Trojan.DownLoader1.8475

Technical Information

Modifies file system

Creates the following files

%ProgramFiles%\win32games\bb.tmp
%HOMEPATH%\favorites\ВіВЈГіГЈ\Г®Г·ГіГ®ГГё.lnk
%APPDATA%\microsoft\windows\start menu\Г¬ГґВ±В¦ГГё.lnk
%TEMP%\is-23q2v.tmp\setup1.tmp
%APPDATA%\microsoft\windows\start menu\internet explorer.lnk
%HOMEPATH%\favorites\Г®Г·ГіГ®ГЇГ©ВЅВЈ.lnk
%HOMEPATH%\favorites\ВіВЈГіГЈ\Г®Г·ГіГ®ГЇГ©ВЅВЈ.lnk
%HOMEPATH%\desktop\Г®Г·ГіГ®ГГё.lnk
%HOMEPATH%\desktop\Г®Г·ГіГ®ГЇГ©ВЅВЈ.lnk
%TEMP%\is-gjveo.tmp\_isetup\_regdll.tmp
%HOMEPATH%\desktop\Г¬ГґВ±В¦ГГё.lnk
%TEMP%\is-gjveo.tmp\_isetup\_setup64.tmp
%ProgramFiles%\win32games\sysdkeys.dll
%TEMP%\is-gjveo.tmp\_isetup\_shfoldr.dll
%ProgramFiles(x86)%\В·ВЅВ±ГЈВ°Г№В¶ГЁГ«Г±Г«Г·\is-nauir.tmp
%ProgramFiles(x86)%\В·ВЅВ±ГЈВ°Г№В¶ГЁГ«Г±Г«Г·\is-tde0l.tmp
%ProgramFiles(x86)%\В·ВЅВ±ГЈВ°Г№В¶ГЁГ«Г±Г«Г·\is-v73o1.tmp
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\В·ВЅВ±ГЈВ°Г№В¶ГЁГ«Г±Г«Г·\В·ВЅВ±ГЈВ°Г№В¶ГЁГ«Г±Г«Г·.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\В·ВЅВ±ГЈВ°Г№В¶ГЁГ«Г±Г«Г·.lnk
%ProgramFiles(x86)%\В·ВЅВ±ГЈВ°Г№В¶ГЁГ«Г±Г«Г·\unins000.dat
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\navcancl[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\errorpagetemplate[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\errorpagestrings[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\httperrorpagesscripts[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\background_gradient[2]
%HOMEPATH%\favorites\ВіВЈГіГЈ\Г¬ГґВ±В¦ГГё.lnk
%HOMEPATH%\favorites\Г®Г·ГіГ®ГГё.lnk
%WINDIR%\syswow64\runfonce.bat
%WINDIR%\syswow64\url.txt
%HOMEPATH%\favorites\Г¬ГґВ±В¦ГГё.lnk
%ProgramFiles%\win32games\addurl.bat
%ProgramFiles%\win32games\addurl.dll
%ProgramFiles%\win32games\baidu.ico
%ProgramFiles%\win32games\bookmarks.dat
%ProgramFiles%\win32games\config.ini
%ProgramFiles%\win32games\dangdangwang.ico
%ProgramFiles%\win32games\install.exe
%ProgramFiles%\win32games\jiuzhou.ico
%ProgramFiles%\win32games\setup.bat
%ProgramFiles%\win32games\setup.exe
%ProgramFiles%\win32games\shffolder.dll
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\info_48[1]
%ProgramFiles(x86)%\В·ВЅВ±ГЈВ°Г№В¶ГЁГ«Г±Г«Г·\is-h6u2n.tmp
%ProgramFiles%\win32games\superrepair.dll
%ProgramFiles%\win32games\thumbs.db
%ProgramFiles%\win32games\url.txt
%ProgramFiles%\win32games\wingames.exe
%ProgramFiles%\win32games\xianjian.ico
%ProgramFiles%\win32games\zhuoyue.ico
%ProgramFiles%\win32games\runbat.bat
%WINDIR%\syswow64\doifa.bat
%HOMEPATH%\favorites\ВµВ±ВµВ±ГГё.lnk
%HOMEPATH%\favorites\ВіВЈГіГЈ\ВµВ±ВµВ±ГГё.lnk
%HOMEPATH%\favorites\Г—ВїГґВЅГГё.lnk
%HOMEPATH%\favorites\ВіВЈГіГЈ\Г—ВїГґВЅГГё.lnk
%ProgramFiles%\win32games\2xi.ico
%ProgramFiles%\win32games\taobao.ico
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\bullet[1]

Deletes the following files

%WINDIR%\syswow64\url.txt
%TEMP%\is-gjveo.tmp\_isetup\_regdll.tmp
%TEMP%\is-gjveo.tmp\_isetup\_setup64.tmp
%TEMP%\is-gjveo.tmp\_isetup\_shfoldr.dll
%TEMP%\is-23q2v.tmp\setup1.tmp

Moves the following files

from %ProgramFiles%\win32games\url.txt to %ProgramFiles%\internet explorer\signup\url.txt
from %ProgramFiles%\win32games\install.exe to %ProgramFiles%\internet explorer\signup\install.exe
from %ProgramFiles%\win32games\sysdkeys.dll to %WINDIR%\syswow64\sysdkeys.dll
from %ProgramFiles%\win32games\setup.exe to %WINDIR%\syswow64\setup1.exe
from %ProgramFiles%\win32games\superrepair.dll to %WINDIR%\syswow64\superrepair.dll
from %ProgramFiles(x86)%\В·ВЅВ±ГЈВ°Г№В¶ГЁГ«Г±Г«Г·\is-h6u2n.tmp to %ProgramFiles(x86)%\В·ВЅВ±ГЈВ°Г№В¶ГЁГ«Г±Г«Г·\unins000.exe
from %ProgramFiles(x86)%\В·ВЅВ±ГЈВ°Г№В¶ГЁГ«Г±Г«Г·\is-nauir.tmp to %ProgramFiles(x86)%\В·ВЅВ±ГЈВ°Г№В¶ГЁГ«Г±Г«Г·\fangbian.exe
from %ProgramFiles(x86)%\В·ВЅВ±ГЈВ°Г№В¶ГЁГ«Г±Г«Г·\is-tde0l.tmp to %ProgramFiles(x86)%\В·ВЅВ±ГЈВ°Г№В¶ГЁГ«Г±Г«Г·\getmessage.dll
from %ProgramFiles(x86)%\В·ВЅВ±ГЈВ°Г№В¶ГЁГ«Г±Г«Г·\is-v73o1.tmp to %ProgramFiles(x86)%\В·ВЅВ±ГЈВ°Г№В¶ГЁГ«Г±Г«Г·\endpro.exe

Modifies the following files

C:\users\public\desktop\firefox.lnk
C:\users\public\desktop\google chrome.lnk

Network activity

UDP

DNS ASK so#.5k5.net
DNS ASK re#.2xi.com
DNS ASK bz.#ee.cn

Miscellaneous

Searches for the following windows

ClassName: 'MS_WINHELP' WindowName: ''
ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebCheckMonitor' WindowName: ''

Creates and executes the following

'%ProgramFiles%\win32games\wingames.exe' http://re#.2xi.com/2010011201/
'%WINDIR%\syswow64\setup1.exe' /SUPPRESSMSGBOXES /VERYSILENT
'%TEMP%\is-23q2v.tmp\setup1.tmp' /SL5="$60282,255588,51712,%WINDIR%\SysWOW64\setup1.exe" /SUPPRESSMSGBOXES /VERYSILENT
'%WINDIR%\syswow64\cmd.exe' /c ""%ProgramFiles%\Win32Games\AddURL.bat" "' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c ""%ProgramFiles%\Win32Games\runbat.bat" "' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c ""%ProgramFiles%\Win32Games\setup.bat" /SILENT /SUPPRESSMSGBOXES"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c ""<SYSTEM32>\doifa.bat" "' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c ""%ProgramFiles%\Win32Games\AddURL.bat" "
'%WINDIR%\syswow64\cmd.exe' /c ""%ProgramFiles%\Win32Games\runbat.bat" "
'%WINDIR%\syswow64\rundll32.exe' "%ProgramFiles%\Win32Games\AddURL.dll" addurlp
'%WINDIR%\syswow64\rundll32.exe' "%ProgramFiles%\Win32Games\shffolder.dll" movefilesuper
'%WINDIR%\syswow64\cmd.exe' /c ""%ProgramFiles%\Win32Games\setup.bat" /SILENT /SUPPRESSMSGBOXES"
'%WINDIR%\syswow64\cmd.exe' /c ""<SYSTEM32>\doifa.bat" "
'%WINDIR%\syswow64\rundll32.exe' "<SYSTEM32>\sysdkeys.dll" huise

Демо бесплатно на 14 дней

Выдаётся при установке

Скачать с сайта

Скачать с Google Play

Завантажте
Dr.Web для Android

Безкоштовно на 3 місяці
Всі компоненти захисту
Подовження демо в
AppGallery/Google Pay

Технології

Терміни

Навчання

Міфи

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней