Trojan.DownLoader33.61755

Техническая информация

Вредоносные функции

Внедряет код в

следующие пользовательские процессы:

gdbrgm.exe

Изменения в файловой системе

Создает следующие файлы

%TEMP%\gdbrgm.exe
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\.net reflector desktop\red gate\.net reflector\desktop 10.2\redgate.licensing.client.ui.dll
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\.net reflector desktop\red gate\.net reflector\desktop 10.2\redgate.licensing.client.ui.dll.~1
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\.net reflector desktop\red gate\.net reflector\desktop 10.2\redgate.licensing.client.dll
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\.net reflector desktop\red gate\.net reflector\desktop 10.2\redgate.licensing.client.dll.~1
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\.net reflector desktop\red gate\.net reflector\desktop 10.2\mindscape.raygun4net4.dll
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\.net reflector visual studio extension\.net reflector visual studio extension_10.2.3.1841_x86.msi.~1
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\.net reflector desktop\red gate\.net reflector\desktop 10.2\mindscape.raygun4net4.dll.~1
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\.net reflector desktop\red gate\.net reflector\desktop 10.2\redgate.reflector.raygun.dll
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\.net reflector desktop\red gate\.net reflector\desktop 10.2\redgate.reflector.raygun.dll.~1
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\.net reflector desktop\red gate\.net reflector\desktop 10.2\microsoft.visualstudio.setup.configuration.interop.dll
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\.net reflector desktop\red gate\.net reflector\desktop 10.2\microsoft.visualstudio.setup.configuration.interop.dll.~1
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\.net reflector desktop\red gate\.net reflector\desktop 10.2\log4net_notice.txt
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\.net reflector desktop\red gate\.net reflector\desktop 10.2\log4net_notice.txt.~1
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\.net reflector desktop\red gate\.net reflector\desktop 10.2\log4net_license.txt
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\.net reflector desktop\red gate\.net reflector\desktop 10.2\log4net_license.txt.~1
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\.net reflector desktop\red gate\.net reflector\desktop 10.2\log4net.dll
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\.net reflector desktop\red gate\.net reflector\desktop 10.2\mindscape.raygun4net.dll
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\autofac.dll
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\.net reflector desktop\red gate\.net reflector\desktop 10.2\redgate.reflector.tools.dll.~1
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\.net reflector visual studio extension\.net reflector visual studio extension_10.2.3.1841_x86.msi
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\.net reflector desktop\red gate\.net reflector\desktop 10.2\addins\powercommands.dll
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\.net reflector desktop\red gate\.net reflector\desktop 10.2\addins\powercommands.dll.~1
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\.net reflector desktop\red gate\.net reflector\desktop 10.2\reflectorcmd.exe
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\.net reflector desktop\red gate\.net reflector\desktop 10.2\reflectorcmd.exe.~1
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\.net reflector desktop\red gate\.net reflector\desktop 10.2\reflector.exe.config
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\.net reflector desktop\red gate\.net reflector\desktop 10.2\reflector.exe.config.~1
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\.net reflector desktop\red gate\.net reflector\desktop 10.2\reflector.exe
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\.net reflector desktop\red gate\.net reflector\desktop 10.2\reflector.exe.~1
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\.net reflector desktop\red gate\.net reflector\desktop 10.2\redgate.usage.client.dll
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\.net reflector desktop\red gate\.net reflector\desktop 10.2\redgate.usage.client.dll.~1
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\.net reflector desktop\red gate\.net reflector\desktop 10.2\redgate.update.client.dll
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\.net reflector desktop\red gate\.net reflector\desktop 10.2\redgate.update.client.dll.~1
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\.net reflector desktop\red gate\.net reflector\desktop 10.2\redgate.shared.utils.dll
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\.net reflector desktop\red gate\.net reflector\desktop 10.2\redgate.shared.utils.dll.~1
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\.net reflector desktop\red gate\.net reflector\desktop 10.2\redgate.shared.controls.dll
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\.net reflector desktop\red gate\.net reflector\desktop 10.2\redgate.shared.controls.dll.~1
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\.net reflector desktop\red gate\.net reflector\desktop 10.2\log4net.dll.~1
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\.net reflector desktop\red gate\.net reflector\desktop 10.2\mindscape.raygun4net.dll.~1
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\.net reflector desktop\red gate\.net reflector\desktop 10.2\lic.rtf
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\.net reflector desktop\red gate\.net reflector\desktop 10.2\lic.rtf.~1
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\.net reflector desktop\red gate\.net reflector\desktop 10.2\cecil_license.txt
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\redgate.installer.longfilename.dll
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\redgate.installerengine.dll
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\redgate.installerengine.interfaces.dll
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\redgate.compressengine.dll
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\redgate.installer.compressioninterfaces.dll
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\redgate.installer.compressors.dll
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\redgate.installer.threadhelper.dll
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\log4net.dll
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\redgate.installer.parameterparsing.dll
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\autofac.configuration.dll
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\redgate.installer.productparsing.dll
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\redgate.licensing.client.dll
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\internal_.net reflector desktop_10.2.3.1841_x86.msi
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\internal_.net reflector visual studio extension_10.2.3.1841_x86.msi
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\sqltoolbeltinstaller.project
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\projectitems.xml
%TEMP%\uhibw.exe
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\.net reflector visual studio extension\red gate\.net reflector\visual studio extension install 10.2\reflector_10.2.3.1841.vsix.~1
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\.net reflector desktop\red gate\.net reflector\desktop 10.2\redgate.reflector.tools.dll
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\newtonsoft.json.dll
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\mahapps.metro.dll
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\redgate.usage.client.dll
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\.net reflector desktop\red gate\.net reflector\desktop 10.2\cecil_license.txt.~1
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\.net reflector desktop\.net reflector desktop_10.2.3.1841_x86.msi
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\.net reflector desktop\.net reflector desktop_10.2.3.1841_x86.msi.~1
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\install.data2d604bbe6b984c0ba07e1bc50ba0b097.txt
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\install.datadf1993f8aa26439e90929e474485764b.txt
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\install.data1.txt
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\install.data0.txt
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\redgate.logfile.txt
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\install.bin
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\microsoft.deployment.windowsinstaller.dll
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\redgate.installer.adapter.dll
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\redgate.installer.model.dll
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\redgate.installer.ui.dll
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\redgate.installer.ui.app.exe
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\redgate.installer.ui.app.exe.config
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\redgate.honeycomb.wpf.dll
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\redgate.win32.dll
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\.net reflector visual studio extension\red gate\.net reflector\visual studio extension install 10.2\reflector_10.2.3.1841.vsix

Удаляет следующие файлы

%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\install.data1.txt
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\.net reflector visual studio extension\red gate\.net reflector\visual studio extension install 10.2\reflector_10.2.3.1841.vsix.~1
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\.net reflector visual studio extension\.net reflector visual studio extension_10.2.3.1841_x86.msi.~1
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\.net reflector desktop\red gate\.net reflector\desktop 10.2\addins\powercommands.dll.~1
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\.net reflector desktop\red gate\.net reflector\desktop 10.2\reflectorcmd.exe.~1
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\.net reflector desktop\red gate\.net reflector\desktop 10.2\reflector.exe.config.~1
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\.net reflector desktop\red gate\.net reflector\desktop 10.2\reflector.exe.~1
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\.net reflector desktop\red gate\.net reflector\desktop 10.2\redgate.usage.client.dll.~1
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\.net reflector desktop\red gate\.net reflector\desktop 10.2\redgate.update.client.dll.~1
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\.net reflector desktop\red gate\.net reflector\desktop 10.2\redgate.shared.utils.dll.~1
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\.net reflector desktop\red gate\.net reflector\desktop 10.2\redgate.shared.controls.dll.~1
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\.net reflector desktop\red gate\.net reflector\desktop 10.2\redgate.reflector.tools.dll.~1
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\install.data2d604bbe6b984c0ba07e1bc50ba0b097.txt
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\.net reflector desktop\red gate\.net reflector\desktop 10.2\redgate.reflector.raygun.dll.~1
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\.net reflector desktop\red gate\.net reflector\desktop 10.2\redgate.licensing.client.dll.~1
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\.net reflector desktop\red gate\.net reflector\desktop 10.2\mindscape.raygun4net4.dll.~1
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\.net reflector desktop\red gate\.net reflector\desktop 10.2\mindscape.raygun4net.dll.~1
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\.net reflector desktop\red gate\.net reflector\desktop 10.2\microsoft.visualstudio.setup.configuration.interop.dll.~1
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\.net reflector desktop\red gate\.net reflector\desktop 10.2\log4net_notice.txt.~1
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\.net reflector desktop\red gate\.net reflector\desktop 10.2\log4net_license.txt.~1
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\.net reflector desktop\red gate\.net reflector\desktop 10.2\log4net.dll.~1
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\.net reflector desktop\red gate\.net reflector\desktop 10.2\lic.rtf.~1
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\.net reflector desktop\red gate\.net reflector\desktop 10.2\cecil_license.txt.~1
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\.net reflector desktop\.net reflector desktop_10.2.3.1841_x86.msi.~1
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\install.data0.txt
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\.net reflector desktop\red gate\.net reflector\desktop 10.2\redgate.licensing.client.ui.dll.~1
%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\install.datadf1993f8aa26439e90929e474485764b.txt

Сетевая активность

Подключается к

'fe######sage.red-gate.com':443

TCP

Запросы HTTP GET

http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt

'pr######sage.red-gate.com':443

UDP

DNS ASK microsoft.com
DNS ASK pr######sage.red-gate.com
DNS ASK fe######sage.red-gate.com

Другое

Создает и запускает на исполнение

'%TEMP%\gdbrgm.exe'
'%TEMP%\uhibw.exe'
'%TEMP%\{99896269-be31-499e-95ec-37d8c30c59fd}\redgate.installer.ui.app.exe' RG_I="Red Gate Software Ltd."
'<SYSTEM32>\wisptis.exe' /ManualLaunch;' (со скрытым окном)

Запускает на исполнение

'<SYSTEM32>\wisptis.exe' /ManualLaunch;

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней