Trojan.DownLoader12.3925

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'wextract_cleanup0' = 'rundll32.exe <SYSTEM32>\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\Service1] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

'%TEMP%\IXP000.TMP\ccsetup418pro.exe'
'<SYSTEM32>\service.exe' /install
'%TEMP%\IXP000.TMP\Extractor.exe'

Запускает на исполнение:

'<SYSTEM32>\msiexec.exe' /V
'<SYSTEM32>\msiexec.exe' /i "%TEMP%\IXP000.TMP\Setup.msi"

Изменения в файловой системе:

Создает следующие файлы:

C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\RestorePointSize
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
%WINDIR%\Installer\MSI1.tmp
<SYSTEM32>\service.exe
C:\Config.Msi\20db5.rbs
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
%TEMP%\nsp5.tmp
%TEMP%\nsz6.tmp\modern-header.bmp
%TEMP%\nsz6.tmp\g\pfWWW.dll
%TEMP%\nsz6.tmp\modern-wizard.bmp
%TEMP%\nsz6.tmp\nsDialogs.dll
%TEMP%\nsz6.tmp\ButtonEvent.dll
%TEMP%\nsz6.tmp\g\gcombo\combo-offer.png
%TEMP%\nsz6.tmp\UserInfo.dll
%TEMP%\nsz6.tmp\System.dll
%TEMP%\nsz6.tmp\g\gtapi_signed.dll
%TEMP%\nsz6.tmp\g\gcombo\ComboOffer.html
%TEMP%\nsz6.tmp\g\gcapi_dll.dll
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\rp.log
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
%WINDIR%\Installer\20db2.msi
%TEMP%\IXP000.TMP\Setup.msi
%TEMP%\IXP000.TMP\Extractor.exe
%TEMP%\IXP000.TMP\ccsetup418pro.exe
%TEMP%\2066e.msi
%TEMP%\IXP000.TMP\CCleaner Professional Edition 4.18.twd
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY

Удаляет следующие файлы:

%TEMP%\IXP000.TMP\CCleaner Professional Edition 4.18.twd
%TEMP%\2066e.msi
%TEMP%\IXP000.TMP\Extractor.exe
%TEMP%\IXP000.TMP\Setup.msi
C:\Config.Msi\20db5.rbs
%WINDIR%\Installer\MSI1.tmp
%WINDIR%\Installer\20db4.ipi
%WINDIR%\Installer\20db2.msi

Сетевая активность:

Подключается к:

'www.go#####analytics.com':80
'www.ho##ail.com':80

TCP:

Запросы HTTP GET:

www.go#####analytics.com/collect?v=###########################################################################################################################################################################################################################
www.go#####analytics.com/collect?v=#######################################################################################################################################################################################################################################################
www.ho##ail.com/
www.go#####analytics.com/analytics.js

UDP: