg"

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\iSafe\msvcp90.dll
%PROGRAM_FILES%\iSafe\msvcr90.dll
%PROGRAM_FILES%\iSafe\Microsoft.VC90.CRT.manifest
%PROGRAM_FILES%\iSafe\Microsoft.VC90.MFC.manifest
%PROGRAM_FILES%\iSafe\ssleay32.dll
%PROGRAM_FILES%\iSafe\SvcControl.exe
%PROGRAM_FILES%\iSafe\openldap.dll
%PROGRAM_FILES%\iSafe\SecPro.exe
%PROGRAM_FILES%\iSafe\mfc90u.dll
%PROGRAM_FILES%\iSafe\IMME64.dll
%PROGRAM_FILES%\iSafe\isafekeypro.7z
%PROGRAM_FILES%\iSafe\FltEng.dll
%PROGRAM_FILES%\iSafe\IMME.dll
%PROGRAM_FILES%\iSafe\libeay32.dll
%PROGRAM_FILES%\iSafe\libsasl.dll
%PROGRAM_FILES%\iSafe\isafekeypro.zip
%PROGRAM_FILES%\iSafe\kern.bin
%APPDATA%\L001\W0003
%ALLUSERSPROFILE%\Application Data\subcfg
%APPDATA%\L001\W0000
%APPDATA%\L001\W0002
%APPDATA%\L001\W0000-journal
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\index[1].htm
%ALLUSERSPROFILE%\Application Data\ftpokay.txt
%APPDATA%\L001\2014-04-18_12-48-22
<SYSTEM32>\FltEng.dll
%PROGRAM_FILES%\iSafe\WPKM.exe
%PROGRAM_FILES%\iSafe\WPKM64.exe
%PROGRAM_FILES%\iSafe\WPK.exe
%PROGRAM_FILES%\iSafe\WPK64.exe
%APPDATA%\Temps\wpkreg.reg
<SYSTEM32>\secpro.exe
%PROGRAM_FILES%\iSafe\wpkr.exe
%PROGRAM_FILES%\iSafe\wpkun.bin
%APPDATA%\Temps\SvcControl.exe
%APPDATA%\Temps\WPK.exe
%APPDATA%\Temps\compress7z.bat
%APPDATA%\Temps\SecPro.exe
%APPDATA%\Temps\WPKM64.exe
%APPDATA%\Temps\wpkr.exe
%APPDATA%\Temps\WPK64.exe
%APPDATA%\Temps\WPKM.exe
%APPDATA%\Temps\Microsoft.VC90.MFC.manifest
%APPDATA%\Temps\7z.dll
%APPDATA%\Temps\7z.exe
%APPDATA%\Temps\isafekeyprotemp
%APPDATA%\Temps\isafekeypro.zip
%APPDATA%\Temps\wpkun.bin
%APPDATA%\Temps\Microsoft.VC90.CRT.manifest
%APPDATA%\Temps\isafekeypro.7z
%APPDATA%\Temps\kern.bin
%APPDATA%\Temps\ssleay32.dll
%PROGRAM_FILES%\iSafe\7z.dll
%APPDATA%\Temps\msvcr90.dll
%APPDATA%\Temps\openldap.dll
%PROGRAM_FILES%\iSafe\compress7z.bat
%PROGRAM_FILES%\iSafe\curllib.dll
%PROGRAM_FILES%\iSafe\7z.exe
%PROGRAM_FILES%\iSafe\ABComFun.dll
%APPDATA%\Temps\msvcp90.dll
%APPDATA%\Temps\FltEng.dll
%APPDATA%\Temps\IMME.dll
%APPDATA%\Temps\ABComFun.dll
%APPDATA%\Temps\curllib.dll
%APPDATA%\Temps\libsasl.dll
%APPDATA%\Temps\mfc90u.dll
%APPDATA%\Temps\IMME64.dll
%APPDATA%\Temps\libeay32.dll