Trojan.KillFiles.20001

Техническая информация

Вредоносные функции:

Создает и запускает на исполнение:

'%TEMP%\VCRedist\x86\VCRedist_x86\MVC+2012\11.0.61030.0\vcredist_x86.exe' /quiet /norestart

Запускает на исполнение:

'<SYSTEM32>\wbem\wmiadap.exe' /R /T
'<SYSTEM32>\msiexec.exe' /i "%TEMP%\VCRedist\x86\VCRedist_x86\MVC+2012\11.0.61030.0\Additional\vc_runtimeAdditional_x86.msi" /qn
'<SYSTEM32>\msiexec.exe' /i "%TEMP%\VCRedist\x86\VCRedist_x86\MVC+2012\11.0.61030.0\Minimum\vc_runtimeMinimum_x86.msi" /qn
'<SYSTEM32>\msiexec.exe' /V

Изменения в файловой системе:

Создает следующие файлы:

<SYSTEM32>\mfc110chs.dll
<SYSTEM32>\mfc110.dll
C:\Config.Msi\3f853.rbs
<SYSTEM32>\mfc110cht.dll
<SYSTEM32>\mfc110esn.dll
<SYSTEM32>\mfc110enu.dll
<SYSTEM32>\mfc110deu.dll
<SYSTEM32>\msvcp110.dll
<SYSTEM32>\atl110.dll
C:\Config.Msi\3f84e.rbs
<SYSTEM32>\msvcr110.dll
%WINDIR%\Installer\MSI7.tmp
%WINDIR%\Installer\3f850.msi
%TEMP%\MSI48a5a.LOG
<SYSTEM32>\mfc110fra.dll
%TEMP%\{f0080ca2-80ae-4958-b6eb-e8fa916d744a}\.ba1\thm.xml
%TEMP%\{f0080ca2-80ae-4958-b6eb-e8fa916d744a}\.ba1\wixstdba.dll
<SYSTEM32>\vcomp110.dll
%TEMP%\{f0080ca2-80ae-4958-b6eb-e8fa916d744a}\.ba1\thm.wxl
%TEMP%\{f0080ca2-80ae-4958-b6eb-e8fa916d744a}\.ba1\BootstrapperApplicationData.xml
%TEMP%\{f0080ca2-80ae-4958-b6eb-e8fa916d744a}\.ba1\license.rtf
%TEMP%\{f0080ca2-80ae-4958-b6eb-e8fa916d744a}\.ba1\logo.png
<SYSTEM32>\mfc110kor.dll
<SYSTEM32>\mfc110jpn.dll
<SYSTEM32>\mfc110ita.dll
<SYSTEM32>\mfc110rus.dll
<SYSTEM32>\mfcm110u.dll
<SYSTEM32>\mfcm110.dll
<SYSTEM32>\mfc110u.dll
%TEMP%\VCRedist\x86\VCRedist_x86\MVC+2012\11.0.61030.0\Additional\Win\System\mfc110esn.dll
%TEMP%\VCRedist\x86\VCRedist_x86\MVC+2012\11.0.61030.0\Additional\Win\System\mfc110enu.dll
%TEMP%\VCRedist\x86\VCRedist_x86\MVC+2012\11.0.61030.0\Additional\Win\System\mfc110deu.dll
%TEMP%\VCRedist\x86\VCRedist_x86\MVC+2012\11.0.61030.0\Additional\Win\System\mfc110fra.dll
%TEMP%\VCRedist\x86\VCRedist_x86\MVC+2012\11.0.61030.0\Additional\Win\System\mfc110kor.dll
%TEMP%\VCRedist\x86\VCRedist_x86\MVC+2012\11.0.61030.0\Additional\Win\System\mfc110jpn.dll
%TEMP%\VCRedist\x86\VCRedist_x86\MVC+2012\11.0.61030.0\Additional\Win\System\mfc110ita.dll
%TEMP%\VCRedist\x86\VCRedist_x86\MVC+2012\11.0.61030.0\vcredist_x86.exe
%TEMP%\nsy3.tmp\modern-header.bmp
%TEMP%\nsh2.tmp
%TEMP%\VCRedist\x86\VCRedist_x86\MVC+2012\11.0.61030.0\Additional\vc_runtimeAdditional_x86.msi
%TEMP%\VCRedist\x86\VCRedist_x86\MVC+2012\11.0.61030.0\Additional\Win\System\mfc110cht.dll
%TEMP%\VCRedist\x86\VCRedist_x86\MVC+2012\11.0.61030.0\Additional\Win\System\mfc110chs.dll
%TEMP%\VCRedist\x86\VCRedist_x86\MVC+2012\11.0.61030.0\Additional\Win\System\mfc110.dll
%TEMP%\VCRedist\x86\VCRedist_x86\MVC+2012\11.0.61030.0\Additional\Win\System\mfc110rus.dll
%TEMP%\VCRedist\x86\VCRedist_x86\MVC+2012\11.0.61030.0\Minimum\Win\System\vccorlib110.dll
%TEMP%\VCRedist\x86\VCRedist_x86\MVC+2012\11.0.61030.0\Minimum\Win\System\msvcr110.dll
%TEMP%\VCRedist\x86\VCRedist_x86\MVC+2012\11.0.61030.0\Minimum\Win\System\msvcp110.dll
%TEMP%\MSI3c015.LOG
%WINDIR%\Installer\MSI4.tmp
%WINDIR%\Installer\3f84b.msi
%TEMP%\VCRedist\x86\VCRedist_x86\MVC+2012\11.0.61030.0\Additional\Win\System\mfcm110u.dll
%TEMP%\VCRedist\x86\VCRedist_x86\MVC+2012\11.0.61030.0\Additional\Win\System\mfcm110.dll
%TEMP%\VCRedist\x86\VCRedist_x86\MVC+2012\11.0.61030.0\Additional\Win\System\mfc110u.dll
%TEMP%\VCRedist\x86\VCRedist_x86\MVC+2012\11.0.61030.0\Additional\Win\System\vcamp110.dll
%TEMP%\VCRedist\x86\VCRedist_x86\MVC+2012\11.0.61030.0\Minimum\Win\System\atl110.dll
%TEMP%\VCRedist\x86\VCRedist_x86\MVC+2012\11.0.61030.0\Minimum\vc_runtimeMinimum_x86.msi
%TEMP%\VCRedist\x86\VCRedist_x86\MVC+2012\11.0.61030.0\Additional\Win\System\vcomp110.dll