Trojan.DownLoader22.64348

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Safe Browsere' = 'C:\\Program Files (x86)\\Safe Browsing\\Safe_Browsing.exe'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\Windows Event Log Viewer] 'ImagePath' = '"%WINDIR%\Win Services\winevent.exe"'
[<HKLM>\SYSTEM\ControlSet001\Services\Windows Event Log Viewer] 'Start' = '00000002'

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\cmd.exe' /c ""%WINDIR%\Win Services\startup.bat" "
'%ProgramFiles%\Safe Browsing\Safe_Browsing.exe' /Passive /NORESTART
'<SYSTEM32>\reg.exe' ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "Safe Browsere" /d "C:\\Program Files\\Safe Browsing\\Safe_Browsing.exe"
'<SYSTEM32>\reg.exe' ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "Safe Browsere" /d "C:\\Program Files (x86)\\Safe Browsing\\Safe_Browsing.exe"
'%TEMP%\is-J5T1H.tmp\sb.tmp' /SL5="$40036,529818,56832,%TEMP%\7ZipSfx.000\sb.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
'%TEMP%\7ZipSfx.000\sb.exe' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
'%WINDIR%\Win Services\winevent.exe'
'%WINDIR%\Win Services\winevent.exe' --install

Изменения в файловой системе:

Создает следующие файлы:

%ALLUSERSPROFILE%\Application Data\Browser Data\Safe_Browsing.exe.config
%ALLUSERSPROFILE%\Application Data\Browser Data\Safe_Browsing.exe
%ALLUSERSPROFILE%\Application Data\Browser Data\Safe_Browsing.pdb
%ALLUSERSPROFILE%\Application Data\Browser Data\Safe_Browsing.vshost.exe.config
%ALLUSERSPROFILE%\Application Data\Browser Data\Safe_Browsing.vshost.exe
%ALLUSERSPROFILE%\Application Data\Browser Data\NDde.dll
%WINDIR%\Win Services\winevent.InstallState
%WINDIR%\Win Services\winevent.InstallLog
%ALLUSERSPROFILE%\Application Data\Browser Data\Browser_voice.wav
%ALLUSERSPROFILE%\Application Data\Browser Data\Microsoft.Win32.TaskScheduler.dll
%ALLUSERSPROFILE%\Application Data\Browser Data\Interop.SHDocVw.dll
%WINDIR%\Win Services\WinLogFile.txt
%ProgramFiles%\Safe Browsing\Microsoft.Win32.TaskScheduler.dll
%WINDIR%\Browser Data\Interop.SHDocVw.dll
%WINDIR%\Browser Data\Microsoft.Win32.TaskScheduler.dll
%WINDIR%\Browser Data\NDde.dll
%ProgramFiles%\Safe Browsing\NDde.dll
%ProgramFiles%\Safe Browsing\Interop.SHDocVw.dll
%ALLUSERSPROFILE%\Application Data\Browser Data\unins000.dat
%ALLUSERSPROFILE%\Application Data\Browser Data\Safe_Browsing.vshost.exe.manifest
%ALLUSERSPROFILE%\Application Data\Browser Data\unins000.exe
%WINDIR%\Browser Data\Browser_voice.wav
%ProgramFiles%\Safe Browsing\Browser_voice.wav
%WINDIR%\Win Services\InstallUtil.InstallLog
%WINDIR%\Win Services\is-E9648.tmp
%WINDIR%\Win Services\is-AOK47.tmp
%WINDIR%\Win Services\is-7BI9K.tmp
%WINDIR%\Win Services\is-HV6C5.tmp
%WINDIR%\Win Services\is-LIHUR.tmp
%WINDIR%\Win Services\is-RFM1R.tmp
%TEMP%\is-J5T1H.tmp\sb.tmp
%TEMP%\7ZipSfx.000\sb.exe
%TEMP%\is-U1GKJ.tmp\_isetup\_shfoldr.dll
%ProgramFiles%\Safe Browsing\is-QPJCE.tmp
%TEMP%\is-U1GKJ.tmp\isxdl.dll
%WINDIR%\Win Services\is-NQ2V1.tmp
%ProgramFiles%\Safe Browsing\is-IG6P0.tmp
%ProgramFiles%\Safe Browsing\is-Q006I.tmp
%ProgramFiles%\Safe Browsing\is-I2AUE.tmp
%ProgramFiles%\Safe Browsing\unins000.dat
%ProgramFiles%\Safe Browsing\is-9JO7T.tmp
%ProgramFiles%\Safe Browsing\is-T18U4.tmp
%ProgramFiles%\Safe Browsing\is-ROIIB.tmp
%ProgramFiles%\Safe Browsing\is-N3AEH.tmp
%ProgramFiles%\Safe Browsing\is-P4GKM.tmp
%ProgramFiles%\Safe Browsing\is-AQK1S.tmp
%ProgramFiles%\Safe Browsing\is-2VQCM.tmp

Удаляет следующие файлы:

%TEMP%\is-J5T1H.tmp\sb.tmp
%TEMP%\7ZipSfx.000\sb.exe
<SYSTEM32>\d3d9caps.dat
%TEMP%\is-U1GKJ.tmp\isxdl.dll
%TEMP%\is-U1GKJ.tmp\_isetup\_shfoldr.dll

Перемещает следующие файлы:

%ProgramFiles%\Safe Browsing\is-2VQCM.tmp в %ProgramFiles%\Safe Browsing\NDde.dll
%ProgramFiles%\Safe Browsing\is-AQK1S.tmp в %ProgramFiles%\Safe Browsing\Safe_Browsing.exe
%ProgramFiles%\Safe Browsing\is-ROIIB.tmp в %ProgramFiles%\Safe Browsing\Interop.SHDocVw.dll
%ProgramFiles%\Safe Browsing\is-P4GKM.tmp в %ProgramFiles%\Safe Browsing\Microsoft.Win32.TaskScheduler.dll
%ProgramFiles%\Safe Browsing\is-T18U4.tmp в %ProgramFiles%\Safe Browsing\Safe_Browsing.exe.config
%ProgramFiles%\Safe Browsing\is-I2AUE.tmp в %ProgramFiles%\Safe Browsing\Safe_Browsing.vshost.exe.config
%ProgramFiles%\Safe Browsing\is-9JO7T.tmp в %ProgramFiles%\Safe Browsing\Safe_Browsing.vshost.exe.manifest
%ProgramFiles%\Safe Browsing\is-Q006I.tmp в %ProgramFiles%\Safe Browsing\Safe_Browsing.pdb
%ProgramFiles%\Safe Browsing\is-IG6P0.tmp в %ProgramFiles%\Safe Browsing\Safe_Browsing.vshost.exe
%WINDIR%\Win Services\is-AOK47.tmp в %WINDIR%\Win Services\winevent.exe
%WINDIR%\Win Services\is-E9648.tmp в %WINDIR%\Win Services\winevent.exe.config
%ProgramFiles%\Safe Browsing\is-QPJCE.tmp в %ProgramFiles%\Safe Browsing\unins000.exe
%WINDIR%\Win Services\is-RFM1R.tmp в %WINDIR%\Win Services\startup.bat
%WINDIR%\Win Services\is-7BI9K.tmp в %WINDIR%\Win Services\winevent.pdb
%WINDIR%\Win Services\is-NQ2V1.tmp в %WINDIR%\Win Services\winevent.vshost.exe.manifest
%ProgramFiles%\Safe Browsing\is-N3AEH.tmp в %ProgramFiles%\Safe Browsing\Browser_voice.wav
%WINDIR%\Win Services\is-LIHUR.tmp в %WINDIR%\Win Services\winevent.vshost.exe
%WINDIR%\Win Services\is-HV6C5.tmp в %WINDIR%\Win Services\winevent.vshost.exe.config