Trojan.DownLoader36.16167

Техническая информация

Вредоносные функции

Запускает на исполнение

'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name = "Interezen Process" dir=in action=allow program="%ProgramFiles(x86)%\IPinside_LWS\I3GProc.exe" enable=yes

Изменения в файловой системе

Создает следующие файлы

%ProgramFiles(x86)%\ipinside_lws\interezen-rootca.crt
%ProgramFiles(x86)%\ipinside_lws\vcredist_x86.exe
%ProgramFiles(x86)%\ipinside_lws\interezen_sha1.crt
%ProgramFiles(x86)%\ipinside_lws\interezen_sha1.opt
%ProgramFiles(x86)%\ipinside_lws\interezenk_sha1.opt
%ProgramFiles(x86)%\ipinside_lws\interezen-rootca_sha1.crt
%ProgramFiles(x86)%\ipinside_lws\interezen.crt
%ProgramFiles(x86)%\ipinside_lws\interezen.opt
%ProgramFiles(x86)%\ipinside_lws\interezenk.opt
%ProgramFiles(x86)%\ipinside_lws\i3gsvcmanager.exe
D:\c690e9db41a696077d814913f59949\vc_red.msi
%WINDIR%\installer\$patchcache$\managed\2a868788ed6d5523aa29aab0a5958b47\9.0.30729\fl_msdia71_dll_2_60035_x86_ln.3643236f_fc70_11d3_a536_0090278a1bb8
D:\c690e9db41a696077d814913f59949\install.exe
D:\c690e9db41a696077d814913f59949\install.res.1042.dll
D:\c690e9db41a696077d814913f59949\eula.1042.txt
D:\c690e9db41a696077d814913f59949\globdata.ini
D:\c690e9db41a696077d814913f59949\install.ini
D:\c690e9db41a696077d814913f59949\vcredist.bmp
D:\c690e9db41a696077d814913f59949\$shtdwn$.req
%TEMP%\dd_vcredistui381e.txt
%TEMP%\dd_vcredistmsi381e.txt
%ProgramFiles(x86)%\ipinside_lws\i3gmainsvc.exe
D:\c690e9db41a696077d814913f59949\vc_red.cab
%ProgramFiles(x86)%\ipinside_lws\i3gmanager.dll
%ProgramFiles(x86)%\ipinside_lws\certfr\libplc4.dll
%ProgramFiles(x86)%\ipinside_lws\cosa.dll
%ProgramFiles(x86)%\ipinside_lws\i3gescp.dll
%ProgramFiles(x86)%\ipinside_lws\i3gex.exe
%ProgramFiles(x86)%\ipinside_lws\ssleay32.dll
%ProgramFiles(x86)%\ipinside_lws\libeay32.dll
%ProgramFiles(x86)%\ipinside_lws\certmgr.exe
%ProgramFiles(x86)%\ipinside_lws\certfr\certutil.exe
%ProgramFiles(x86)%\ipinside_lws\certfr\freebl3.dll
%ProgramFiles(x86)%\ipinside_lws\certfr\libnspr4.dll
%ProgramFiles(x86)%\ipinside_lws\certfr\libplds4.dll
%ProgramFiles(x86)%\ipinside_lws\i3gproc.exe
%ProgramFiles(x86)%\ipinside_lws\certfr\nss3.dll
%ProgramFiles(x86)%\ipinside_lws\certfr\nssckbi.dll
%ProgramFiles(x86)%\ipinside_lws\certfr\nssdbm3.dll
%ProgramFiles(x86)%\ipinside_lws\certfr\nssutil3.dll
%ProgramFiles(x86)%\ipinside_lws\certfr\smime3.dll
%ProgramFiles(x86)%\ipinside_lws\certfr\softokn3.dll
%ProgramFiles(x86)%\ipinside_lws\certfr\sqlite3.dll
%ProgramFiles(x86)%\ipinside_lws\certfr\ssl3.dll
%WINDIR%\hipiw.dll
%ProgramFiles(x86)%\ipinside_lws\i3ginit.exe
%TEMP%\vwlb25d.tmp

Присваивает атрибут 'скрытый' для следующих файлов

%WINDIR%\hipiw.dll

Удаляет следующие файлы

%TEMP%\vwlb25d.tmp
D:\c690e9db41a696077d814913f59949\vcredist.bmp
D:\c690e9db41a696077d814913f59949\install.ini
D:\c690e9db41a696077d814913f59949\globdata.ini
D:\c690e9db41a696077d814913f59949\eula.1042.txt
D:\c690e9db41a696077d814913f59949\install.res.1042.dll
D:\c690e9db41a696077d814913f59949\install.exe
D:\c690e9db41a696077d814913f59949\vc_red.msi
D:\c690e9db41a696077d814913f59949\vc_red.cab

Сетевая активность

TCP

Запросы HTTP GET

http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
http://oc##.#tartssl.com/sub/class2/code/ca/MEMwQTA%2FMD0wOzAJBgUrDgMCGgUABBQSOgrhRCSnWfKxoWTjWxhk8hga9AQU0E4PQJlsuEsZbzsouODjiAc0qrcCAhAV

UDP

DNS ASK microsoft.com
DNS ASK oc##.#tartssl.com

Другое

Создает и запускает на исполнение

'%ProgramFiles(x86)%\ipinside_lws\vcredist_x86.exe' /q:a /c:"msiexec /i vcredist.msi /qn /l*v %temp%credist_x86.log"
'D:\c690e9db41a696077d814913f59949\install.exe' /q:a /c:"msiexec /i vcredist.msi /qn /l*v %temp%credist_x86.log"
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name = "Interezen Process" dir=in action=allow program="%ProgramFiles(x86)%\IPinside_LWS\I3GProc.exe" enable=yes' (со скрытым окном)
'%ProgramFiles(x86)%\ipinside_lws\vcredist_x86.exe' /q:a /c:"msiexec /i vcredist.msi /qn /l*v %temp%credist_x86.log"' (со скрытым окном)