Trojan.DownLoader7.22839

Техническая информация

Вредоносные функции:

Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%TEMP%\Incredibar_install.exe' = '%TEMP%\Incredibar_install.exe:*:Enabled:IncrediBar Installer'

Создает и запускает на исполнение:

%TEMP%\Incredibar_install.exe -silent -did 10678 -ms_url_id 185 -toolbar 1 -homepage 1 -defsearch 1 -ppd 100

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\IM_2.tmp\Gui\language\splash-strings-he.js
%TEMP%\IM_2.tmp\Gui\language\splash-strings-hu.js
%TEMP%\IM_2.tmp\Gui\language\splash-strings-fr.js
%TEMP%\IM_2.tmp\Gui\language\splash-strings-es.js
%TEMP%\IM_2.tmp\Gui\language\splash-strings-fi.js
%TEMP%\IM_2.tmp\Gui\language\splash-strings-pl.js
%TEMP%\IM_2.tmp\Gui\language\splash-strings-pt.js
%TEMP%\IM_2.tmp\Gui\language\splash-strings-nl.js
%TEMP%\IM_2.tmp\Gui\language\splash-strings-it.js
%TEMP%\IM_2.tmp\Gui\language\splash-strings-nb.js
%TEMP%\IM_2.tmp\Gui\jquery-1.3.2.min.js
%TEMP%\IM_2.tmp\Gui\jquery.localisation.min.js
%TEMP%\IM_2.tmp\Gui\api.js
%TEMP%\IM_2.tmp\Gui\api.css
%TEMP%\IM_2.tmp\Gui\splash.css
%TEMP%\IM_2.tmp\Gui\language\splash-strings-el.js
%TEMP%\IM_2.tmp\Gui\language\splash-strings-en.js
%TEMP%\IM_2.tmp\Gui\language\splash-strings-de.js
%TEMP%\IM_2.tmp\Gui\language\splash-strings-ar.js
%TEMP%\IM_2.tmp\Gui\language\splash-strings-da.js
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\app[1].htm
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\upn[1].aspx
%TEMP%\ppd.xml
%TEMP%\upn2.xml
%TEMP%\did.xml
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\reg[1].aspx
%TEMP%\ImInstaller\IncrediMail\arguments.xml
%TEMP%\ImInstaller\IncrediMail\status.xml
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\app[1].htm
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\upn[1].aspx
%TEMP%\IM_2.tmp\Gui\language\splash-strings.js
%TEMP%\IM_2.tmp\Gui\splash.js
%TEMP%\IM_2.tmp\Gui\language\splash-strings-tr.js
%TEMP%\IM_2.tmp\Gui\language\splash-strings-ru.js
%TEMP%\IM_2.tmp\Gui\language\splash-strings-sv.js
%TEMP%\ImInstaller\IncrediMail\cookies.xml
%TEMP%\cdate.xml
%TEMP%\ImInstaller\incredibar_install.log
%TEMP%\IM_2.tmp\Gui\translation.js
%TEMP%\IM_2.tmp\ActionEngine.dll
%TEMP%\IM_2.tmp\Language\strings-he.xml
%TEMP%\IM_2.tmp\Language\strings-hu.xml
%TEMP%\IM_2.tmp\Language\strings-fr.xml
%TEMP%\IM_2.tmp\Language\strings-es.xml
%TEMP%\IM_2.tmp\Language\strings-fi.xml
%TEMP%\IM_2.tmp\Language\strings-pl.xml
%TEMP%\IM_2.tmp\Language\strings-pt.xml
%TEMP%\IM_2.tmp\Language\strings-nl.xml
%TEMP%\IM_2.tmp\Language\strings-it.xml
%TEMP%\IM_2.tmp\Language\strings-nb.xml
%TEMP%\IM_2.tmp\Language\settings-en.xml
%TEMP%\IM_2.tmp\Language\settings-he.xml
%TEMP%\IM_2.tmp\Language\settings-ar.xml
%TEMP%\Incredibar_install.exe
%TEMP%\IM_2.tmp\BASICSCRIPT.7Z
%TEMP%\IM_2.tmp\Language\strings-el.xml
%TEMP%\IM_2.tmp\Language\strings-en.xml
%TEMP%\IM_2.tmp\Language\strings-de.xml
%TEMP%\IM_2.tmp\Language\strings-ar.xml
%TEMP%\IM_2.tmp\Language\strings-da.xml
%TEMP%\IM_2.tmp\uninstallsearchguard.xml
%TEMP%\IM_2.tmp\utilities.xml
%TEMP%\IM_2.tmp\statistics.xml
%TEMP%\IM_2.tmp\instlangs.xml
%TEMP%\IM_2.tmp\productscorrelations.xml
%TEMP%\IM_2.tmp\Gui\loading_right.png
%TEMP%\IM_2.tmp\Gui\splash.html
%TEMP%\IM_2.tmp\Gui\loading_left.png
%TEMP%\IM_2.tmp\Gui\loading_center.png
%TEMP%\IM_2.tmp\Gui\loading_icon.png
%TEMP%\IM_2.tmp\terms.7z
%TEMP%\IM_2.tmp\ars.xml
%TEMP%\IM_2.tmp\Language\strings-tr.xml
%TEMP%\IM_2.tmp\Language\strings-ru.xml
%TEMP%\IM_2.tmp\Language\strings-sv.xml
%TEMP%\IM_2.tmp\basicproductparams.xml
%TEMP%\IM_2.tmp\basicscript.xml
%TEMP%\IM_2.tmp\basicparameters.xml
%TEMP%\IM_2.tmp\arscookies.xml
%TEMP%\IM_2.tmp\autoupdateengine.xml

Удаляет следующие файлы:

%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\app[1].htm
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\app[1].htm
%TEMP%\cdate.xml

Сетевая активность:

Подключается к:

'ww###.#ncredimail.com':80
'ce#.##credibar.com':80
'localhost':1036

TCP:

Запросы HTTP GET:

ce#.##credibar.com/h/reg.aspx?pp##################################
ce#.##credibar.com/h/upn.aspx?r=#################################################
ce#.##credibar.com/h/upn.aspx?r=###################################################################

Запросы HTTP POST: