Trojan.DownLoader11.38397

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'USB Security' = '%PROGRAM_FILES%\USB Disk Security\USBGuard.exe'

Вредоносные функции:

Создает и запускает на исполнение:

'%TEMP%\is-OJMHN.tmp\setup.tmp' /SL5="$200E6,5480044,146432,%TEMP%\_ir_sf_temp_0\setup.exe" /SILENT /NORESTART
'%TEMP%\_ir_sf_temp_0\setup.exe' /SILENT /NORESTART
'%TEMP%\_ir_sf_temp_0\irsetup.exe' __IRAOFF:1748850 "__IRAFN:<Полный путь к вирусу>" "__IRCT:0" "__IRTSS:0" "__IRSID:S-1-5-21-2052111302-484763869-725345543-1003"

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\USB Disk Security\locales\is-ULDHI.tmp
%PROGRAM_FILES%\USB Disk Security\is-TU6BS.tmp
%PROGRAM_FILES%\USB Disk Security\locales\is-F1KF7.tmp
%PROGRAM_FILES%\USB Disk Security\locales\is-4HBDJ.tmp
%PROGRAM_FILES%\USB Disk Security\locales\is-P0E9N.tmp
%PROGRAM_FILES%\USB Disk Security\is-Q5IVN.tmp
%PROGRAM_FILES%\USB Disk Security\is-NNUJB.tmp
%PROGRAM_FILES%\USB Disk Security\is-U051R.tmp
%PROGRAM_FILES%\USB Disk Security\is-MFUAP.tmp
%PROGRAM_FILES%\USB Disk Security\is-S141K.tmp
%ALLUSERSPROFILE%\Desktop\Unattended Soft.url
%TEMP%\www.softpir.com Setup Log.txt
%ALLUSERSPROFILE%\Application Data\Zbshareware Lab\profile.ini
%HOMEPATH%\Start Menu\Programs\www.softpir.com\USB Disk Security.lnk
%PROGRAM_FILES%\USB Disk Security\USBGuard.exe
%ALLUSERSPROFILE%\Start Menu\Programs\USB Disk Security\Help.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\USB Disk Security\USB Disk Security.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\USB Disk Security\Uninstall USB Disk Security.lnk
%PROGRAM_FILES%\USB Disk Security\unins000.dat
%ALLUSERSPROFILE%\Desktop\USB Disk Security.lnk
%PROGRAM_FILES%\USB Disk Security\is-2B8ON.tmp
%TEMP%\is-OJMHN.tmp\setup.tmp
%TEMP%\_ir_sf_temp_0\setup.exe
%TEMP%\is-6654L.tmp\_isetup\_shfoldr.dll
%TEMP%\is-6654L.tmp\check.xml
%TEMP%\is-6654L.tmp\itdownload.dll
%TEMP%\_ir_sf_temp_0\lua5.1.dll
%TEMP%\_ir_sf_temp_0\irsetup.exe
%TEMP%\_ir_sf_temp_0\irsetup.dat
%TEMP%\_ir_sf_temp_0\IRIMG2.JPG
%TEMP%\_ir_sf_temp_0\IRIMG1.JPG
%PROGRAM_FILES%\USB Disk Security\is-NEQHQ.tmp
%PROGRAM_FILES%\USB Disk Security\is-NNAR2.tmp
%PROGRAM_FILES%\USB Disk Security\is-H7ELM.tmp
%PROGRAM_FILES%\USB Disk Security\is-DSSM8.tmp
%PROGRAM_FILES%\USB Disk Security\is-LCN4D.tmp
%PROGRAM_FILES%\USB Disk Security\is-UKP0H.tmp
%PROGRAM_FILES%\USB Disk Security\is-R58H9.tmp
%PROGRAM_FILES%\USB Disk Security\is-8UGU2.tmp
%PROGRAM_FILES%\USB Disk Security\is-B4F96.tmp
%PROGRAM_FILES%\USB Disk Security\is-3LC82.tmp

Удаляет следующие файлы:

%TEMP%\_ir_sf_temp_0\IRIMG2.JPG
%TEMP%\_ir_sf_temp_0\IRIMG1.JPG
%TEMP%\_ir_sf_temp_0\setup.exe
%TEMP%\_ir_sf_temp_0\lua5.1.dll
%TEMP%\_ir_sf_temp_0\irsetup.exe
%PROGRAM_FILES%\USB Disk Security\USBGuard.exe
%TEMP%\is-6654L.tmp\check.xml
%TEMP%\_ir_sf_temp_0\irsetup.dat
%TEMP%\is-6654L.tmp\itdownload.dll
%TEMP%\is-OJMHN.tmp\setup.tmp
%TEMP%\is-6654L.tmp\_isetup\_shfoldr.dll

Перемещает следующие файлы:

%PROGRAM_FILES%\USB Disk Security\is-S141K.tmp в %PROGRAM_FILES%\USB Disk Security\log2.dmb
%PROGRAM_FILES%\USB Disk Security\is-MFUAP.tmp в %PROGRAM_FILES%\USB Disk Security\log3.dmb
%PROGRAM_FILES%\USB Disk Security\is-U051R.tmp в %PROGRAM_FILES%\USB Disk Security\log1.dmb
%PROGRAM_FILES%\USB Disk Security\is-NNUJB.tmp в %PROGRAM_FILES%\USB Disk Security\USBGuardUpdate.dat
%PROGRAM_FILES%\USB Disk Security\is-Q5IVN.tmp в %PROGRAM_FILES%\USB Disk Security\log.dmb
%PROGRAM_FILES%\USB Disk Security\locales\is-P0E9N.tmp в %PROGRAM_FILES%\USB Disk Security\locales\russian.dll
%PROGRAM_FILES%\USB Disk Security\locales\is-4HBDJ.tmp в %PROGRAM_FILES%\USB Disk Security\locales\spanish.dll
%PROGRAM_FILES%\USB Disk Security\locales\is-F1KF7.tmp в %PROGRAM_FILES%\USB Disk Security\locales\portuese.dll
%PROGRAM_FILES%\USB Disk Security\is-TU6BS.tmp в %PROGRAM_FILES%\USB Disk Security\version.ini
%PROGRAM_FILES%\USB Disk Security\locales\is-ULDHI.tmp в %PROGRAM_FILES%\USB Disk Security\locales\chinetw.dll
%PROGRAM_FILES%\USB Disk Security\is-2B8ON.tmp в %PROGRAM_FILES%\USB Disk Security\USBGuardUpdate.exe
%PROGRAM_FILES%\USB Disk Security\is-3LC82.tmp в %PROGRAM_FILES%\USB Disk Security\BCGCBPRO1500u80.dll
%PROGRAM_FILES%\USB Disk Security\is-B4F96.tmp в %PROGRAM_FILES%\USB Disk Security\BCGPStyle2010Blue150.dll
%PROGRAM_FILES%\USB Disk Security\is-8UGU2.tmp в %PROGRAM_FILES%\USB Disk Security\USBGuard.chm
%PROGRAM_FILES%\USB Disk Security\is-R58H9.tmp в %PROGRAM_FILES%\USB Disk Security\unins000.exe
%PROGRAM_FILES%\USB Disk Security\is-UKP0H.tmp в %PROGRAM_FILES%\USB Disk Security\USBGuard.exe
%PROGRAM_FILES%\USB Disk Security\is-LCN4D.tmp в %PROGRAM_FILES%\USB Disk Security\msvcp80.dll
%PROGRAM_FILES%\USB Disk Security\is-DSSM8.tmp в %PROGRAM_FILES%\USB Disk Security\msvcr80.dll
%PROGRAM_FILES%\USB Disk Security\is-H7ELM.tmp в %PROGRAM_FILES%\USB Disk Security\Microsoft.VC80.MFC.manifest
%PROGRAM_FILES%\USB Disk Security\is-NNAR2.tmp в %PROGRAM_FILES%\USB Disk Security\mfc80u.dll
%PROGRAM_FILES%\USB Disk Security\is-NEQHQ.tmp в %PROGRAM_FILES%\USB Disk Security\Microsoft.VC80.CRT.manifest