Trojan.Win32.MEREDROP.AA

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Löscht Dateien, so dass Programme und Anwendungen nicht ordnungsgemäß ausgeführt werden.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

Fügt die folgenden Prozesse hinzu:

• "%System Root%\Program Files\Internet Explorer\iexplore.exe" http://www.{BLOCKED}n.com
• iexplore http://www.{BLOCKED}n.com
• reg delete "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /f
• reg add "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d "http://www.{BLOCKED}n.com" /f
• "%Program Files%\Internet Explorer\IEXPLORE.EXE" SCODEF:2624 CREDAT:275457 /prefetch:2

Erstellt die folgenden Ordner:

• %Application Data%\Microsoft\Windows\DNTException
• %Application Data%\Microsoft\Windows\PrivacIE
• %Application Data%\Microsoft\Windows\IECompatCache
• %AppDataLocal%\Microsoft\Internet Explorer\DomainSuggestions
• %AppDataLocal%\Microsoft\Internet Explorer\Recovery\High\Active
• %Application Data%\Microsoft\Windows\IECompatUACache

(Hinweis: %Application Data% ist der Ordner 'Anwendungsdaten' für den aktuellen Benutzer, normalerweise C:\Windows\Profile\{Benutzername}\Anwendungsdaten unter Windows 98 und ME, C:\WINNT\Profile\{Benutzername}\Anwendungsdaten unter Windows NT, C:\Dokumente und Einstellungen\{Benutzername}\Lokale Einstellungen\Anwendungsdaten unter Windows 2000(32-bit), XP und Server 2003(32-bit) und C:\Users\{Benutzername}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) und 10(64-bit).)

Andere Systemänderungen

Löscht die folgenden Dateien:

• %AppDataLocal%Low\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Einschleusungsroutine

Schleust die folgenden Dateien ein:

• %AppDataLocal%\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{45B3189E-F645-11E9-8694-005056BC7592}.dat
• %AppDataLocal%\Microsoft\Internet Explorer\Recovery\High\Active\{4BBE66C0-F645-11E9-8694-005056BC7592}.dat
• %AppDataLocal%\Microsoft\Internet Explorer\DomainSuggestions\en-US.6
• %Favorites%\xe2\x95\xa8\xe2\x96\x91\xe2\x95\xa2\xc2\xb1\xe2\x94\x90\xe2\x95\x92\xe2\x95\x9d\xce\xa3.url
• %AppDataLocal%\Microsoft\Internet Explorer\DOMStore\3UYAQU1F\www.ipvecn[1].xml
• %AppDataLocal%\Microsoft\Internet Explorer\MSIMGSIZ.DAT

Andere Details

It connects to the following possibly malicious URL:

• http://www.{BLOCKED}n.com
• http://www.{BLOCKED}n.com/template/kbe/css/icomoon.css
• http://www.{BLOCKED}n.com/template/kbe/css/animate.css
• http://www.{BLOCKED}n.com/template/kbe/css/bootstrap.css
• http://www.{BLOCKED}n.com/template/kbe/css/simple-line-icons.css
• http://www.{BLOCKED}n.com/template/kbe/css/owl.carousel.min.css
• http://www.{BLOCKED}n.com/template/kbe/css/owl.theme.default.min.css
• http://www.{BLOCKED}n.com/template/kbe/css/style.css
• http://www.{BLOCKED}n.com/template/kbe/js/modernizr-2.6.2.min.js
• http://www.{BLOCKED}n.com/{random path}
• http://www.{BLOCKED}n.com/template/kbe/js/jquery.min.js
• http://www.{BLOCKED}n.com/template/kbe/js/jquery.easing.1.3.js
• http://www.{BLOCKED}n.com/template/kbe/js/bootstrap.min.js
• http://www.{BLOCKED}n.com/template/kbe/js/jquery.waypoints.min.js
• http://www.{BLOCKED}n.com/template/kbe/js/jquery.stellar.min.js
• http://www.{BLOCKED}n.com/template/kbe/js/owl.carousel.min.js
• http://www.{BLOCKED}n.com/template/kbe/js/jquery.countTo.js
• http://www.{BLOCKED}n.com/template/kbe/js/main.js
• http://www.{BLOCKED}n.com/c.js
• http://www.{BLOCKED}n.com/shuju.min.js
• http://www.{BLOCKED}n.com/template/kbe/images/person2.jpg
• http://www.{BLOCKED}n.com/template/kbe/images/person3.jpg
• http://www.{BLOCKED}n.com/template/kbe/images/person4.jpg
• http://www.{BLOCKED}n.com/template/kbe/images/logo1.png
• http://www.{BLOCKED}n.com/template/kbe/images/logo2.png
• http://www.{BLOCKED}n.com/template/kbe/images/logo3.png
• http://www.{BLOCKED}n.com/template/kbe/images/logo4.png
• http://www.{BLOCKED}n.com/template/kbe/images/logo5.png
• http://www.{BLOCKED}n.com/template/kbe/fonts/icomoon/icomoon.eot?qtatmt
• http://www.{BLOCKED}n.com/template/kbe/fonts/icomoon/icomoon.eot?srf3rx
• http://www.{BLOCKED}n.com/{random path}?
• http://www.{BLOCKED}n.com/images/full_image_3.jpg
• http://www.{BLOCKED}n.com/images/full_image_5.jpg
• http://www.{BLOCKED}n.com/images/project-1.jpg
• http://www.{BLOCKED}n.com/images/project-2.jpg
• http://www.{BLOCKED}n.com/images/project-5.jpg
• http://www.{BLOCKED}n.com/images/project-9.jpg
• http://www.{BLOCKED}n.com/images/project-4.jpg
• http://www.{BLOCKED}n.com/images/project-3.jpg
• http://www.{BLOCKED}n.com/images/project-10.jpg
• http://www.{BLOCKED}n.com/images/project-11.jpg
• http://www.{BLOCKED}n.com/images/project-7.jpg
• http://www.{BLOCKED}n.com/images/project-6.jpg
• http://www.{BLOCKED}n.com/images/project-8.jpg
• http://www.{BLOCKED}n.com/images/project-12.jpg
• http://www.{BLOCKED}n.com/images/full_image_4.jpg
• http://www.{BLOCKED}w.com
• http://www.{BLOCKED}w.com/static/css/base.css
• http://www.{BLOCKED}w.com/static/css/button.css
• http://www.{BLOCKED}w.com/static/picture/love-logo.png
• http://www.{BLOCKED}w.com/static/picture/lovebet.png
• http://www.{BLOCKED}w.com/static/picture/love-zz.png
• http://www.{BLOCKED}w.com/bj.jpg
• http://ia.{BLOCKED}1.la/go1?{random characters}
• http://push.{BLOCKED}ang.baidu.com/push.js
• http://www.{BLOCKED}n.com/favicon.ico
• http://api.{BLOCKED}e.baidu.com/s.gif?l=http://www.ipvecn.com
• http://api.{BLOCKED}g.com
• http://www.{BLOCKED}g.com
• http://js.{BLOCKED}s.51.la
• http://hm.{BLOCKED}u.com
• http://sqm.{BLOCKED}try.microsoft.com
• http://ieonline.{BLOCKED}oft.com