Trojan.DownLoader37.59016

Technical Information

Modifies file system

Creates the following files

%APPDATA%\macromedia\flash player\macromedia.com\support\flashplayer\sys\#yandex.st\settings.sxx
%APPDATA%\macromedia\flash player\macromedia.com\support\flashplayer\sys\settings.sxx
%APPDATA%\macromedia\flash player\#sharedobjects\gr8by44n\yandex.st\swf\videoplayer\13_102\videoplayer.swf\yalogger.sxx
%APPDATA%\macromedia\flash player\#sharedobjects\gr8by44n\yandex.st\swf\videoplayer\13_102\videoplayer.swf\videoplayer.sxx

Deletes the following files

%APPDATA%\macromedia\flash player\macromedia.com\support\flashplayer\sys\#yandex.st\settings.sol

Moves the following files

from %APPDATA%\macromedia\flash player\macromedia.com\support\flashplayer\sys\#yandex.st\settings.sxx to %APPDATA%\macromedia\flash player\macromedia.com\support\flashplayer\sys\#yandex.st\settings.sol
from %APPDATA%\macromedia\flash player\#sharedobjects\gr8by44n\yandex.st\swf\videoplayer\13_102\videoplayer.swf\yalogger.sxx to %APPDATA%\macromedia\flash player\#sharedobjects\gr8by44n\yandex.st\swf\videoplayer\13_102\videoplayer.swf\yalogger.sol
from %APPDATA%\macromedia\flash player\#sharedobjects\gr8by44n\yandex.st\swf\videoplayer\13_102\videoplayer.swf\videoplayer.sxx to %APPDATA%\macromedia\flash player\#sharedobjects\gr8by44n\yandex.st\swf\videoplayer\13_102\videoplayer.swf\videoplayer.sol

Substitutes the following files

%APPDATA%\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol
%APPDATA%\macromedia\flash player\macromedia.com\support\flashplayer\sys\#yandex.st\settings.sxx
%APPDATA%\macromedia\flash player\macromedia.com\support\flashplayer\sys\#yandex.st\settings.sol

Network activity

Connects to

'co####r.yadro.ru':80
'clck.yandex.ru':445
'tn###ounter.ru':80
'co####r.24log.ru':443
'co####r.24log.ru':80
'c.###mir.net':80
'dm#.###italtarget.ru':443
'go##ats.ru':80
'hi###.hotlog.ru':80
'op###tat.net':80
'fp######ad2.macromedia.com':80
'ya##ex.st':80
'tn###ounter.ru':443
'ki###oisk.ru':443
'ki###oisk.ru':80
'st##evu.com':80
'kr####.rambler.ru':443
'to######mages.rambler.ru':80
'st####.rapidssl.com':80
'co####r.rambler.ru':443
'co####r.rambler.ru':80
'microsoft.com':80
's3#.#coz.net':443
'co####r.yadro.ru':443
's3#.#coz.net':80
'static.video.yandex.ru':80
'st####.video.yandex.net':80

TCP

HTTP GET requests

http://co####r.yadro.ru/hit;ucoznet?r;#####################################################################
http://st####.video.yandex.net/get/zalito1/cgfbf2zt2t.214/0h.xml?nc###################
http://co####r.24log.ru/counter?id################################################################################################
http://co####r.24log.ru/buttons/24/bg24-7_2.gif
http://ya##ex.st/swf/videoplayer/13_102/videoplayer.swf?ve############
http://co####r.24log.ru/buttons/24/bg24-7_3.gif
http://s3#.#coz.net/.s/img/icon/social/ya.svg
http://hi###.hotlog.ru/cgi-bin/hotlog/count?0.#####################################################################################################################
http://s3#.#coz.net/.s/img/icon/social/tw.svg
http://s3#.#coz.net/.s/img/icon/social/gp.svg
http://s3#.#coz.net/.s/img/icon/social/fb.svg
http://s3#.#coz.net/.s/img/icon/social/ok.svg
http://s3#.#coz.net/.s/img/icon/social/vk.svg
http://s3#.#coz.net/.s/img/icon/social/u.svg
http://s3#.#coz.net/img/ma/refresh.gif
http://fi####inema.ucoz.ru/tags/swfobject.js
http://s3#.#coz.net/.s/img/fr/g.gif
http://fi####inema.ucoz.ru/secure/?k=##################################################
http://fi####inema.ucoz.ru/rtr/1-1
http://fi####inema.ucoz.ru/logo/new.gif
http://s3#.#coz.net/src/social.css
http://s3#.#coz.net/cgi/uutils.fcg?a=######################################
http://s3#.#coz.net/src/socCom.js
http://s3#.#coz.net/src/socCom.css
http://s3#.#coz.net/src/uwnd.js?2
http://s3#.#coz.net/src/ulightbox/ulightbox.css
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
http://s3#.#coz.net/src/jquery-1.7.2.js
http://fi####inema.ucoz.ru/_st/my.css
http://s3#.#coz.net/src/layer1.css
http://op###tat.net/cnt?ci#######################################################################################################################################################################...
http://st####.video.yandex.net/get/zalito1/cgfbf2zt2t.214/0h.xml?nc####################