Trojan.KeyLogger.26551

Technical Information

Malicious functions:

Creates and executes the following:

'<Current directory>\DNF_ST.exe'

Installs hooks to intercept notifications

on keystrokes:

Handler for all processes: <Current directory>\cfgdll.dll

Modifies file system :

Creates the following files:

<Current directory>\Нјїв\ё±±ѕ_К§ВдµДЙсµо_К§ВдЙсµоµДШ¬ГО.bmp
<Current directory>\Нјїв\ё±±ѕ_УАєгГОѕі_Б¦ЛщДЬј°µДКВ.bmp
<Current directory>\Нјїв\ё±±ѕ_УАєгГОѕі_ГОЦРµДєф»Ѕ.bmp
<Current directory>\Нјїв\ё±±ѕ_ДєЙ«Ц®іЗ_ДєЙ«Ц®іЗµДШ¬ГО.bmp
<Current directory>\Нјїв\ё±±ѕ_ј«№в»Гѕі_ј«№в»Гѕі.bmp
<Current directory>\Нјїв\±јЕЬ.bmp
<Current directory>\Нјїв\ё±±ѕ_ёсАјЦ®»р_ѕ«БйГЗµДѕцТй.bmp
<Current directory>\Нјїв\З©µЅ±јЕЬ.bmp
<Current directory>\Нјїв\ИООсµг»ч.bmp
<Current directory>\Нјїв\ё±±ѕ_ОБТЯЦ®Фґ_Гс±ш¶Уі¤єШјУЛ№.bmp
<Current directory>\Нјїв\їХјјДЬАё.bmp
<Current directory>\Нјїв\Ѕы±Х2.bmp
<Current directory>\Нјїв\Ѕы±Х3.bmp
<Current directory>\Нјїв\Ѕы±Х.bmp
<Current directory>\Нјїв\ё±±ѕ_ј«№в»Гѕі_ИьАцСЗµДИҐПт.bmp
<Current directory>\Нјїв\Д§·ЁК¦(Е®)_101.bmp
<Current directory>\Нјїв\ё±±ѕ_·иїсµДјАµд_ЎѕёцРФјјДЬЎїЕСНЅСЗ¶Ў°НµВ.bmp
<Current directory>\Нјїв\єПіЙ·вУЎЧ°±ёA2.bmp
<Current directory>\Нјїв\Д§·ЁК¦(ДР)_102.bmp
<Current directory>\Нјїв\ёс¶·јТ(Е®)_101.bmp
<Current directory>\Нјїв\ёс¶·јТ(Е®)_102.bmp
<Current directory>\Нјїв\Д§·ЁК¦(ДР)_101.bmp
<Current directory>\Нјїв\№ЕіЗТЕОп.bmp
<Current directory>\Нјїв\МмбЎѕЮКЮµДБЫЖ¬.bmp
<Current directory>\Нјїв\ё±±ѕ_±щґМНҐФє_±щґМНҐФєµДШ¬ГО.bmp
<Current directory>\Нјїв\ёЎУОКЇФКЇ.bmp
<Current directory>\Нјїв\єПіЙ·вУЎЧ°±ёA.bmp
<Current directory>\Нјїв\єПіЙ·вУЎЧ°±ёB2.bmp
<Current directory>\Нјїв\єПіЙ·вУЎЧ°±ёB.bmp
<Current directory>\Нјїв\ИООсµг»ч2.bmp
<Current directory>\ЕдЦГ\ё±±ѕРЕПў.ini
<Current directory>\plugin\dm.dll
<Current directory>\ЕдЦГ\NPCРЕПў.ini
<Current directory>\Нјїв\µЅNPCЙМµк№єОпЛµГч.jpg
<Current directory>\Нјїв\ТмЅзµШПВіЗ№ҐВФЅМіМїЄ№ШїЄ.bmp
<Current directory>\Нјїв\УВХЯЙијЖНј.bmp
C:\s_game\plug_in\dm.dll
<Current directory>\ЕдЦГ\ИООсРЕПў.txt
<Current directory>\ЕдЦГ\МШКвИООсРЕПў.txt
<Current directory>\ЕдЦГ\Ц°ТµРЕПў.ini
<Current directory>\ЧЦїв\ИООсРЕПў.txt
<Current directory>\ЧЦїв\МШКвИООсРЕПў.txt
<Current directory>\ЧЦїв\NPCРЕПў.txt
<Current directory>\ЕдЦГ\ИООсРЕПў.ini
<Current directory>\Нјїв\ТмЅзµШПВіЗ№ҐВФЅМіМїЄ№Ш.bmp
<Current directory>\Нјїв\ґґЅЁЅЗЙ«3.bmp
<Current directory>\Нјїв\ґґЅЁЅЗЙ«2.bmp
<Current directory>\Нјїв\ё±±ѕ_УДЪ¤јаУь_ФЩґОПаУцµДЙЩЕ®.bmp
<Current directory>\Нјїв\РЮБ¶ЅзРВРЗ.bmp
<Current directory>\Нјїв\ё±±ѕ_±щѕ§ЙБЦ_їбє®АґП®.bmp
<Current directory>\Нјїв\ё±±ѕ_Л®ѕ§їуВц_µЫ№ъѕьµДП®»ч.bmp
<Current directory>\Нјїв\УВХЯ№йАґ.bmp
<Current directory>\Нјїв\±щЦ®ЛюАївніНЕФ±.bmp
<Current directory>\Нјїв\БТСЧЦ®КЦІЁ¶ыА.bmp
<Current directory>\Нјїв\ЛАНцЦ®ДЙМШСЗ.bmp
<Current directory>\Нјїв\ХЩ»ЅЙіУ°±ґАыМШ.bmp
<Current directory>\Нјїв\УЕ»ЭИЇАсєРРЎНј±к.bmp
<Current directory>\Нјїв\XНЛіц.bmp
<Current directory>\Нјїв\БчАЛУ¶±шДщФъµВ.bmp
<Current directory>\Нјїв\ёс¶·јТ(ДР)_102.bmp
<Current directory>\plugin\MYPLUGINUI.DLL
<Current directory>\plugin\BKGND.DLL
<Current directory>\plugin\JK.DLL
<Current directory>\plugin\WINDOW.DLL
%TEMP%\plugin.zip
<Current directory>\plugin\GETSYSINFO.DLL
<Current directory>\plugin\MSG.DLL
%TEMP%\mymacro.zip
<Current directory>\cfgdll.dll
<Current directory>\ShieldModule.dat
<Current directory>\plugin\JDYANSWER.DLL
<Current directory>\plugin\FILE.DLL
<Current directory>\plugin\MEDIA.DLL
<Current directory>\plugin\SYS.DLL
%TEMP%\2.tmp
<Current directory>\3.bat
<Current directory>\开机延迟启动脚本_____________________请直接把我丢开机启动项里.bat
<Current directory>\rsaenh.dll
<Current directory>\1.bat
<Current directory>\DNF_ST.exe
<Current directory>\plugin\DAMA2QMPLUGIN.DLL
<Current directory>\plugin\REMOTEANSWER.DLL
<Current directory>\SD003.dat
<Current directory>\SD004.dat
%TEMP%\1.tmp
<Current directory>\SD000.dat
<Current directory>\140218_x64.sys
<Current directory>\140321.sys
<Current directory>\runner.dat
%APPDATA%\mymacro\qdisp.dll
<Current directory>\Нјїв\ЙсЗ№КЦ(Е®)_102.bmp
<Current directory>\Нјїв\ЙсЗ№КЦ(ДР)_101.bmp
<Current directory>\Нјїв\ЙсЗ№КЦ(ДР)_102.bmp
<Current directory>\Нјїв\РДТвАсєР2.bmp
<Current directory>\Нјїв\Ѕ±Аш2.bmp
<Current directory>\Нјїв\јјДЬµИј¶Lv14.bmp
<Current directory>\Нјїв\РДТвЧ°°зАсєР.bmp
<Current directory>\Нјїв\№нЅЈКї(Е®)_102.bmp
<Current directory>\Нјїв\Д§·ЁК¦(Е®)_102.bmp
<Current directory>\Нјїв\ёс¶·јТ(ДР)_101.bmp
<Current directory>\Нјїв\№нЅЈКї(Е®)_101.bmp
<Current directory>\Нјїв\ЙсЗ№КЦ(Е®)_101.bmp
<Current directory>\Нјїв\№нЅЈКї(ДР)_101.bmp
<Current directory>\Нјїв\№нЅЈКї(ДР)_102.bmp
<Current directory>\Нјїв\јјДЬµИј¶Lv13.bmp
%APPDATA%\qmacro\shield\SD003.dat
%APPDATA%\qmacro\shield\SD004.dat
%APPDATA%\qmacro\shield\Shield.ini
%APPDATA%\qmacro\shield\SD002.dat
%TEMP%\b8d3.tmp
%APPDATA%\qmacro\shield\SD000.dat
%APPDATA%\qmacro\shield\SD001.dat
<Current directory>\Нјїв\ё±±ѕ_GBLЕ®Йсµо_№оТмµДGBLЕ®Йсµо.bmp
<Current directory>\Нјїв\іЙјЁ2.bmp
<Current directory>\Нјїв\ґґЅЁЅЗЙ«.bmp
<Current directory>\plugin\FILE.ini
<Current directory>\DNF_ST.ini
<Current directory>\timer_icon.ico
<Current directory>\uservar.ini

Deletes the following files:

<Current directory>\timer_icon.ico
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\Q03833[1].htm
<Current directory>\ShieldModule.dat
%TEMP%\plugin.zip
%TEMP%\mymacro.zip

Network activity:

Connects to:

'c.###huoa.com':80

TCP:

HTTP GET requests:

c.###huoa.com/banner/Q03833.htm

UDP:

DNS ASK c.###huoa.com

Miscellaneous:

Searches for the following windows:

ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: 'EDIT' WindowName: ''

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial