Trojan.KeyLogger.18149

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'DianDian' = '%PROGRAM_FILES%\dict.cn\DianDian.exe'

Вредоносные функции:

Создает и запускает на исполнение:

%PROGRAM_FILES%\dict.cn\Init.exe -autorunon
%PROGRAM_FILES%\dict.cn\DianDian.exe
%TEMP%\is-1O8MH.tmp\<Имя вируса>.tmp /SL5="$30092,735860,64000,<Полный путь к вирусу>"
%PROGRAM_FILES%\dict.cn\Init.exe -large

Устанавливает процедуры перхвата сообщений

о нажатии клавиш клавиатуры:

Библиотека-обработчик для всех процессов: %PROGRAM_FILES%\dict.cn\Watch.dll

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\dict.cn\image\is-B2HFO.tmp
%PROGRAM_FILES%\dict.cn\image\is-TFK97.tmp
%PROGRAM_FILES%\dict.cn\image\is-OCFVM.tmp
%PROGRAM_FILES%\dict.cn\is-P8C45.tmp
%PROGRAM_FILES%\dict.cn\is-PEERL.tmp
%PROGRAM_FILES%\dict.cn\image\is-U16A6.tmp
%PROGRAM_FILES%\dict.cn\image\is-J675U.tmp
%PROGRAM_FILES%\dict.cn\image\is-4CVPK.tmp
%PROGRAM_FILES%\dict.cn\image\is-524CB.tmp
%PROGRAM_FILES%\dict.cn\image\is-H2SA1.tmp
%ALLUSERSPROFILE%\Start Menu\Programs\єЈґКµдµд\єЈґКµдµд.lnk
%PROGRAM_FILES%\dict.cn\data\data.ddb
%PROGRAM_FILES%\dict.cn\data\data.ddb-journal
%PROGRAM_FILES%\dict.cn\data\ec_.dict
%PROGRAM_FILES%\dict.cn\data\ce_.dict
%ALLUSERSPROFILE%\Desktop\єЈґКµдµд.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\єЈґКµдµд\Р¶ФШ єЈґКµдµд.lnk
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\єЈґКµдµд.lnk
%PROGRAM_FILES%\dict.cn\launch.dat
%PROGRAM_FILES%\dict.cn\unins000.dat
%PROGRAM_FILES%\dict.cn\is-VB3FK.tmp
%PROGRAM_FILES%\dict.cn\is-C2N68.tmp
%PROGRAM_FILES%\dict.cn\is-KBJ8O.tmp
%PROGRAM_FILES%\dict.cn\is-ENSEI.tmp
%PROGRAM_FILES%\dict.cn\is-5H5PM.tmp
%TEMP%\is-CJS9J.tmp\_isetup\_RegDLL.tmp
%TEMP%\is-1O8MH.tmp\<Имя вируса>.tmp
%TEMP%\is-CJS9J.tmp\_isetup\_shfoldr.dll
%PROGRAM_FILES%\dict.cn\is-TB0LD.tmp
%PROGRAM_FILES%\dict.cn\is-TBJVM.tmp
%PROGRAM_FILES%\dict.cn\is-RNNOA.tmp
%PROGRAM_FILES%\dict.cn\html\is-8G70M.tmp
%PROGRAM_FILES%\dict.cn\html\is-E4G5M.tmp
%PROGRAM_FILES%\dict.cn\html\is-ITU0S.tmp
%PROGRAM_FILES%\dict.cn\html\is-VANIU.tmp
%PROGRAM_FILES%\dict.cn\html\is-Q3H00.tmp
%PROGRAM_FILES%\dict.cn\is-4AJ1H.tmp
%PROGRAM_FILES%\dict.cn\is-MNQFA.tmp
%PROGRAM_FILES%\dict.cn\html\is-7BCOQ.tmp
%PROGRAM_FILES%\dict.cn\html\is-AAJ55.tmp
%PROGRAM_FILES%\dict.cn\html\is-H2FQG.tmp

Удаляет следующие файлы:

%PROGRAM_FILES%\dict.cn\launch.dat
%TEMP%\is-1O8MH.tmp\<Имя вируса>.tmp
%PROGRAM_FILES%\dict.cn\data\data.ddb-journal
%TEMP%\is-CJS9J.tmp\_isetup\_RegDLL.tmp
%TEMP%\is-CJS9J.tmp\_isetup\_shfoldr.dll
%PROGRAM_FILES%\dict.cn\Init.exe

Перемещает следующие файлы:

%PROGRAM_FILES%\dict.cn\image\is-U16A6.tmp в %PROGRAM_FILES%\dict.cn\image\capture.ani
%PROGRAM_FILES%\dict.cn\image\is-4CVPK.tmp в %PROGRAM_FILES%\dict.cn\image\dictLogo.png
%PROGRAM_FILES%\dict.cn\image\is-H2SA1.tmp в %PROGRAM_FILES%\dict.cn\image\form.png
%PROGRAM_FILES%\dict.cn\image\is-J675U.tmp в %PROGRAM_FILES%\dict.cn\image\Bee.png
%PROGRAM_FILES%\dict.cn\html\is-ITU0S.tmp в %PROGRAM_FILES%\dict.cn\html\sound.png
%PROGRAM_FILES%\dict.cn\html\is-Q3H00.tmp в %PROGRAM_FILES%\dict.cn\html\star.png
%PROGRAM_FILES%\dict.cn\html\is-VANIU.tmp в %PROGRAM_FILES%\dict.cn\html\welcome.png
%PROGRAM_FILES%\dict.cn\image\is-524CB.tmp в %PROGRAM_FILES%\dict.cn\image\icons.png
%PROGRAM_FILES%\dict.cn\is-P8C45.tmp в %PROGRAM_FILES%\dict.cn\ref.dat
%PROGRAM_FILES%\dict.cn\data\ce_.dict в %PROGRAM_FILES%\dict.cn\data\ce.dict
%PROGRAM_FILES%\dict.cn\data\ec_.dict в %PROGRAM_FILES%\dict.cn\data\ec.dict
%PROGRAM_FILES%\dict.cn\is-PEERL.tmp в %PROGRAM_FILES%\dict.cn\Init.exe
%PROGRAM_FILES%\dict.cn\image\is-TFK97.tmp в %PROGRAM_FILES%\dict.cn\image\main.png
%PROGRAM_FILES%\dict.cn\image\is-B2HFO.tmp в %PROGRAM_FILES%\dict.cn\image\suspend.png
%PROGRAM_FILES%\dict.cn\image\is-OCFVM.tmp в %PROGRAM_FILES%\dict.cn\image\toolbar.png
%PROGRAM_FILES%\dict.cn\is-KBJ8O.tmp в %PROGRAM_FILES%\dict.cn\GetWord.ini
%PROGRAM_FILES%\dict.cn\is-5H5PM.tmp в %PROGRAM_FILES%\dict.cn\GetWordNT.dll
%PROGRAM_FILES%\dict.cn\is-ENSEI.tmp в %PROGRAM_FILES%\dict.cn\ICall.dll
%PROGRAM_FILES%\dict.cn\is-VB3FK.tmp в %PROGRAM_FILES%\dict.cn\UpdateSync.exe
%PROGRAM_FILES%\dict.cn\is-TBJVM.tmp в %PROGRAM_FILES%\dict.cn\unins000.exe
%PROGRAM_FILES%\dict.cn\is-TB0LD.tmp в %PROGRAM_FILES%\dict.cn\DianDian.exe
%PROGRAM_FILES%\dict.cn\is-C2N68.tmp в %PROGRAM_FILES%\dict.cn\Watch.dll
%PROGRAM_FILES%\dict.cn\is-RNNOA.tmp в %PROGRAM_FILES%\dict.cn\KeyboardHook.dll
%PROGRAM_FILES%\dict.cn\html\is-AAJ55.tmp в %PROGRAM_FILES%\dict.cn\html\main.css
%PROGRAM_FILES%\dict.cn\html\is-E4G5M.tmp в %PROGRAM_FILES%\dict.cn\html\main.js
%PROGRAM_FILES%\dict.cn\html\is-8G70M.tmp в %PROGRAM_FILES%\dict.cn\html\small.png
%PROGRAM_FILES%\dict.cn\html\is-H2FQG.tmp в %PROGRAM_FILES%\dict.cn\html\loading.gif
%PROGRAM_FILES%\dict.cn\is-MNQFA.tmp в %PROGRAM_FILES%\dict.cn\License.dat
%PROGRAM_FILES%\dict.cn\is-4AJ1H.tmp в %PROGRAM_FILES%\dict.cn\MouseHook.dll
%PROGRAM_FILES%\dict.cn\html\is-7BCOQ.tmp в %PROGRAM_FILES%\dict.cn\html\add.png