Trojan.DownLoader30.30136

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\Software\Classes\Iress.Document\shell\Open\command] '' = '"%ProgramFiles(x86)%\IRESS Market Technology\Iress\IRESS.EXE" -w:"%1"'

Modifies file system

Creates the following files

%TEMP%\rarsfx0\(ca) default - 1920 x 1080.wsp
%ProgramFiles(x86)%\iress market technology\iress\macros\iress\saxbasic\financial data\fingroup.bas
%ProgramFiles(x86)%\iress market technology\iress\sounds\you are the best.wav
%ProgramFiles(x86)%\iress market technology\iress\macros\iress\saxbasic\dfsiress.bas
%ProgramFiles(x86)%\iress market technology\iress\sounds\schwarzenegger - i'll be back.wav
%ProgramFiles(x86)%\iress market technology\iress\price.dll
%ProgramFiles(x86)%\iress market technology\iress\iress.webserviceslib.dll
%ProgramFiles(x86)%\iress market technology\iress\dbghelp.dll
%ProgramFiles(x86)%\iress market technology\iress\system.windows.controls.datavisualization.toolkit.dll
%ProgramFiles(x86)%\iress market technology\iress\sounds\string.wav
%ProgramFiles(x86)%\iress market technology\iress\macros\iress\c++\datapriceevents.odl
%ProgramFiles(x86)%\iress market technology\iress\defaultprofile\userdata\new starter.wsp
%ProgramFiles(x86)%\iress market technology\iress\defaultprofile\userdata\ems-sa.wsp
%ProgramFiles(x86)%\iress market technology\iress\sbent532.ocx
%ProgramFiles(x86)%\iress market technology\iress\sounds\homer - crap.wav
%ProgramFiles(x86)%\iress market technology\iress\macros\iress\saxbasic\financial data\finitem.bas
%ProgramFiles(x86)%\iress market technology\iress\macros\iress\saxbasic\wlseclst.bas
%ProgramFiles(x86)%\iress market technology\iress\cmdperfcounters_v2.xml
%ProgramFiles(x86)%\iress market technology\iress\images\methodreferenceexpand.jpg
%ProgramFiles(x86)%\iress market technology\iress\perfcounters_v2.xml
%ProgramFiles(x86)%\iress market technology\iress\sounds\burns - excellent.wav
%ProgramFiles(x86)%\iress market technology\iress\macros\iress\c#\datapriceevents\datapriceevents\form1.cs
%ProgramFiles(x86)%\iress market technology\iress\microsoft.expression.interactions.dll
%ProgramFiles(x86)%\iress market technology\iress\charts.dll
%ProgramFiles(x86)%\iress market technology\iress\macros\iress\saxbasic\dfscmd.bas
%ProgramFiles(x86)%\iress market technology\iress\sounds\homer - doh.wav
%ProgramFiles(x86)%\iress market technology\iress\xcpars30.dll
%ProgramFiles(x86)%\iress market technology\iress\iressrtdserver.dll
%ProgramFiles(x86)%\iress market technology\iress\sounds\daffy - ahhah.wav
%ProgramFiles(x86)%\iress market technology\iress\macros\iress\c++\datapriceevents.h
%ProgramFiles(x86)%\iress market technology\iress\defaultprofile\userdata\md-sa.wsp
%ProgramFiles(x86)%\iress market technology\iress\sounds\drum roll.wav
%ProgramFiles(x86)%\iress market technology\iress\macros\iress\c++\dlgproxy.h
%ProgramFiles(x86)%\iress market technology\iress\wpf.dll
%ProgramFiles(x86)%\iress market technology\iress\boost_signals-vc90-mt-1_35.dll
%ProgramFiles(x86)%\iress market technology\iress\sounds\darth wader - the dark side.wav
%ProgramFiles(x86)%\iress market technology\iress\sounds\panic.wav
%ProgramFiles(x86)%\iress market technology\iress\macros\iress\saxbasic\trades\cmycol.cls
%ProgramFiles(x86)%\iress market technology\iress\sbe5_32.dll
%ProgramFiles(x86)%\iress market technology\iress\iress.exe.config
%ProgramFiles(x86)%\iress market technology\iress\macros\iress\saxbasic\dfsoptio.bas
%ProgramFiles(x86)%\iress market technology\iress\macros\iress\c#\datapriceevents\datapriceevents\form1.resx
%ProgramFiles(x86)%\iress market technology\iress\macros\iress\saxbasic\secaccum.bas
%ProgramFiles(x86)%\iress market technology\iress\iressbrowser.exe
%ProgramFiles(x86)%\iress market technology\iress\gmock.dll
%ProgramFiles(x86)%\iress market technology\iress\iresscmn141.dll
%ProgramFiles(x86)%\iress market technology\iress\macros\iress\vb.net\datapriceevents\datapriceevents\form1.resx
%ProgramFiles(x86)%\iress market technology\iress\macros\iress\c++\datapriceevents.sln
%ProgramFiles(x86)%\iress market technology\iress\iressserverapi.dll
%ProgramFiles(x86)%\iress market technology\iress\hhactivex.dll
%ProgramFiles(x86)%\iress market technology\iress\macros\iress\saxbasic\dfstimes.bas
%ProgramFiles(x86)%\iress market technology\iress\macros\iress\saxbasic\trades\ctrade.cls
%ProgramFiles(x86)%\iress market technology\iress\defaultprofile\userdata\sampleworkspace4 (nz 1024x768).wsp
%ProgramFiles(x86)%\iress market technology\iress\sounds\homer - aaaah.wav
%ProgramFiles(x86)%\iress market technology\iress\ifccalc141.dll
%ProgramFiles(x86)%\iress market technology\iress\dscrt30.dll
%ProgramFiles(x86)%\iress market technology\iress\macros\iress\saxbasic\dfstext.bas
%ProgramFiles(x86)%\iress market technology\iress\defaultprofile\userdata\sampleworkspace2 (1024x768).wsp
%ProgramFiles(x86)%\iress market technology\iress\images\methodreferencesortdirectiondown.png
%ProgramFiles(x86)%\iress market technology\iress\macros\iress\c++\stdafx.h
%ProgramFiles(x86)%\iress market technology\iress\macros\iress\saxbasic\trades\cdatatra.cls
%ProgramFiles(x86)%\iress market technology\iress\exceladdins\ddeiress.xla
%ProgramFiles(x86)%\iress market technology\iress\ifcbase141.dll
%ProgramFiles(x86)%\iress market technology\iress\macros\iress\saxbasic\dfsindic.bas
%ProgramFiles(x86)%\iress market technology\iress\macros\iress\c++\datapriceevents.rc
%ProgramFiles(x86)%\iress market technology\iress\macros\iress\saxbasic\setcmds.bas
%ProgramFiles(x86)%\iress market technology\iress\iress.exe
%ProgramFiles(x86)%\iress market technology\iress\iress.pvf
%ProgramFiles(x86)%\iress market technology\iress\iressserverapiregister.bat
%ProgramFiles(x86)%\iress market technology\iress\iressserverapiunregister.bat
%ProgramFiles(x86)%\iress market technology\iress\ngeninstall.bat
%ProgramFiles(x86)%\iress market technology\iress\reservenamespaces.bat
%ProgramFiles(x86)%\iress market technology\iress\unreservenamespaces.bat
%ProgramFiles(x86)%\iress market technology\iress\defaultprofile\userdata\ktaplus.wsp
%ProgramFiles(x86)%\iress market technology\iress\sounds\horn.wav
%ProgramFiles(x86)%\iress market technology\iress\rwuxthemes90.dll
%ProgramFiles(x86)%\iress market technology\iress\indicate.dll
%ProgramFiles(x86)%\iress market technology\iress\screen141.dll
%ProgramFiles(x86)%\iress market technology\iress\images\methodreferencebookmark.png
%ProgramFiles(x86)%\iress market technology\iress\sounds\blip.wav
%ProgramFiles(x86)%\iress market technology\iress\macros\iress\saxbasic\trades\datatrad.bas
%ProgramFiles(x86)%\iress market technology\iress\macros\iress\c++\datapriceeventsdlg.cpp
%ProgramFiles(x86)%\iress market technology\iress\cfx2032.dll
%ProgramFiles(x86)%\iress market technology\iress\option.dll
%ProgramFiles(x86)%\iress market technology\iress\macros\iress\c++\res\datapriceevents.rc2
%ProgramFiles(x86)%\iress market technology\iress\macros\iress\c++\dlgproxy.cpp
%ProgramFiles(x86)%\iress market technology\iress\macros\iress\vb.net\datapriceevents\datapriceevents\form1.vb
%ProgramFiles(x86)%\iress market technology\iress\exceladdins\dfsopval.xla
%ProgramFiles(x86)%\iress market technology\iress\macros\iress\c++\data.cpp
%ProgramFiles(x86)%\iress market technology\iress\sounds\sheep.wav
%ProgramFiles(x86)%\iress market technology\iress\macros\iress\excel\dfsvwap.xls
%ProgramFiles(x86)%\iress market technology\iress\macros\iress\vb.net\datapriceevents\datapriceevents.sln
%ProgramFiles(x86)%\iress market technology\iress\macros\iress\saxbasic\chartind.bas
%ProgramFiles(x86)%\iress market technology\iress\wpfvisifire.gauges.dll
%ProgramFiles(x86)%\iress market technology\iress\iressserverapi.cmd141.dll
%ProgramFiles(x86)%\iress market technology\iress\iress_setup_help.chm
%ProgramFiles(x86)%\iress market technology\iress\macros\iress\c++\dataprice.cpp
%ProgramFiles(x86)%\iress market technology\iress\sounds\homer - i dare you.wav
%ProgramFiles(x86)%\iress market technology\iress\iressserverapi.iress.dll
%ProgramFiles(x86)%\iress market technology\iress\macros\iress\c#\datapriceevents\datapriceevents.suo
%ProgramFiles(x86)%\iress market technology\iress\iressfl5as.dll
%ProgramFiles(x86)%\iress market technology\iress\macros\iress\vb.net\datapriceevents\datapriceevents\assemblyinfo.vb
%ProgramFiles(x86)%\iress market technology\iress\sounds\schwarzenegger - stop it.wav
%ProgramFiles(x86)%\iress market technology\iress\iress.tlb
%ProgramFiles(x86)%\iress market technology\iress\sounds\applause.wav
%ProgramFiles(x86)%\iress market technology\iress\macros\iress\saxbasic\liquidty.bas
%ProgramFiles(x86)%\iress market technology\iress\macros\iress\vb.net\datapriceevents\datapriceevents\datapriceevents.vbproj.user
%ProgramFiles(x86)%\iress market technology\iress\macros\iress\c#\datapriceevents\datapriceevents.sln
%ProgramFiles(x86)%\iress market technology\iress\macros\iress\saxbasic\dfsbrokr.bas
%ProgramFiles(x86)%\iress market technology\iress\images\methodreferenceprimarykey.png
%ProgramFiles(x86)%\iress market technology\iress\system.windows.interactivity.dll
%ProgramFiles(x86)%\iress market technology\iress\sounds\schwarzenegger - hasta la vista, baby.wav
%ProgramFiles(x86)%\iress market technology\iress\macros\iress\saxbasic\charts.bas
%ProgramFiles(x86)%\iress market technology\iress\defaultprofile\userdata\spanned retail oms.wsp
%ProgramFiles(x86)%\iress market technology\iress\sounds\dirty harry - do you feel lucky punk.wav
%ProgramFiles(x86)%\iress market technology\iress\macros\iress\c++\datapriceevents.vcproj
%ProgramFiles(x86)%\iress market technology\iress\macros\iress\saxbasic\word.bas
%ProgramFiles(x86)%\iress market technology\iress\sounds\kramer - oh yeah.wav
%ProgramFiles(x86)%\iress market technology\iress\macros\iress\saxbasic\dfsprice.bas
%ProgramFiles(x86)%\iress market technology\iress\macros\iress\c++\res\datapriceevents.ico
%ProgramFiles(x86)%\iress market technology\iress\defaultprofile\userdata\sampleworkspace3 (800x600).wsp
%ProgramFiles(x86)%\iress market technology\iress\cmd141.dll
%ProgramFiles(x86)%\iress market technology\iress\macros\iress\excel\optionvaluation.xls
%ProgramFiles(x86)%\iress market technology\iress\broker.dll
%ProgramFiles(x86)%\iress market technology\iress\wpfvisifire.charts.dll
%ProgramFiles(x86)%\iress market technology\iress\macros\iress\c++\dataprice.h
%ProgramFiles(x86)%\iress market technology\iress\iressoledbprovider.dll
%ProgramFiles(x86)%\iress market technology\iress\interop.dfsiress.dll
%ProgramFiles(x86)%\iress market technology\iress\sounds\i'm not gonna hurt you.wav
%ProgramFiles(x86)%\iress market technology\iress\images\methodreferencecollapse.jpg
%ProgramFiles(x86)%\iress market technology\iress\sounds\daffy - are you nuts.wav
%ProgramFiles(x86)%\iress market technology\iress\sounds\daffy - laughter.wav
%TEMP%\rarsfx0\(ca) basic - 1920 x 1080.wsp
%TEMP%\rarsfx0\(ca) basic - 1280 x 1024.wsp
%TEMP%\rarsfx0\setlocalecanada.reg
%TEMP%\rarsfx0\(ca) retail oms.wsp
%TEMP%\rarsfx0\(ca) market data - 1920 x 1080.wsp
%TEMP%\rarsfx0\(ca) market data - 1280 x 1024.wsp
%TEMP%\rarsfx0\iresscanadainstall.bat
%TEMP%\rarsfx0\ios plus - 16.3 sp37\setup.exe
%TEMP%\rarsfx0\iress pro - 16.3 sp10\setup.exe
%TEMP%\{24151836-35e2-4b26-96c5-bb669e0154b9}\iress.msi
%TEMP%\rarsfx0\(ca) default - 1280 x 1024.wsp
%ProgramFiles(x86)%\iress market technology\iress\iressot11as.dll
%ProgramFiles(x86)%\iress market technology\iress\macros\iress\c#\datapriceevents\datapriceevents\app.ico
%ProgramFiles(x86)%\iress market technology\iress\macros\iress\saxbasic\top20.bas
%ProgramFiles(x86)%\iress market technology\iress\macros\iress\excel\ddecntxt.xls
%ProgramFiles(x86)%\iress market technology\iress\sounds\explosion.wav
%ProgramFiles(x86)%\iress market technology\iress\sounds\seinfeld - no no no.wav
%ProgramFiles(x86)%\iress market technology\iress\sounds\daffy - help.wav
%ProgramFiles(x86)%\iress market technology\iress\iressdesktopwslib.dll
%ProgramFiles(x86)%\iress market technology\iress\defaultprofile\appdata\canada\fld32cmd.fmt
%ProgramFiles(x86)%\iress market technology\iress\defaultprofile\appdata\fld32.fmt
%ProgramFiles(x86)%\iress market technology\iress\macros\iress\saxbasic\hiport.bas
%ProgramFiles(x86)%\iress market technology\iress\macros\iress\c++\datapriceeventsdlg.h
%WINDIR%\installer\{11c10cdf-b6b7-4765-9682-82ef0185204c}\iressicon.exe
%ProgramFiles(x86)%\iress market technology\iress\macros\iress\excel\stockbetacalculator.xls
%ProgramFiles(x86)%\iress market technology\iress\macros\iress\excel\depth.xls
%ProgramFiles(x86)%\iress market technology\iress\macros\iress\c++\stdafx.cpp
%ProgramFiles(x86)%\iress market technology\iress\macros\iress\excel\dfsoptex.xls
%ProgramFiles(x86)%\iress market technology\iress\defaultprofile\userdata\new starter + ios.wsp
%ProgramFiles(x86)%\iress market technology\iress\macros\iress\c++\resource.h
%ProgramFiles(x86)%\iress market technology\iress\timeseries.dll
%ProgramFiles(x86)%\iress market technology\iress\boost_thread-vc90-mt-1_35.dll
%ProgramFiles(x86)%\iress market technology\iress\diagnostichelper.exe
%ProgramFiles(x86)%\iress market technology\iress\xcpro30.dll
%ProgramFiles(x86)%\iress market technology\iress\sounds\soup nazi - no soup for you.wav
%ProgramFiles(x86)%\iress market technology\iress\xccdx30.dll
%ProgramFiles(x86)%\iress market technology\iress\sounds\dirty harry - make my day.wav
%ProgramFiles(x86)%\iress market technology\iress\ifcgrid141.dll
%ProgramFiles(x86)%\iress market technology\iress\text.dll
%ProgramFiles(x86)%\iress market technology\iress\images\methodreferencesortdirectionup.png
%ProgramFiles(x86)%\iress market technology\iress\sounds\schwarzenegger - thanks for your advice.wav
%ProgramFiles(x86)%\iress market technology\iress\sounds\homer - ahh.wav
%ProgramFiles(x86)%\iress market technology\iress\sounds\scream.wav
%ProgramFiles(x86)%\iress market technology\iress\macros\iress\saxbasic\financial data\finclass.bas
%ProgramFiles(x86)%\iress market technology\iress\runmacro.exe
%ProgramFiles(x86)%\iress market technology\iress\sounds\alladin - big problem.wav
%ProgramFiles(x86)%\iress market technology\iress\macros\iress\c#\datapriceevents\datapriceevents\datapriceevents.csproj.user
%ProgramFiles(x86)%\iress market technology\iress\macros\iress\c++\datapriceevents.cpp
%ProgramFiles(x86)%\iress market technology\iress\priceextra.dll
%ProgramFiles(x86)%\iress market technology\iress\macros\iress\saxbasic\tradehst.bas
%ProgramFiles(x86)%\iress market technology\iress\macros\iress\saxbasic\news.bas
%ProgramFiles(x86)%\iress market technology\iress\sounds\boing.wav
%ProgramFiles(x86)%\iress market technology\iress\sounds\laser.wav
%ProgramFiles(x86)%\iress market technology\iress\defaultprofile\userdata\default.wsp
%ProgramFiles(x86)%\iress market technology\iress\defaultprofile\appdata\australia\fld32cmd.fmt
%ProgramFiles(x86)%\iress market technology\iress\macros\iress\excel\totalreturn.xls
%ProgramFiles(x86)%\iress market technology\iress\macros\iress\excel\exchangetime.xls
%ProgramFiles(x86)%\iress market technology\iress\defaultprofile\userdata\spanned oms.wsp
%ProgramFiles(x86)%\iress market technology\iress\macros\iress\saxbasic\dfssec.bas
%ProgramFiles(x86)%\iress market technology\iress\secinfo.dll
%ProgramFiles(x86)%\iress market technology\iress\boost_date_time-vc90-mt-1_35.dll
%ProgramFiles(x86)%\iress market technology\iress\macros\iress\c++\data.h
%ProgramFiles(x86)%\iress market technology\iress\macros\iress\saxbasic\sectn235.bas
%ProgramFiles(x86)%\iress market technology\iress\macros\iress\c#\datapriceevents\datapriceevents\assemblyinfo.cs
%ProgramFiles(x86)%\iress market technology\iress\sounds\no.wav
%ProgramFiles(x86)%\iress market technology\iress\wpftoolkit.dll
%ProgramFiles(x86)%\iress market technology\iress\defaultprofile\userdata\sampleworkspace1 (1024x768).wsp
%ProgramFiles(x86)%\iress market technology\iress\defaultprofile\userdata\market data.wsp
%ProgramFiles(x86)%\iress market technology\iress\sounds\alladin - i can't take it any more.wav
%ProgramFiles(x86)%\iress market technology\iress\macros\iress\c#\datapriceevents\datapriceevents\datapriceevents.csproj
%ProgramFiles(x86)%\iress market technology\iress\interop.dfscmd.dll
%ProgramFiles(x86)%\iress market technology\iress\chartfrontend.dll
%ProgramFiles(x86)%\iress market technology\iress\macros\iress\vb.net\datapriceevents\datapriceevents\datapriceevents.vbproj
%ProgramFiles(x86)%\iress market technology\iress\sounds\cash registry.wav
%ProgramFiles(x86)%\iress market technology\iress\httpcfg.exe
%ProgramFiles(x86)%\iress market technology\iress\macros\iress\saxbasic\trades\cbrokert.cls
%ProgramFiles(x86)%\iress market technology\iress\sounds\schwarzenegger - deep trouble.wav
%PROGRAMDATA%\microsoft\windows\start menu\programs\iress market technology\iress.lnk

Miscellaneous

Searches for the following windows

ClassName: 'EDIT' WindowName: ''
ClassName: 'RegEdit_RegEdit' WindowName: ''

Creates and executes the following

'%TEMP%\rarsfx0\iress pro - 16.3 sp10\setup.exe' /passive SOCKETADDRESS=MACHINE:36865 SECONDARY_SOCKETADDRESS=MACHINE:36865 LOGIN_COMPANYNAME=COMPANY USERDIR=\"%HOMEPATH%\Documents\IRESS\" APPDIR=\"%APPDATA%\IRESS\"

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\RarSFX0\IressCanadaInstall.bat" "
'%WINDIR%\syswow64\regedit.exe' /S SetLocaleCanada.reg
'%WINDIR%\syswow64\cmd.exe' /c reg.exe query "HKCU\Software\DFS\IRESS\File" /v "UserDir"
'%WINDIR%\syswow64\reg.exe' query "HKCU\Software\DFS\IRESS\File" /v "UserDir"
'%WINDIR%\syswow64\cmd.exe' /c reg.exe query "HKCU\Software\DFS\IRESS\File" /v "WorkDir"
'%WINDIR%\syswow64\reg.exe' query "HKCU\Software\DFS\IRESS\File" /v "WorkDir"
'%WINDIR%\syswow64\msiexec.exe' /i %TEMP%\{24151836-35E2-4B26-96C5-BB669E0154B9}\IRESS.msi /passive SOCKETADDRESS=MACHINE:36865 SECONDARY_SOCKETADDRESS=MACHINE:36865 LOGIN_COMPANYNAME=COMPANY USERDIR=\"%HOMEPATH%\Documents\IR...

Technologies

Begriffe

Schulung und Training

Mythen

Technical Information

Curing recommendations

Free trial