Техническая информация
Вредоносные функции
Запускает на исполнение
- '%WINDIR%\syswow64\taskkill.exe' /f /im teamviewer.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im teamviewer_service.exe
Изменения в файловой системе
Создает следующие файлы
- C:\tvrepro30\killtv.bat
- %WINDIR%\temp\tar67c5.tmp
- %WINDIR%\temp\cab935a.tmp
- %WINDIR%\temp\tar935b.tmp
- %WINDIR%\temp\cab9456.tmp
- %WINDIR%\temp\tar9457.tmp
- %WINDIR%\temp\caba996.tmp
- %WINDIR%\temp\tara997.tmp
- %WINDIR%\temp\caba9d6.tmp
- %WINDIR%\temp\tara9d7.tmp
- %WINDIR%\temp\tarbf36.tmp
- %WINDIR%\temp\cab21c2.tmp
- %APPDATA%\teamviewer\teamviewer9_logfile.log
- %WINDIR%\temp\cabcb4d.tmp
- %WINDIR%\temp\tarcb4e.tmp
- %WINDIR%\temp\cabe0ac.tmp
- %WINDIR%\temp\tare0ad.tmp
- %WINDIR%\temp\cabe10b.tmp
- %WINDIR%\temp\tare10c.tmp
- %WINDIR%\temp\cabf699.tmp
- %WINDIR%\temp\tarf69a.tmp
- %WINDIR%\temp\cab67c4.tmp
- %WINDIR%\temp\cabbf35.tmp
- %TEMP%\teamviewer\version9\tvinfo.ini
- %TEMP%\teamviewer\version9\teamviewer.exe
- C:\tvrepro30\killtv.exe
- C:\tvrepro30\repro30.ico
- C:\tvrepro30\teamviewerqs_fr-idc6unhc4y.exe
- %TEMP%\ec7a.tmp\killtv.bat
- %TEMP%\nsifebb.tmp
- %TEMP%\nsiff0a.tmp\tvgetversion.dll
- %TEMP%\nsiff0a.tmp\system.dll
- %TEMP%\teamviewer\version9\tvqsfiles.7z
- %TEMP%\nsiff0a.tmp\nsis7z.dll
- %TEMP%\teamviewer\version9\teamviewer_desktop.exe
- %TEMP%\teamviewer\version9\x64\tvmonitor.inf
- %TEMP%\teamviewer\version9\teamviewer_service.exe
- %TEMP%\teamviewer\version9\tv_w32.exe
- %TEMP%\teamviewer\version9\tv_x64.exe
- %TEMP%\teamviewer\version9\teamviewer_resource_fr.dll
- %TEMP%\teamviewer\version9\teamviewer_staticres.dll
- %TEMP%\teamviewer\version9\tv_w32.dll
- %TEMP%\teamviewer\version9\tv_x64.dll
- %TEMP%\teamviewer\version9\tvqsfilesx64.7z
- %TEMP%\teamviewer\version9\x64\tvmonitor.cat
- %TEMP%\teamviewer\version9\x64\tvmonitor.sy_
- %WINDIR%\temp\tar21c3.tmp
Удаляет следующие файлы
- %TEMP%\teamviewer\version9\tvqsfiles.7z
- %WINDIR%\temp\tarf69a.tmp
- %WINDIR%\temp\cabf699.tmp
- %WINDIR%\temp\tare10c.tmp
- %WINDIR%\temp\cabe10b.tmp
- %WINDIR%\temp\tare0ad.tmp
- %WINDIR%\temp\cabe0ac.tmp
- %WINDIR%\temp\tarcb4e.tmp
- %WINDIR%\temp\cabcb4d.tmp
- %WINDIR%\temp\tarbf36.tmp
- %WINDIR%\temp\cabbf35.tmp
- %WINDIR%\temp\tara9d7.tmp
- %WINDIR%\temp\caba9d6.tmp
- %WINDIR%\temp\tara997.tmp
- %WINDIR%\temp\caba996.tmp
- %WINDIR%\temp\tar9457.tmp
- %WINDIR%\temp\cab9456.tmp
- %WINDIR%\temp\tar935b.tmp
- %WINDIR%\temp\cab935a.tmp
- %WINDIR%\temp\tar67c5.tmp
- %WINDIR%\temp\cab67c4.tmp
- %TEMP%\ec7a.tmp\killtv.bat
- %TEMP%\nsiff0a.tmp\tvgetversion.dll
- %TEMP%\nsiff0a.tmp\system.dll
- %TEMP%\nsiff0a.tmp\nsis7z.dll
- %TEMP%\teamviewer\version9\tvqsfilesx64.7z
- %WINDIR%\temp\cab21c2.tmp
- %WINDIR%\temp\tar21c3.tmp
Сетевая активность
TCP
Запросы HTTP GET
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
UDP
- DNS ASK co#####l.teamviewer.com
- DNS ASK microsoft.com
- DNS ASK pi###.#eamviewer.com
- DNS ASK ma#####4.teamviewer.com
- DNS ASK cl####.teamviewer.com
Другое
Ищет следующие окна
- ClassName: 'EDIT' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: '#32770' WindowName: ''
- ClassName: '' WindowName: 'TeamViewer Manager'
Создает и запускает на исполнение
- 'C:\tvrepro30\killtv.exe'
- 'C:\tvrepro30\teamviewerqs_fr-idc6unhc4y.exe'
- '%TEMP%\teamviewer\version9\teamviewer.exe' --configuration 6unhc4y
- '%TEMP%\teamviewer\version9\tv_w32.exe' --action hooks --log %APPDATA%\TeamViewer\TeamViewer9_Logfile.log
- '%TEMP%\teamviewer\version9\tv_x64.exe' --action hooks --log %APPDATA%\TeamViewer\TeamViewer9_Logfile.log
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\EC7A.tmp\Killtv.bat" "' (со скрытым окном)
Запускает на исполнение
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\EC7A.tmp\Killtv.bat" "
