Trojan.MulDrop8.60230

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Classes\TeamViewerSession\shell\open\command] '' = '"%ProgramFiles%\Teamviewer\Version5\TeamViewer.exe" --play "%1"'
[<HKLM>\SOFTWARE\Classes\TeamViewerControl\shell\open\command] '' = '"%ProgramFiles%\Teamviewer\Version5\TeamViewer.exe" --control "%1"'

Вредоносные функции:

Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%ProgramFiles%\Teamviewer\Version5\TeamViewer.exe' = '%ProgramFiles%\T...

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\RarSFX0\help.cmd
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
%WINDIR%\Installer\24704.ipi
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
%WINDIR%\Installer\MSI1.tmp
%WINDIR%\Installer\{07ADD033-ED60-4DD2-A24B-776EED71F7A9}\_01D125059C3E5D0BDBBD55.exe
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
%WINDIR%\Installer\24706.msi
%ALLUSERSPROFILE%\Desktop\TeamViewer 5.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\TeamViewer 5\TeamViewer 5.lnk
%ProgramFiles%\Teamviewer\Version5\w2k\teamviewervpn.sys
%ProgramFiles%\Teamviewer\Version5\Teamviewer_Resource_ru.dll
%ProgramFiles%\Teamviewer\Version5\x86\TeamViewerVPN.inf
%ProgramFiles%\Teamviewer\Version5\w2k\TeamViewerVPN.inf
%ProgramFiles%\Teamviewer\Version5\install.exe
%ProgramFiles%\Teamviewer\Version5\TeamViewer_Service.exe
%ProgramFiles%\Teamviewer\Version5\TeamViewer.exe
%ProgramFiles%\Teamviewer\Version5\SAS.exe
%ProgramFiles%\Teamviewer\Version5\tvca.dll
%ProgramFiles%\Teamviewer\Version5\x86\teamviewervpn.cat
%ProgramFiles%\Teamviewer\Version5\Teamviewer_Resource_en.dll
%ProgramFiles%\Teamviewer\Version5\x86\teamviewervpn.sys
%ProgramFiles%\Teamviewer\Version5\TV.dll
C:\Config.Msi\24705.rbs
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
%WINDIR%\Temp\TV\x86\TeamViewerVPN.inf
%WINDIR%\Temp\TV\x86\teamviewervpn.cat
%WINDIR%\Temp\TV\x64\teamviewervpn.cat
%WINDIR%\Temp\TV\TeamViewer.ini
%WINDIR%\Temp\TV\config.ini
%WINDIR%\Temp\TV\FAQ.chm
%WINDIR%\Temp\TV\TeamViewerHost.msi
%WINDIR%\Temp\TV\TeamViewer.msi
%TEMP%\RarSFX0\TeamViewer 5.0.9104.exe
%TEMP%\RarSFX0\run_portable_cid.cmd
%TEMP%\RarSFX0\run_portable.cmd
%TEMP%\RarSFX0\install_vpn.cmd
%TEMP%\RarSFX0\install_host_vpn.cmd
%TEMP%\RarSFX0\install_host.cmd
%TEMP%\RarSFX0\install_full_vpn.cmd
%TEMP%\RarSFX0\install_full_autorun_vpn.cmd
%TEMP%\RarSFX0\install_full_autorun.cmd
%TEMP%\RarSFX0\install_full.cmd
%WINDIR%\Temp\TV\w2k\TeamViewerVPN.inf
%WINDIR%\Temp\TV\x64\TeamViewerVPN.inf
%WINDIR%\Installer\24702.msi
%WINDIR%\Temp\TV\full.exe
%WINDIR%\Temp\TV\x64\teamviewervpn.sys
%WINDIR%\Temp\TV\w2k\teamviewervpn.sys
%WINDIR%\Temp\TV\x86\teamviewervpn.sys
%WINDIR%\Temp\TV\tvca.dll
%WINDIR%\Temp\TV\TV.dll
%WINDIR%\Temp\TV\Teamviewer_Resource_ru.dll
%WINDIR%\Temp\TV\Teamviewer_Resource_en.dll
%WINDIR%\Temp\TV\TVShell.exe
%WINDIR%\Temp\TV\TeamViewer_Service.exe
%WINDIR%\Temp\TV\host\TeamViewer.exe
%WINDIR%\Temp\TV\TeamViewer.exe
%WINDIR%\Temp\TV\SAS.exe
%WINDIR%\Temp\TV\rClientID.exe
%WINDIR%\Temp\TV\install64.exe
%WINDIR%\Temp\TV\install.exe
%WINDIR%\Temp\TV\host.exe
%WINDIR%\Temp\TV\fulla.exe
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
%WINDIR%\Installer\{07ADD033-ED60-4DD2-A24B-776EED71F7A9}\_6FB44E1F7E5DE356C4E30B.exe

Удаляет следующие файлы:

%WINDIR%\Installer\MSI1.tmp
C:\Config.Msi\24705.rbs
%WINDIR%\Installer\24702.msi
%WINDIR%\Installer\24704.ipi

Другое:

Ищет следующие окна:

ClassName: 'EDIT' WindowName: ''

Создает и запускает на исполнение:

'%TEMP%\RarSFX0\TeamViewer 5.0.9104.exe' -ai1
'%WINDIR%\Temp\TV\full.exe'

Запускает на исполнение:

'<SYSTEM32>\cmd.exe' /c ""%TEMP%\RarSFX0\install_full.cmd" "
'<SYSTEM32>\msiexec.exe' /i TeamViewer.msi /qb /norestart
'<SYSTEM32>\msiexec.exe' /V
'<SYSTEM32>\msiexec.exe' -Embedding 47DD8671911703A7C7B2275CFC4E56E9 M Global\MSI0000