Trojan.DownLoader6.30561

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\default.job
%WINDIR%\Tasks\default.exe

Вредоносные функции:

Запускает на исполнение:

<SYSTEM32>\wbem\wmic.exe /failfast:on /append:"%PROGRAM_FILES%\nt.log" SHARE get /value
<SYSTEM32>\wbem\wmic.exe /failfast:on /append:"%PROGRAM_FILES%\nt.log" STARTUP get /value
<SYSTEM32>\wbem\wmic.exe /failfast:on /append:"%PROGRAM_FILES%\nt.log" PROCESS get /value
<SYSTEM32>\wbem\wmic.exe /failfast:on /append:"%PROGRAM_FILES%\nt.log" USERACCOUNT get /value
<SYSTEM32>\wbem\wmic.exe /failfast:on /append:"%PROGRAM_FILES%\nt.log" LOGICALDISK get /value
<SYSTEM32>\wbem\wmic.exe /failfast:on /append:"%PROGRAM_FILES%\nt.log" CDROM get /value
<SYSTEM32>\wbem\wmic.exe /failfast:on /append:"%PROGRAM_FILES%\nt.log" PRINTERCONFIG get /value
<SYSTEM32>\wbem\wmic.exe /failfast:on /append:"%PROGRAM_FILES%\nt.log" SERVICE get /value
<SYSTEM32>\bootcfg.exe
<SYSTEM32>\ipconfig.exe /ALL
<SYSTEM32>\more.com
<SYSTEM32>\reg.exe QUERY HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /s
<SYSTEM32>\wbem\wmic.exe /failfast:on /append:"%PROGRAM_FILES%\nt.log" SYSDRIVER get /value
<SYSTEM32>\wbem\wmic.exe /failfast:on /append:"%PROGRAM_FILES%\nt.log" PAGEFILE get /value
<SYSTEM32>\systeminfo.exe
<SYSTEM32>\wbem\wmic.exe /failfast:on /append:"%PROGRAM_FILES%\nt.log" SOUNDDEV get /value
<SYSTEM32>\wbem\wmic.exe /failfast:on /append:"%PROGRAM_FILES%\nt.log" /namespace:\\root\SecurityCenter path AntiVirusProduct get /value
<SYSTEM32>\wbem\wmic.exe /failfast:on /append:"%PROGRAM_FILES%\nt.log" /namespace:\\root\SecurityCenter path AntiSpywareProduct get /value
<SYSTEM32>\wbem\wmic.exe /failfast:on /append:"%PROGRAM_FILES%\nt.log" /namespace:\\root\SecurityCenter path FirewallProduct get /value
<SYSTEM32>\cmd.exe /c ""%PROGRAM_FILES%\nt.cmd" "%PROGRAM_FILES%\nt.log" "%PROGRAM_FILES%\Microsoft Games\Windows:i1""
<SYSTEM32>\schtasks.exe /create /TN default /TR "\"%WINDIR%\Tasks\default.exe\"" /SC ONSTART /ru ""
<SYSTEM32>\svchost.exe -k LocalUser
<SYSTEM32>\lsass.exe -l dump
<SYSTEM32>\wbem\wmic.exe /failfast:on /append:"%PROGRAM_FILES%\nt.log" OS get /value
<SYSTEM32>\wbem\wmic.exe /failfast:on /append:"%PROGRAM_FILES%\nt.log" BASEBOARD get /value
<SYSTEM32>\wbem\wmic.exe /failfast:on /append:"%PROGRAM_FILES%\nt.log" BIOS get /value
<SYSTEM32>\wbem\wmic.exe /failfast:on /append:"%PROGRAM_FILES%\nt.log" CPU get /value
<SYSTEM32>\wbem\wmic.exe /failfast:on /append:"%PROGRAM_FILES%\nt.log" DESKTOPMONITOR get /value
<SYSTEM32>\wbem\wmic.exe /failfast:on /append:"%PROGRAM_FILES%\nt.log" TIMEZONE get /value
<SYSTEM32>\wbem\wmic.exe /failfast:on /append:"%PROGRAM_FILES%\nt.log" LOGON get /value
<SYSTEM32>\wbem\wmic.exe /failfast:on /append:"%PROGRAM_FILES%\nt.log" DESKTOP get /value

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\Microsoft Games\Windows:s2pc.3
%PROGRAM_FILES%\Microsoft Games\Windows:s2pc.4
%PROGRAM_FILES%\Microsoft Games\Windows:i1
<SYSTEM32>\wbem\AutoRecover\23BDE61F1F4FACE17E9B0C01F2A1FD9B.mof
<SYSTEM32>\wbem\Logs\WMIC.LOG
%PROGRAM_FILES%\Microsoft Games\Windows:2120627121515
%PROGRAM_FILES%\Microsoft Games\Windows:00
%PROGRAM_FILES%\Microsoft Games\Windows:s2pc.6
%PROGRAM_FILES%\Microsoft Games\Windows:s2pc.5
%PROGRAM_FILES%\Microsoft Games\Windows:s2pc.7
%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\ec702f375e1b12d218f67ab9ef19ca23_23ef5514-3059-436f-a4a7-4cefaab20eb1
%PROGRAM_FILES%\nt.cmd
%APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\Preferred
%APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\abade1bd-2075-4f4a-9928-19b7c01980bb
<SYSTEM32>\wbem\AutoRecover\C8463ECBE33BC240263A0B094E46D510.mof
%TEMP%\tmp3.tmp
%TEMP%\tmp2.tmp
%PROGRAM_FILES%\nt.log
%TEMP%\tmp1.tmp

Присваивает атрибут 'скрытый' для следующих файлов:

%PROGRAM_FILES%\Microsoft Games\Windows:s2pc.5
%PROGRAM_FILES%\Microsoft Games\Windows:s2pc.6
%PROGRAM_FILES%\Microsoft Games\Windows:s2pc.7
%WINDIR%\Tasks\default.job
%PROGRAM_FILES%\Microsoft Games\Windows:s2pc.3
%PROGRAM_FILES%\Microsoft Games\Windows:s2pc.4

Удаляет следующие файлы:

%PROGRAM_FILES%\Microsoft Games\Windows:s2pc.6
%PROGRAM_FILES%\Microsoft Games\Windows:s2pc.5
%PROGRAM_FILES%\Microsoft Games\Windows:s2pc.4
%PROGRAM_FILES%\Microsoft Games\Windows:2120627121515
%PROGRAM_FILES%\Microsoft Games\Windows:i1
%PROGRAM_FILES%\Microsoft Games\Windows:s2pc.7
%PROGRAM_FILES%\Microsoft Games\Windows:s2pc.3
%TEMP%\tmp2.tmp
%TEMP%\tmp1.tmp
%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\ec702f375e1b12d218f67ab9ef19ca23_23ef5514-3059-436f-a4a7-4cefaab20eb1
%PROGRAM_FILES%\nt.cmd
%PROGRAM_FILES%\nt.log
%TEMP%\tmp3.tmp