Trojan.DownLoader3.61104

Для обеспечения автозапуска и распространения:

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\QuickDownload Service] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\QuickDownload Agent] 'Start' = '00000002'

Вредоносные функции:

Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\QuickDownloadService\qdownservice.exe' = '%PROGRAM_FILES%\QuickDownloadService\qdownservice.exe:*:Enabled:QuickDownloadSvc'

Создает и запускает на исполнение:

%PROGRAM_FILES%\QuickDownloadService\sc.exe STOP "QuickDownload Update" STOP "QuickDownload Service" STOP "QuickDownload Agent" DELETE "QuickDownload Update" DELETE "QuickDownload Service" DELETE "QuickDownload Agent" STOP "Mega Network Service" DELETE "Mega Network Manager" STOP "Mega Network Manager" DELETE "Mega Network Update" STOP "Mega Network Update" DELETE "Mega Network Service"
%PROGRAM_FILES%\QuickDownloadService\qdownagent.exe
%PROGRAM_FILES%\QuickDownloadService\qdownservice.exe
%PROGRAM_FILES%\QuickDownloadService\ElevationWrap.exe
<Текущая директория>\ElevationWrap.exe
%PROGRAM_FILES%\QuickDownloadService\StopMegaService.exe

Запускает на исполнение:

<SYSTEM32>\sc.exe FAILURE "QuickDownload Agent" reset= 180 actions= "restart/180000/restart/180000/restart/180000"
<SYSTEM32>\sc.exe start "QuickDownload Service"
<SYSTEM32>\sc.exe start "QuickDownload Agent"
<SYSTEM32>\sc.exe description "QuickDownload Service" "컨텐츠 다운로드시 다운로드 속도 향상을 위한 서비스를 제공합니다."
<SYSTEM32>\sc.exe description "QuickDownload Agent" "컨텐츠 다운로드시 다운로드 속도 향상을 위한 서비스를 제공합니다."
<SYSTEM32>\sc.exe FAILURE "QuickDownload Service" reset= 180 actions= "restart/180000/restart/180000/restart/180000"
<SYSTEM32>\netsh.exe firewall add portopening TCP 2869 "UPnP TCP"
<SYSTEM32>\netsh.exe firewall add allowedprogram "%PROGRAM_FILES%\QuickDownloadService\qdownservice.exe" "QuickDownloadSvc" ENABLE
<SYSTEM32>\wscript.exe "%PROGRAM_FILES%\QuickDownloadService\Firewall.vbs"
<SYSTEM32>\sc.exe create "QuickDownload Service" binPath= "%PROGRAM_FILES%\QuickDownloadService\qdownservice.exe" start= auto error= ignore
<SYSTEM32>\sc.exe create "QuickDownload Agent" binPath= "%PROGRAM_FILES%\QuickDownloadService\qdownagent.exe" start= auto error= ignore
<SYSTEM32>\netsh.exe firewall add portopening UDP 1900 "UPnP UDP"

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\QuickDownloadService\conf\is-JJ5FK.tmp
%PROGRAM_FILES%\QuickDownloadService\unins000.dat
%PROGRAM_FILES%\QuickDownloadService\conf\data3.cfg
%PROGRAM_FILES%\QuickDownloadService\is-C2AH1.tmp
%PROGRAM_FILES%\QuickDownloadService\is-D5QEB.tmp
%PROGRAM_FILES%\QuickDownloadService\is-A1DE6.tmp
%PROGRAM_FILES%\QuickDownloadService\conf\data4.cfg
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\0J2LM5OP\maxuploadspeed[1].txt
%PROGRAM_FILES%\QuickDownloadService\maxuploadspeed.txt
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\0J2LM5OP\wpad[1].dat
%PROGRAM_FILES%\QuickDownloadService\conf\data6.tmp
%PROGRAM_FILES%\QuickDownloadService\conf\data2.tmp
%PROGRAM_FILES%\QuickDownloadService\conf\data2.cfg
%PROGRAM_FILES%\QuickDownloadService\is-VR03L.tmp
%PROGRAM_FILES%\QuickDownloadService\is-SFHA1.tmp
%PROGRAM_FILES%\QuickDownloadService\is-686H5.tmp
%TEMP%\is-UTU3U.tmp\<Имя вируса>.tmp
%TEMP%\is-GHQ4R.tmp\_isetup\_shfoldr.dll
%PROGRAM_FILES%\QuickDownloadService\is-04POE.tmp
%PROGRAM_FILES%\QuickDownloadService\is-MCKP1.tmp
%PROGRAM_FILES%\QuickDownloadService\is-AM9DO.tmp
%PROGRAM_FILES%\QuickDownloadService\is-685S5.tmp
%PROGRAM_FILES%\QuickDownloadService\is-QC3AD.tmp
<Текущая директория>\is-FSOLI.tmp
<Текущая директория>\is-1C3EF.tmp
%PROGRAM_FILES%\QuickDownloadService\is-O4LUA.tmp