Trojan.DownLoader11.8784

Техническая информация

Вредоносные функции:

Создает и запускает на исполнение:

'%PROGRAM_FILES%\Songr\Songr.exe' /AfterMigration
'%PROGRAM_FILES%\Songr\SongrJumplistLauncher.exe' /ScheduleNgen

Запускает на исполнение:

'%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe' -UseCLSID {34A2EDC1-EB72-4B90-856F-74063E36D799} -Comment "NGen Worker Process"
'%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe' -UseCLSID {FF356D09-13C0-4DD4-95F5-33AD753D79C1} -Comment "NGen Worker Process"
'%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe' -UseCLSID {EFD35653-15CD-4DC7-A8D8-E459AF9BAAA9} -Comment "NGen Worker Process"
'%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe' -UseCLSID {6A4D0BED-3BD9-4159-BF4D-3E1C4DB8ECAC} -Comment "NGen Worker Process"
'%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe' -UseCLSID {858D54EE-3E53-467B-A0E4-808F51E07F7E} -Comment "NGen Worker Process"
'%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe' -UseCLSID {552D06F3-9C28-484F-9E42-599EFACD08BF} -Comment "NGen Worker Process"
'%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ngen.exe' install "%PROGRAM_FILES%\Songr\Songr.exe"
'%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe' -UseCLSID {90F0A710-B9CB-485E-BDD4-308FBF521644} -Comment "NGen Worker Process"
'%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe' -UseCLSID {F4E7661D-DCF9-4DB0-9E50-BBB9978714DD} -Comment "NGen Worker Process"

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\Songr\sv\Songr.V1.resources.dll
%PROGRAM_FILES%\Songr\ru\Songr.V1.resources.dll
%PROGRAM_FILES%\Songr\ro\Songr.V1.resources.dll
%PROGRAM_FILES%\Songr\Songr.V1.954dc023a3ef.dll
%PROGRAM_FILES%\Songr\zh-Hant\Songr.V1.resources.dll
%PROGRAM_FILES%\Songr\tr\Songr.V1.resources.dll
%PROGRAM_FILES%\Songr\no\Songr.V1.resources.dll
%PROGRAM_FILES%\Songr\nl\Songr.V1.resources.dll
%PROGRAM_FILES%\Songr\lv\Songr.V1.resources.dll
%PROGRAM_FILES%\Songr\pt-pt\Songr.V1.resources.dll
%PROGRAM_FILES%\Songr\pt-br\Songr.V1.resources.dll
%PROGRAM_FILES%\Songr\pl\Songr.V1.resources.dll
%WINDIR%\assembly\NativeImages_v4.0.30319_32\Temp\c4c-0\System.EnterpriseServices.dll
%WINDIR%\assembly\NativeImages_v4.0.30319_32\Temp\c4c-0\System.EnterpriseServices.Wrapper.dll
%WINDIR%\assembly\NativeImages_v4.0.30319_32\Temp\c20-0\System.Transactions.dll
%WINDIR%\assembly\NativeImages_v4.0.30319_32\Temp\cc4-0\System.Web.dll
%WINDIR%\assembly\NativeImages_v4.0.30319_32\Temp\c9c-0\System.Runtime.Remoting.dll
%WINDIR%\assembly\NativeImages_v4.0.30319_32\Temp\c74-0\System.DirectoryServices.dll
%ALLUSERSPROFILE%\Start Menu\Programs\Songr.lnk
%PROGRAM_FILES%\Songr\Uninstall.exe
%PROGRAM_FILES%\Songr\Songr.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\Temp\bf4-0\Microsoft.VisualC.dll
%WINDIR%\assembly\NativeImages_v4.0.30319_32\Temp\bcc-0\Songr.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\wpad[1].cache
%PROGRAM_FILES%\Songr\ko\Songr.V1.resources.dll
%PROGRAM_FILES%\Songr\SongrJumplistLauncher.exe
%PROGRAM_FILES%\Songr\Songr.exe.config
%PROGRAM_FILES%\Songr\Genres\Gospel.jpg
%PROGRAM_FILES%\Songr\cs\Songr.V1.resources.dll
%PROGRAM_FILES%\Songr\ca\Songr.V1.resources.dll
%PROGRAM_FILES%\Songr\bg\Songr.V1.resources.dll
%TEMP%\nsp3.tmp\nsProcess.dll
%TEMP%\nsp3.tmp\UAC.dll
%TEMP%\nsu2.tmp
%PROGRAM_FILES%\Songr\Interop.WMPLib.dll
%TEMP%\nsp3.tmp\System.dll
%TEMP%\nsp3.tmp\modern-wizard.bmp
%PROGRAM_FILES%\Songr\he\Songr.V1.resources.dll
%PROGRAM_FILES%\Songr\gl\Songr.V1.resources.dll
%PROGRAM_FILES%\Songr\fr\Songr.V1.resources.dll
%PROGRAM_FILES%\Songr\it\Songr.V1.resources.dll
%PROGRAM_FILES%\Songr\id\Songr.V1.resources.dll
%PROGRAM_FILES%\Songr\hu\Songr.V1.resources.dll
%PROGRAM_FILES%\Songr\el\Songr.V1.resources.dll
%PROGRAM_FILES%\Songr\de\Songr.V1.resources.dll
%PROGRAM_FILES%\Songr\da\Songr.V1.resources.dll
%PROGRAM_FILES%\Songr\fi\Songr.V1.resources.dll
%PROGRAM_FILES%\Songr\eu\Songr.V1.resources.dll
%PROGRAM_FILES%\Songr\es\Songr.V1.resources.dll

Удаляет следующие файлы:

%TEMP%\nsp3.tmp\UAC.dll
%WINDIR%\assembly\NativeImages_v4.0.30319_32\index1b.dat
%TEMP%\nsp3.tmp\System.dll
%TEMP%\nsp3.tmp\modern-wizard.bmp
%TEMP%\nsp3.tmp\nsProcess.dll

Перемещает следующие файлы:

%WINDIR%\assembly\NativeImages_v4.0.30319_32\Temp\c4c-0\System.EnterpriseServices.Wrapper.dll в %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.EnterpriseSe#\8b6e9d6171aad3561263ce2cd05c57df\System.EnterpriseServices.Wrapper.dll
%WINDIR%\assembly\NativeImages_v4.0.30319_32\Temp\c74-0\System.DirectoryServices.dll в %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.DirectorySer#\5166bf93ac5239837c9c92b58d183ea6\System.DirectoryServices.ni.dll
%WINDIR%\assembly\NativeImages_v4.0.30319_32\Temp\c9c-0\System.Runtime.Remoting.dll в %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Runtime.Remo#\dc1f0dbf1d3ba856eccec90b62b55d79\System.Runtime.Remoting.ni.dll
%WINDIR%\assembly\NativeImages_v4.0.30319_32\Temp\c4c-0\System.EnterpriseServices.dll в %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.EnterpriseSe#\8b6e9d6171aad3561263ce2cd05c57df\System.EnterpriseServices.ni.dll
%WINDIR%\assembly\NativeImages_v4.0.30319_32\Temp\bcc-0\Songr.exe в %WINDIR%\assembly\NativeImages_v4.0.30319_32\Songr\2736766560a89aac1a18f74fb850be61\Songr.ni.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\Temp\bf4-0\Microsoft.VisualC.dll в %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.VisualC\552a460a8bcf608aecc6418db0d40216\Microsoft.VisualC.ni.dll
%WINDIR%\assembly\NativeImages_v4.0.30319_32\Temp\c20-0\System.Transactions.dll в %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Transactions\dd9dbf82e44454689976a49a9e4ddb6d\System.Transactions.ni.dll

Сетевая активность:

Подключается к: