Trojan.DownLoader11.23091

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\Start Driver Reviver for CRNJEUFU@%USERNAME%(logon).job

Вредоносные функции:

Создает и запускает на исполнение:

'%PROGRAM_FILES%\ReviverSoft\Driver Reviver\DriverReviver.exe' s_install
'<SYSTEM32>\1.exe' /S

Изменения в файловой системе:

Создает следующие файлы:

%ALLUSERSPROFILE%\Application Data\ReviverSoft\Driver Reviver\Language\Danish.xml
%ALLUSERSPROFILE%\Application Data\ReviverSoft\Driver Reviver\Language\Dutch.xml
%ALLUSERSPROFILE%\Desktop\Driver Reviver.lnk
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Driver Reviver.lnk
%ALLUSERSPROFILE%\Application Data\ReviverSoft\Driver Reviver\Language\English.xml
%ALLUSERSPROFILE%\Application Data\ReviverSoft\Driver Reviver\Language\Italian.xml
%ALLUSERSPROFILE%\Application Data\ReviverSoft\Driver Reviver\Language\Japanese.xml
%ALLUSERSPROFILE%\Application Data\ReviverSoft\Driver Reviver\Language\French.xml
%ALLUSERSPROFILE%\Application Data\ReviverSoft\Driver Reviver\Language\German.xml
%PROGRAM_FILES%\ReviverSoft\Driver Reviver\defaults\TradChinese.xml
%PROGRAM_FILES%\ReviverSoft\Driver Reviver\defaults\TradChinese1
%PROGRAM_FILES%\ReviverSoft\Driver Reviver\defaults\Spanish1
%PROGRAM_FILES%\ReviverSoft\Driver Reviver\defaults\Spanish2
%PROGRAM_FILES%\ReviverSoft\Driver Reviver\defaults\TradChinese2
%PROGRAM_FILES%\ReviverSoft\Driver Reviver\defaults\Turkish2
%ALLUSERSPROFILE%\Start Menu\Programs\ReviverSoft\Driver Reviver\Driver Reviver.lnk
%PROGRAM_FILES%\ReviverSoft\Driver Reviver\defaults\Turkish.xml
%PROGRAM_FILES%\ReviverSoft\Driver Reviver\defaults\Turkish1
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\update[1].htm
%ALLUSERSPROFILE%\Application Data\DriverReviver.exe\lastResponse.xml
%ALLUSERSPROFILE%\Application Data\DriverReviver.exe\lastRequest.xml
%ALLUSERSPROFILE%\Application Data\DriverReviver.exe\additionalHeaders.txt
%ALLUSERSPROFILE%\Application Data\ReviverSoft\Driver Reviver\backups\BackupInfo.xml
%PROGRAM_FILES%\ReviverSoft\Driver Reviver\Request.xml
%PROGRAM_FILES%\ReviverSoft\Driver Reviver\Response.xml
%PROGRAM_FILES%\ReviverSoft\Driver Reviver\DRmanager_log.log
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\refreshdriver[1].htm
%ALLUSERSPROFILE%\Application Data\ReviverSoft\Driver Reviver\Language\TradChinese.xml
%ALLUSERSPROFILE%\Application Data\ReviverSoft\Driver Reviver\Language\Turkish.xml
%ALLUSERSPROFILE%\Application Data\ReviverSoft\Driver Reviver\Language\Russian.xml
%ALLUSERSPROFILE%\Application Data\ReviverSoft\Driver Reviver\Language\Spanish.xml
%PROGRAM_FILES%\ReviverSoft\Driver Reviver\7za.exe
%PROGRAM_FILES%\ReviverSoft\Driver Reviver\Logs\License.log
%PROGRAM_FILES%\ReviverSoft\Driver Reviver\Logs\ServerCommunications.log
%PROGRAM_FILES%\ReviverSoft\Driver Reviver\app_log.log
%ALLUSERSPROFILE%\Application Data\ReviverSoft\Driver Reviver\S-1-5-21-2052111302-484763869-725345543-1003\AppSettings.xml
%PROGRAM_FILES%\ReviverSoft\Driver Reviver\defaults\Spanish.xml
%PROGRAM_FILES%\ReviverSoft\Driver Reviver\Uninstall.exe
%PROGRAM_FILES%\ReviverSoft\Driver Reviver\defaults\Danish.xml
%PROGRAM_FILES%\ReviverSoft\Driver Reviver\SignatureChecker.dll
%PROGRAM_FILES%\ReviverSoft\Driver Reviver\DriverReviverUpdater.exe
%PROGRAM_FILES%\ReviverSoft\Driver Reviver\defaults\Danish1
%PROGRAM_FILES%\ReviverSoft\Driver Reviver\defaults\Dutch1
%PROGRAM_FILES%\ReviverSoft\Driver Reviver\defaults\Dutch2
%PROGRAM_FILES%\ReviverSoft\Driver Reviver\defaults\Danish2
%PROGRAM_FILES%\ReviverSoft\Driver Reviver\defaults\Dutch.xml
%TEMP%\aut2.tmp
<SYSTEM32>\1.exe
%TEMP%\aut1.tmp
%TEMP%\jmgfqfq
%TEMP%\nsj4.tmp
%TEMP%\nsz5.tmp\nsProcess.dll
%PROGRAM_FILES%\ReviverSoft\Driver Reviver\DriverReviver.exe
%TEMP%\nsz5.tmp\nsSessionSIDW.dll
%TEMP%\nsz5.tmp\System.dll
%PROGRAM_FILES%\ReviverSoft\Driver Reviver\defaults\Italian2
%PROGRAM_FILES%\ReviverSoft\Driver Reviver\defaults\Japanese.xml
%PROGRAM_FILES%\ReviverSoft\Driver Reviver\defaults\Italian.xml
%PROGRAM_FILES%\ReviverSoft\Driver Reviver\defaults\Italian1
%PROGRAM_FILES%\ReviverSoft\Driver Reviver\defaults\Japanese1
%PROGRAM_FILES%\ReviverSoft\Driver Reviver\defaults\Russian1
%PROGRAM_FILES%\ReviverSoft\Driver Reviver\defaults\Russian2
%PROGRAM_FILES%\ReviverSoft\Driver Reviver\defaults\Japanese2
%PROGRAM_FILES%\ReviverSoft\Driver Reviver\defaults\Russian.xml
%PROGRAM_FILES%\ReviverSoft\Driver Reviver\defaults\English2
%PROGRAM_FILES%\ReviverSoft\Driver Reviver\defaults\French.xml
%PROGRAM_FILES%\ReviverSoft\Driver Reviver\defaults\English.xml
%PROGRAM_FILES%\ReviverSoft\Driver Reviver\defaults\English1
%PROGRAM_FILES%\ReviverSoft\Driver Reviver\defaults\French1
%PROGRAM_FILES%\ReviverSoft\Driver Reviver\defaults\German1
%PROGRAM_FILES%\ReviverSoft\Driver Reviver\defaults\German2
%PROGRAM_FILES%\ReviverSoft\Driver Reviver\defaults\French2
%PROGRAM_FILES%\ReviverSoft\Driver Reviver\defaults\German.xml