Adware.Downware.361

Техническая информация

Вредоносные функции:

Создает и запускает на исполнение:

'C:\torrent.exe' "/name=purnima_didi_bhajan" "/publisher=1021" "/sub=" "/search=purnima_didi_bhajan" "/type=search" "/tag=6"

Изменяет следующие настройки браузера Windows Internet Explorer:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] 'Icon' = 'inetcpl.cpl#001313'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] 'Description' = 'This zone contains all Web sites you haven't placed in other zones'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] 'RecommendedLevel' = '00011000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] 'MinLevel' = '00011000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] 'DisplayName' = 'Internet'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] 'Flags' = '00000047'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] 'RecommendedLevel' = '00010000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '' = ''
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1805' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] 'MinLevel' = '00012000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] 'Icon' = 'inetcpl.cpl#00004481'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] 'Flags' = '00000003'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] 'RecommendedLevel' = '00012000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] 'Description' = 'This zone contains Web sites that could potentially damage your computer or data.'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1805' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] 'Flags' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] 'DisplayName' = 'Restricted sites'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '' = ''
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] 'MinLevel' = '00010000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] '1805' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] 'Flags' = '00000021'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] 'DisplayName' = 'Local intranet'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '' = ''
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] 'CurrentLevel' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] 'DisplayName' = 'My Computer'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] '' = ''
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] 'Icon' = 'explorer.exe#0100'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] 'Description' = 'Your computer'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] 'DisplayName' = 'Trusted sites'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '' = ''
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] 'Icon' = 'inetcpl.cpl#00004480'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] 'Description' = 'This zone contains Web sites that you trust not to damage your computer or data.'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1805' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] 'Icon' = 'shell32.dll#0018'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] 'Description' = 'This zone contains all Web sites that are on your organization's intranet.'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] 'RecommendedLevel' = '00010500'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] 'MinLevel' = '00010000'

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\RGI5.tmp
%TEMP%\RGI6.tmp
%TEMP%\RGI4.tmp
%TEMP%\nsw3.tmp\nsDialogs.dll
%TEMP%\nsw3.tmp\inetc.dll
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\get_id[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\open[1].php
%PROGRAM_FILES%\smartdl\status
%PROGRAM_FILES%\smartdl\cc
%PROGRAM_FILES%\smartdl\installid
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\get_cc[1].php
%PROGRAM_FILES%\smartdl\header2.bmp
%PROGRAM_FILES%\smartdl\header3.bmp
%PROGRAM_FILES%\smartdl\header.bmp
C:\torrent.exe
%PROGRAM_FILES%\smartdl\gunzip.exe
%PROGRAM_FILES%\smartdl\next.bmp
%TEMP%\nsw3.tmp\modern-header.bmp
%TEMP%\nsw3.tmp\System.dll
%TEMP%\nsw3.tmp\modern-wizard.bmp
%PROGRAM_FILES%\smartdl\skip.bmp
%TEMP%\nsw3.tmp\ioSpecial.ini

Удаляет следующие файлы:

%PROGRAM_FILES%\smartdl\installid
%PROGRAM_FILES%\smartdl\cc
%TEMP%\RGI6.tmp
%TEMP%\RGI4.tmp
%TEMP%\RGI5.tmp

Сетевая активность:

Подключается к:

'tr###.#ecureasset.info':80

TCP:

Запросы HTTP GET:

tr###.#ecureasset.info/bundleinstaller/open.php?ii#################################################################
tr###.#ecureasset.info/bundleinstaller/get_cc.php
tr###.#ecureasset.info/bundleinstaller/get_id.php

UDP: