Trojan.DownLoader22.33585

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,...
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,...
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,...
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,...
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,...
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,...
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,...
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,...
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,...
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,...
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,...
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,...
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,...

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\tap0901] 'ImagePath' = 'system32\DRIVERS\tap0901.sys'

Вредоносные функции:

Запускает на исполнение:

'%TEMP%\nsi2.tmp\ns4.tmp' "%ProgramFiles%\TAP-Windows\bin\tapinstall.exe" install "%ProgramFiles%\TAP-Windows\driver\OemVista.inf" tap0901
'%ProgramFiles%\TAP-Windows\bin\tapinstall.exe' install "%ProgramFiles%\TAP-Windows\driver\OemVista.inf" tap0901
'<SYSTEM32>\runonce.exe' -r
'%ProgramFiles%\TAP-Windows\bin\tapinstall.exe' hwids tap0901
'<SYSTEM32>\cmd.exe' /c ""C:\MTC LIME\autorun.bat" "
'C:\MTC LIME\driver.exe' /S /Q
'%TEMP%\nsi2.tmp\ns3.tmp' "%ProgramFiles%\TAP-Windows\bin\tapinstall.exe" hwids tap0901

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\Cab29.tmp
%TEMP%\Cab27.tmp
%TEMP%\Cab25.tmp
%TEMP%\Cab2B.tmp
%TEMP%\Cab31.tmp
%TEMP%\Cab2F.tmp
%TEMP%\Cab2D.tmp
%TEMP%\Cab23.tmp
%TEMP%\Cab17.tmp
%TEMP%\Cab15.tmp
%TEMP%\Cab13.tmp
%TEMP%\Cab19.tmp
%TEMP%\Cab21.tmp
%TEMP%\Cab1F.tmp
%TEMP%\Cab1D.tmp
%TEMP%\Cab33.tmp
%TEMP%\Cab44.tmp
%TEMP%\Cab42.tmp
%TEMP%\Cab40.tmp
%TEMP%\Cab46.tmp
%TEMP%\Cab4C.tmp
%TEMP%\Cab4A.tmp
%TEMP%\Cab48.tmp
%TEMP%\Cab3E.tmp
<DRIVERS>\SET35.tmp
%WINDIR%\inf\oem3.PNF
%WINDIR%\inf\oem3.inf
%TEMP%\Cab36.tmp
%TEMP%\Cab3C.tmp
%TEMP%\Cab3A.tmp
%TEMP%\Cab38.tmp
%TEMP%\Cab11.tmp
%TEMP%\nsi2.tmp\UserInfo.dll
C:\MTC LIME\Uninstall.ini
%HOMEPATH%\Desktop\MTC LIME.lnk
%TEMP%\nsi2.tmp\System.dll
%ProgramFiles%\TAP-Windows\driver\tap0901.cat
%ProgramFiles%\TAP-Windows\driver\OemVista.inf
%ProgramFiles%\TAP-Windows\bin\tapinstall.exe
C:\MTC LIME\Uninstall.exe
%TEMP%\$inst\temp_0.tmp
%TEMP%\$inst\4.tmp
%TEMP%\$inst\2.tmp
C:\MTC LIME\autorun.bat
C:\MTC LIME\MTC LIME.exe
C:\MTC LIME\ico.ico
C:\MTC LIME\driver.exe
%ProgramFiles%\TAP-Windows\driver\tap0901.sys
%TEMP%\Cab7.tmp
%TEMP%\Cab5.tmp
%APPDATA%\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
%TEMP%\Cab9.tmp
%TEMP%\CabF.tmp
%TEMP%\CabD.tmp
%TEMP%\CabB.tmp
%APPDATA%\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
%TEMP%\nsi2.tmp\nsExec.dll
%ProgramFiles%\TAP-Windows\icon.ico
%ProgramFiles%\TAP-Windows\license.txt
%TEMP%\nsi2.tmp\ns3.tmp
%APPDATA%\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004
%APPDATA%\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004
%TEMP%\nsi2.tmp\ns4.tmp

Удаляет следующие файлы:

%TEMP%\Cab36.tmp
%TEMP%\Cab33.tmp
%TEMP%\Cab3A.tmp
%TEMP%\Cab38.tmp
%TEMP%\Cab31.tmp
%TEMP%\Cab2B.tmp
%TEMP%\Cab29.tmp
%TEMP%\Cab2F.tmp
%TEMP%\Cab2D.tmp
%TEMP%\Cab48.tmp
%TEMP%\Cab46.tmp
%TEMP%\Cab4C.tmp
%TEMP%\Cab4A.tmp
%TEMP%\Cab44.tmp
%TEMP%\Cab3E.tmp
%TEMP%\Cab3C.tmp
%TEMP%\Cab42.tmp
%TEMP%\Cab40.tmp
%TEMP%\Cab27.tmp
%TEMP%\CabD.tmp
%TEMP%\CabB.tmp
%TEMP%\Cab11.tmp
%TEMP%\CabF.tmp
%TEMP%\Cab9.tmp
%TEMP%\nsi2.tmp\ns3.tmp
%TEMP%\$inst\temp_0.tmp
%TEMP%\Cab7.tmp
%TEMP%\Cab5.tmp
%TEMP%\Cab21.tmp
%TEMP%\Cab1F.tmp
%TEMP%\Cab25.tmp
%TEMP%\Cab23.tmp
%TEMP%\Cab1D.tmp
%TEMP%\Cab15.tmp
%TEMP%\Cab13.tmp
%TEMP%\Cab19.tmp
%TEMP%\Cab17.tmp

Перемещает следующие файлы:

<DRIVERS>\SET35.tmp в <DRIVERS>\tap0901.sys

Сетевая активность:

Подключается к:

'www.download.windowsupdate.com':80
'wp#d':80

TCP:

Запросы HTTP GET:

http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt
http://11#.#11.111.1/wpad.dat via wp#d

UDP: