Trojan.AVKill.34985

Trojan.AVKill.34985

Добавлен в вирусную базу Dr.Web: 2014-02-05

Описание добавлено: 2014-02-07

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'xsxwaak3iq1' = 'C:\iexplore.bat'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'xyedvhew0in' = 'C:\runshut.bat'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '1iownnp4eja' = '<Current directory>\<Virus name>t5xcfbm4bxhzrdhiklhotjzfmvf12fw5x.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'aosbw5uuq01' = '<Current directory>\<Virus name>ec1opx2wqzirlk2lf125fv.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '41s2rfs5imn' = 'C:\iexplore.bat'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'csww5whyids' = '<Current directory>\<Virus name>q4gbkjkwy5ar5qvulndeev.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '3yigwd3gapz' = 'C:\iexplore.bat'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'rqd1j4x2b00' = '<Current directory>\<Virus name>gqt52gp15qj.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'kjl5tzhaucb' = 'C:\iexplore.bat'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'xmoiimqdv5z' = 'C:\iexplore.bat'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '2montqfhf01' = '<Current directory>\<Virus name>t5xcfbm4bxhlpa2qlbj5so.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'gwoorglrqgv' = '<Current directory>\<Virus name>t5xcfbm4bxhevs03pmnupp.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'yamxi1krsvz' = '<Current directory>\<Virus name>q4gbkjkwy5akrqgcy5a4ru.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'wg5eociwvmu' = 'C:\iexplore.bat'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '1quvraj41x4' = 'C:\runshut.bat'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'l3of4w0zjz3' = 'C:\runshut.bat'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '30ofuruw1e0' = '<Current directory>\<Virus name>t5xcfbm4bxhwjm2mc5aqjd5w3uhldxm5x.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'fvjmfsn3p3t' = '<Current directory>\<Virus name>wj0shfujw1k.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'xklz5e1qjl0' = 'C:\runshut.bat'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'm31f4myxf3n' = 'C:\iexplore.bat'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'bpwq3hqc2qp' = 'C:\iexplore.bat'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'awovzk1wvqz' = '<Current directory>\<Virus name>t5xcfbm4bxhzrdhiklhotj.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'xxki0kndape' = '<Current directory>\<Virus name>q4gbkjkwy5a.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'uokfrmenuxk' = 'C:\runshut.bat'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '0y24q2dpkpe' = 'C:\runshut.bat'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '2iokwb2ko40' = '<Current directory>\<Virus name>t5xcfbm4bxh.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'wqkyx3uzusa' = 'C:\runshut.bat'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'eykv3pflu54' = 'C:\iexplore.bat'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ach34qbsdtz' = '<Current directory>\<Virus name>ec1opx2wqzi.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ppfmltxpzwm' = 'C:\runshut.bat'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'qd3oja5fdaz' = 'C:\iexplore.bat'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'vk3hrzwaf3s' = 'C:\iexplore.bat'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '5ncfc3ymty5' = 'C:\runshut.bat'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'y0phtk4yeqd' = 'C:\runshut.bat'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'm1xyh42agaq' = 'C:\iexplore.bat'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'aoylrzrlomg' = '<Current directory>\<Virus name>t5xcfbm4bxhwjm2mc5aqjd.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'pkfvy3qa03r' = 'C:\runshut.bat'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '5f1eiyou0qj' = 'C:\runshut.bat'

Malicious functions:

Creates and executes the following:

'<Current directory>\<Virus name>t5xcfbm4bxhwjm2mc5aqjd5w3uhldxm5x.exe'
'<Current directory>\<Virus name>t5xcfbm4bxhzrdhiklhotjzfmvf12fw5x.exe'
'<Current directory>\<Virus name>ec1opx2wqzirlk2lf125fv.exe'
'<Current directory>\<Virus name>q4gbkjkwy5akrqgcy5a4ru.exe'
'<Current directory>\<Virus name>t5xcfbm4bxhlpa2qlbj5so.exe'
'<Current directory>\<Virus name>wj0shfujw1k.exe'
'<Current directory>\<Virus name>gqt52gp15qj.exe'
'<Current directory>\<Virus name>t5xcfbm4bxhzrdhiklhotj.exe'
'<Current directory>\<Virus name>q4gbkjkwy5a.exe'
'<Current directory>\<Virus name>t5xcfbm4bxh.exe'
'<Current directory>\<Virus name>q4gbkjkwy5ar5qvulndeev.exe'
'<Current directory>\<Virus name>t5xcfbm4bxhwjm2mc5aqjd.exe'
'<Current directory>\<Virus name>ec1opx2wqzi.exe'

Executes the following:

'<SYSTEM32>\net1.exe' user %USERNAME% xsq5gxxns4j
'<SYSTEM32>\cmd.exe' /c ""C:\iexplore.bat" "
'<SYSTEM32>\shutdown.exe' /s /t 30

Injects code into

the following user processes:

nod32.exe

Terminates or attempts to terminate

the following system processes:

%WINDIR%\Explorer.EXE

the following user processes:

iexplore.exe
chrome.exe
opera.exe
nod32.exe
skype.exe

Attempts to shut down the Windows operating system.

Modifies file system :

Creates the following files:

<Current directory>\<Virus name>t5xcfbm4bxhzrdhiklhotjzfmvf12fw5x.exe
<Current directory>\<Virus name>t5xcfbm4bxhwjm2mc5aqjd5w3uhldxm5x.exe
<Current directory>\<Virus name>gqt52gp15qj.exe
<Current directory>\<Virus name>ec1opx2wqzirlk2lf125fv.exe
<Current directory>\<Virus name>t5xcfbm4bxhlpa2qlbj5so.exe
<Current directory>\<Virus name>q4gbkjkwy5akrqgcy5a4ru.exe
<Current directory>\<Virus name>wj0shfujw1k.exe
<Current directory>\<Virus name>t5xcfbm4bxhevs03pmnupp.exe
<Current directory>\<Virus name>q4gbkjkwy5ar5qvulndeev.exe
C:\runshut.bat
C:\iexplore.bat
%WINDIR%\createuser.bat
<Current directory>\<Virus name>t5xcfbm4bxh.exe
<Current directory>\<Virus name>ec1opx2wqzi.exe
<Current directory>\<Virus name>t5xcfbm4bxhwjm2mc5aqjd.exe
<Current directory>\<Virus name>q4gbkjkwy5a.exe
<Current directory>\<Virus name>t5xcfbm4bxhzrdhiklhotj.exe

Sets the 'hidden' attribute to the following files:

<Current directory>\<Virus name>t5xcfbm4bxhwjm2mc5aqjd5w3uhldxm5x.exe
<Current directory>\<Virus name>ec1opx2wqzirlk2lf125fv.exe
<Current directory>\<Virus name>t5xcfbm4bxhzrdhiklhotjzfmvf12fw5x.exe
<Current directory>\<Virus name>q4gbkjkwy5akrqgcy5a4ru.exe
<Current directory>\<Virus name>t5xcfbm4bxhlpa2qlbj5so.exe
<Current directory>\<Virus name>wj0shfujw1k.exe
<Current directory>\<Virus name>gqt52gp15qj.exe
<Current directory>\<Virus name>t5xcfbm4bxhzrdhiklhotj.exe
<Current directory>\<Virus name>q4gbkjkwy5a.exe
<Current directory>\<Virus name>t5xcfbm4bxh.exe
<Current directory>\<Virus name>q4gbkjkwy5ar5qvulndeev.exe
<Current directory>\<Virus name>t5xcfbm4bxhwjm2mc5aqjd.exe
<Current directory>\<Virus name>ec1opx2wqzi.exe

Deletes the following files:

<Current directory>\<Virus name>t5xcfbm4bxhevs03pmnupp.exe

Deletes itself.

Miscellaneous:

Searches for the following windows:

ClassName: 'Indicator' WindowName: '(null)'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней