Trojan.KillProc.18798

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Secu-Route' = '%PROGRAM_FILES%\Secu-Route\secu-route.exe'

Вредоносные функции:

Создает и запускает на исполнение:

%PROGRAM_FILES%\Secu-Route\im\32Bit\snetcfg.exe -v -l im\32Bit\ndisrd.inf -m im\32Bit\ndisrd_m.inf -c s -i nt_ndisrd
%PROGRAM_FILES%\Secu-Route\im\install.exe
%PROGRAM_FILES%\Secu-Route\secu-route.exe
%TEMP%\nsl2.tmp\nsB.tmp icacls "%PROGRAM_FILES%\Secu-Route" /grant Users:F /T
%TEMP%\nsl2.tmp\ns4.tmp "<SYSTEM32>\cmd.exe" /c ""sc" delete "Secu-Route Service""
%TEMP%\nsl2.tmp\ns3.tmp "<SYSTEM32>\cmd.exe" /c ""sc" stop "Secu-Route Service""
%PROGRAM_FILES%\Secu-Route\drvinstall.exe
%TEMP%\nsl2.tmp\ns5.tmp taskkill /F /im secu-route.exe

Запускает на исполнение:

<SYSTEM32>\taskkill.exe /F /im secu-route.exe
<SYSTEM32>\runonce.exe -r
<SYSTEM32>\sc.exe stop "Secu-Route Service"
<SYSTEM32>\sc.exe delete "Secu-Route Service"

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\Secu-Route\lwf\64Bit\snetcfg.exe
%APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\7b15525b-2bf3-42fc-bf12-871fc1b99394
%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\ec702f375e1b12d218f67ab9ef19ca23_23ef5514-3059-436f-a4a7-4cefaab20eb1
%APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\Preferred
%PROGRAM_FILES%\Secu-Route\lwf\64Bit\ndisrd_lwf.inf
%PROGRAM_FILES%\Secu-Route\lwf\32Bit\ndisrd_lwf.inf
%PROGRAM_FILES%\Secu-Route\lwf\32Bit\ndisrd.sys
%PROGRAM_FILES%\Secu-Route\lwf\32Bit\snetcfg.exe
%PROGRAM_FILES%\Secu-Route\lwf\64Bit\ndisrd.sys
%PROGRAM_FILES%\Secu-Route\lwf\64Bit\ndisrd64.cat
%PROGRAM_FILES%\Secu-Route\Uninstall.exe
<SYSTEM32>\srapi.dll
%TEMP%\nsl2.tmp\nsB.tmp
%ALLUSERSPROFILE%\Start Menu\Programs\Secu-Route\Secu-Route.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Secu-Route\Uninstall Secu-Route.lnk
<DRIVERS>\SETA.tmp
%WINDIR%\inf\oem3.PNF
%WINDIR%\inf\oem3.inf
%WINDIR%\inf\oem4.inf
%WINDIR%\inf\INFCACHE.0
%WINDIR%\inf\oem4.PNF
%PROGRAM_FILES%\Secu-Route\lwf\32Bit\ndisrd86.cat
%TEMP%\nsl2.tmp\ns5.tmp
%PROGRAM_FILES%\Secu-Route\update.exe
%PROGRAM_FILES%\Secu-Route\secu-route.exe
%PROGRAM_FILES%\Secu-Route\im\32Bit\ndisrd.inf
%PROGRAM_FILES%\Secu-Route\im\install.exe
%PROGRAM_FILES%\Secu-Route\drvinstall.exe
%TEMP%\nsl2.tmp\nsExec.dll
%TEMP%\nsl2.tmp\System.dll
%TEMP%\nsl2.tmp\ns3.tmp
%PROGRAM_FILES%\Secu-Route\sr.cfg
%TEMP%\nsl2.tmp\ns4.tmp
%PROGRAM_FILES%\Secu-Route\im\64Bit\ndisrd_mamd64.cat
%PROGRAM_FILES%\Secu-Route\im\64Bit\snetcfg.exe
%PROGRAM_FILES%\Secu-Route\im\64Bit\ndisrdamd64.cat
%PROGRAM_FILES%\Secu-Route\lwf\root.cer
%PROGRAM_FILES%\Secu-Route\lwf\certinst.exe
%PROGRAM_FILES%\Secu-Route\im\64Bit\ndisrd.sys
%PROGRAM_FILES%\Secu-Route\im\32Bit\ndisrd.sys
%PROGRAM_FILES%\Secu-Route\im\32Bit\ndisrd_m.inf
%PROGRAM_FILES%\Secu-Route\im\32Bit\snetcfg.exe
%PROGRAM_FILES%\Secu-Route\im\64Bit\ndisrd_m.inf
%PROGRAM_FILES%\Secu-Route\im\64Bit\ndisrd.inf

Удаляет следующие файлы:

%PROGRAM_FILES%\Secu-Route\lwf\64Bit\ndisrd.sys
%PROGRAM_FILES%\Secu-Route\lwf\64Bit\ndisrd64.cat
%PROGRAM_FILES%\Secu-Route\lwf\64Bit\ndisrd_lwf.inf
%PROGRAM_FILES%\Secu-Route\lwf\32Bit\snetcfg.exe
%PROGRAM_FILES%\Secu-Route\lwf\32Bit\ndisrd.sys
%PROGRAM_FILES%\Secu-Route\lwf\32Bit\ndisrd86.cat
%PROGRAM_FILES%\Secu-Route\lwf\32Bit\ndisrd_lwf.inf
%TEMP%\nsl2.tmp\nsExec.dll
%TEMP%\nsl2.tmp\System.dll
%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\ec702f375e1b12d218f67ab9ef19ca23_23ef5514-3059-436f-a4a7-4cefaab20eb1
%TEMP%\nsl2.tmp\nsB.tmp
%PROGRAM_FILES%\Secu-Route\lwf\64Bit\snetcfg.exe
%PROGRAM_FILES%\Secu-Route\lwf\certinst.exe
%PROGRAM_FILES%\Secu-Route\lwf\root.cer
%PROGRAM_FILES%\Secu-Route\im\install.exe
%PROGRAM_FILES%\Secu-Route\im\32Bit\ndisrd.inf
%PROGRAM_FILES%\Secu-Route\im\32Bit\ndisrd.sys
%PROGRAM_FILES%\Secu-Route\im\32Bit\ndisrd_m.inf
%PROGRAM_FILES%\Secu-Route\drvinstall.exe
%TEMP%\nsl2.tmp\ns3.tmp
%TEMP%\nsl2.tmp\ns4.tmp
%TEMP%\nsl2.tmp\ns5.tmp
%PROGRAM_FILES%\Secu-Route\im\64Bit\ndisrd_m.inf
%PROGRAM_FILES%\Secu-Route\im\64Bit\ndisrd_mamd64.cat
%PROGRAM_FILES%\Secu-Route\im\64Bit\snetcfg.exe
%PROGRAM_FILES%\Secu-Route\im\64Bit\ndisrdamd64.cat
%PROGRAM_FILES%\Secu-Route\im\32Bit\snetcfg.exe
%PROGRAM_FILES%\Secu-Route\im\64Bit\ndisrd.inf
%PROGRAM_FILES%\Secu-Route\im\64Bit\ndisrd.sys