Trojan.DownLoader11.11158

Техническая информация

Вредоносные функции:

Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] 'C:\TeamViewerPortable9.0.28223\App\TeamViewer\TeamViewer.exe' = 'C:\TeamViewerPortable9.0.28223\App\TeamViewer\TeamViewer.exe:*:Enabled:TeamViewer Portable Remote Control Application'

Создает и запускает на исполнение:

'C:\TeamViewerPortable9.0.28223\App\TeamViewer\tv_w32.exe' --action hooks --deferlog --log
'C:\TeamViewerPortable9.0.28223\App\TeamViewer\TeamViewer.exe'
'C:\TeamViewerPortable9.0.28223\TeamViewerPortable.exe'

Запускает на исполнение:

'%WINDIR%\regedit.exe' /s "C:\TeamViewerPortable9.0.28223\Data\TeamViewer.reg"

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\Cab2A.tmp
%TEMP%\Cab2C.tmp
%TEMP%\Cab28.tmp
%TEMP%\Cab24.tmp
%TEMP%\Cab26.tmp
%TEMP%\Cab34.tmp
%TEMP%\Cab36.tmp
%TEMP%\Cab32.tmp
%TEMP%\Cab2E.tmp
%TEMP%\Cab30.tmp
%TEMP%\Cab22.tmp
%TEMP%\Cab14.tmp
%TEMP%\Cab16.tmp
%TEMP%\Cab12.tmp
%TEMP%\CabE.tmp
%TEMP%\Cab10.tmp
%TEMP%\Cab1E.tmp
%TEMP%\Cab20.tmp
%TEMP%\Cab1C.tmp
%TEMP%\Cab18.tmp
%TEMP%\Cab1A.tmp
%TEMP%\Cab54.tmp
%TEMP%\Cab56.tmp
%TEMP%\Cab52.tmp
%TEMP%\Cab4E.tmp
%TEMP%\Cab50.tmp
%TEMP%\Cab5E.tmp
%TEMP%\Cab60.tmp
%TEMP%\Cab5C.tmp
%TEMP%\Cab58.tmp
%TEMP%\Cab5A.tmp
%TEMP%\Cab4C.tmp
%TEMP%\Cab3E.tmp
%TEMP%\Cab40.tmp
%TEMP%\Cab3C.tmp
%TEMP%\Cab38.tmp
%TEMP%\Cab3A.tmp
%TEMP%\Cab48.tmp
%TEMP%\Cab4A.tmp
%TEMP%\Cab46.tmp
%TEMP%\Cab42.tmp
%TEMP%\Cab44.tmp
%TEMP%\CabC.tmp
C:\TeamViewerPortable9.0.28223\App\TeamViewer\TeamViewer_Resource_ja.dll
C:\TeamViewerPortable9.0.28223\App\TeamViewer\TeamViewer_Resource_vi.dll
C:\TeamViewerPortable9.0.28223\App\TeamViewer\TeamViewer_Resource_en.dll
C:\TeamViewerPortable9.0.28223\App\TeamViewer\tv_w32.exe
C:\TeamViewerPortable9.0.28223\App\TeamViewer\tv_x64.exe
C:\TeamViewerPortable9.0.28223\Other\_Include\Installer.bmp
C:\TeamViewerPortable9.0.28223\Other\_Include\Splash.bmp
C:\TeamViewerPortable9.0.28223\App\TeamViewer\tv_x64.dll
C:\TeamViewerPortable9.0.28223\App\TeamViewer\TeamViewer_StaticRes.dll
C:\TeamViewerPortable9.0.28223\App\TeamViewer\tv_w32.dll
C:\TeamViewerPortable9.0.28223\TeamViewerPortable.exe
C:\TeamViewerPortable9.0.28223\App\TeamViewer\TeamViewer.ini
C:\TeamViewerPortable9.0.28223\Data\TeamViewerPortable.ini
C:\TeamViewerPortable9.0.28223\App\TeamViewer\License.txt
C:\TeamViewerPortable9.0.28223\App\TeamViewer\README.txt
C:\TeamViewerPortable9.0.28223\App\TeamViewer\CopyRights.txt
C:\TeamViewerPortable9.0.28223\App\TeamViewer\TeamViewer.exe
C:\TeamViewerPortable9.0.28223\App\TeamViewer\TeamViewer_Desktop.exe
C:\TeamViewerPortable9.0.28223\Other\_Include\7-Zip\7za.exe
C:\TeamViewerPortable9.0.28223\TeamViewerPortable.ini
C:\TeamViewerPortable9.0.28223\App\TeamViewer\autorun.inf
%APPDATA%\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004
%APPDATA%\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
%APPDATA%\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004
%TEMP%\nsa3.tmp\splash.bmp
%TEMP%\nsa3.tmp\newadvsplash.dll
%TEMP%\Cab8.tmp
%TEMP%\CabA.tmp
%TEMP%\Cab6.tmp
%APPDATA%\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
%TEMP%\Cab4.tmp
%TEMP%\nsa3.tmp\nsisFirewall.dll
C:\TeamViewerPortable9.0.28223\Other\_Include\Launcher.nsh
C:\TeamViewerPortable9.0.28223\Other\Source\_TeamViewerPortable.nsi
C:\TeamViewerPortable9.0.28223\Other\_Include\Installer.nsh
C:\TeamViewerPortable9.0.28223\Other\Source\TeamViewer.ico
C:\TeamViewerPortable9.0.28223\TeamViewerPortable.ico
%TEMP%\nsa3.tmp\Registry.dll
%TEMP%\nsa3.tmp\FindProcDLL.dll
%TEMP%\nsa2.tmp
C:\TeamViewerPortable9.0.28223\Other\Source\_TeamViewerPortableInstaller.nsi
C:\TeamViewerPortable9.0.28223\Data\TeamViewer.reg

Присваивает атрибут 'скрытый' для следующих файлов:

C:\TeamViewerPortable9.0.28223\Data\TeamViewerPortable.ini

Удаляет следующие файлы:

%TEMP%\Cab42.tmp
%TEMP%\Cab40.tmp
%TEMP%\Cab44.tmp
%TEMP%\Cab48.tmp
%TEMP%\Cab46.tmp
%TEMP%\Cab3E.tmp
%TEMP%\Cab36.tmp
%TEMP%\Cab34.tmp
%TEMP%\Cab38.tmp
%TEMP%\Cab3C.tmp
%TEMP%\Cab3A.tmp
%TEMP%\Cab4A.tmp
%TEMP%\Cab5A.tmp
%TEMP%\Cab58.tmp
%TEMP%\Cab5C.tmp
%TEMP%\Cab60.tmp
%TEMP%\Cab5E.tmp
%TEMP%\Cab56.tmp
%TEMP%\Cab4E.tmp
%TEMP%\Cab4C.tmp
%TEMP%\Cab50.tmp
%TEMP%\Cab54.tmp
%TEMP%\Cab52.tmp
%TEMP%\Cab32.tmp
%TEMP%\Cab12.tmp
%TEMP%\Cab10.tmp
%TEMP%\Cab14.tmp
%TEMP%\Cab18.tmp
%TEMP%\Cab16.tmp
%TEMP%\CabE.tmp
%TEMP%\Cab6.tmp
%TEMP%\Cab4.tmp
%TEMP%\Cab8.tmp
%TEMP%\CabC.tmp
%TEMP%\CabA.tmp
%TEMP%\Cab1A.tmp
%TEMP%\Cab2A.tmp
%TEMP%\Cab28.tmp
%TEMP%\Cab2C.tmp
%TEMP%\Cab30.tmp
%TEMP%\Cab2E.tmp
%TEMP%\Cab26.tmp
%TEMP%\Cab1E.tmp
%TEMP%\Cab1C.tmp
%TEMP%\Cab20.tmp
%TEMP%\Cab24.tmp
%TEMP%\Cab22.tmp

Сетевая активность:

Подключается к:

'pi###.#eamviewer.com':5938
'ma#####3.teamviewer.com':5938
'wp#d':80
'www.download.windowsupdate.com':80

TCP:

Запросы HTTP GET:

www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt
wp#d/wpad.dat

UDP: