Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'Cisco AnyConnect Secure Mobility Agent for Windows' = '"%ProgramFiles(x86)%\Cisco\Cisco AnyConnect Secure Mobility Client\vpn...
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'GrpConv' = 'grpconv -o'
Устанавливает следующие настройки сервисов
- [<HKLM>\System\CurrentControlSet\Services\vpnagent] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\vpnagent] 'ImagePath' = '"%ProgramFiles(x86)%\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe"'
- [<HKLM>\System\CurrentControlSet\Services\acsock] 'ImagePath' = 'system32\DRIVERS\acsock64.sys'
- [<HKLM>\System\CurrentControlSet\Services\vpnva] 'ImagePath' = 'system32\DRIVERS\vpnva64-6.sys'
Создает следующие сервисы
- 'vpnagent' "%ProgramFiles(x86)%\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe"
- 'vpnagent' %ProgramFiles(x86)%\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe
- 'acsock' system32\DRIVERS\acsock64.sys
- 'vpnva' system32\DRIVERS\vpnva64-6.sys
Вредоносные функции
Создает и запускает на исполнение
- '%ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\installhelper.exe' -moveIfExist "%ALLUSERSPROFILE%\\Cisco\Cisco AnyConnect VPN Client\preferences_global.xml" "%ALLUSERSPROFILE%\Cisco\Cisco AnyConnect Secure Mobility Client\\preferences_global.xml"
- '%ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\installhelper.exe' -moveIfExist "%LOCALAPPDATA%\\Cisco\Cisco AnyConnect VPN Client\preferences.xml" "%LOCALAPPDATA%\Cisco\Cisco AnyConnect Secure Mobility Client\\preferences.xml"
- '%ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\installhelper.exe' -moveFiles "%ALLUSERSPROFILE%\\Cisco\Cisco AnyConnect VPN Client\Profile\\" "%ALLUSERSPROFILE%\Cisco\Cisco AnyConnect Secure Mobility Client\\Profile\\" "*.xml"
- '%ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\installhelper.exe' -moveFiles "%ALLUSERSPROFILE%\\Cisco\Cisco AnyConnect VPN Client\Script\\" "%ALLUSERSPROFILE%\Cisco\Cisco AnyConnect Secure Mobility Client\\Script\\" "*.*"
- '%ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\installhelper.exe' -moveFiles "%ALLUSERSPROFILE%\\Cisco\Cisco AnyConnect VPN Client\l10n\\" "%ALLUSERSPROFILE%\Cisco\Cisco AnyConnect Secure Mobility Client\\l10n\\" "*.*"
- '%ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\installhelper.exe' -copyFiles "%HOMEPATH%\Downloads\Profiles\\" "%ALLUSERSPROFILE%\Cisco\Cisco AnyConnect Secure Mobility Client\\" "AnyConnectLocalPolicy.xml"
- '%ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\installhelper.exe' -copyFiles "%HOMEPATH%\Downloads\Profiles\vpn\\" "%ALLUSERSPROFILE%\Cisco\Cisco AnyConnect Secure Mobility Client\\Profile\\" "*.xml"
- '%ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\installhelper.exe' -copyFiles "%HOMEPATH%\Downloads\Profiles\feedback\\" "%ALLUSERSPROFILE%\Cisco\Cisco AnyConnect Secure Mobility Client\CustomerExperienceFeedback\\" "CustomerExperience_Feedback.xml"
- '%ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\vacon64.exe' kdf -install "%ProgramFiles(x86)%\Cisco\Cisco AnyConnect Secure Mobility Client\\" acsock
- '%ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\installhelper.exe' -acpolgen bd=false fm=false rpc=false rtp=false rwl=false sct=false epf=false ewn=false emn=false efn=false upsu=true upcu=true upvp=true upip=true upsp=true upal= ecc=false
- '%ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\vpnagent.exe'
- '%ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\vacon64.exe' -install "%ProgramFiles(x86)%\Cisco\Cisco AnyConnect Secure Mobility Client\\vpnva-6.inf" VPNVA
- '%ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\installhelper.exe' -createLink "%ProgramFiles(x86)%\Cisco\Cisco AnyConnect VPN Client\vpndownloader.exe" "%ProgramFiles(x86)%\Cisco\Cisco AnyConnect Secure Mobility Client\vpndownloader.exe"
- '%ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\installhelper.exe' -createLink "%ALLUSERSPROFILE%\Cisco\Cisco AnyConnect VPN Client\update.txt" "%ALLUSERSPROFILE%\Cisco\Cisco AnyConnect Secure Mobility Client\update.txt"
- '%ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\installhelper.exe' -acl "%ALLUSERSPROFILE%\Cisco\Cisco AnyConnect Secure Mobility Client\\" -r
- '%ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\manifesttool.exe' -i "%ALLUSERSPROFILE%\Cisco\Cisco AnyConnect Secure Mobility Client\\" "%ALLUSERSPROFILE%\Cisco\Cisco AnyConnect Secure Mobility Client\VPNManifestClient.xml"
Изменения в файловой системе
Создает следующие файлы
- %WINDIR%\temp\cab3850.tmp
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\app_logo.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\company_logo_alt.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\vpn_logo.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\toolbar_prefs.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\toolbar_help.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\toolbar.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\plugins\acfeedback.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\vpn_connected.ico
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\transition_2.ico
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\toolbar_prefs_hover.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\transition_1.ico
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\neutral.ico
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\error.ico
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\attention.ico
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\about_hover.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\status_ico_trusted.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\opensource.html
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\transition_3.ico
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\ac_sock_fltr_api.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\toolbar_help_hover.png
- %TEMP%\{403bbff1-b057-5d1b-76a2-823c43bacf48}\set7178.tmp
- %TEMP%\{403bbff1-b057-5d1b-76a2-823c43bacf48}\set6ab4.tmp
- %ALLUSERSPROFILE%\cisco\cisco anyconnect secure mobility client\anyconnectlocalpolicy.xml
- %WINDIR%\temp\udd472d.tmp
- <DRIVERS>\set3a61.tmp
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\cisco\cisco anyconnect secure mobility client\~isco anyconnect secure mobility client.tmp
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\cisco\cisco anyconnect secure mobility client\cisco anyconnect secure mobility client.lnk
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\installhelper64.exe
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\uninstall.exe
- %ALLUSERSPROFILE%\cisco\cisco anyconnect secure mobility client\eula.txt
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\status_ico_noncompliant.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\noncompliant.ico
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\vpnva64-6.sys
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\vpnva-6.inf
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\vpnva-6.cat
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\toast_vpn.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\toast_nam.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\toolbar_about_hover.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\plugins\vpnapishim.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\toolbar_about.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\mftogglebtn-down-solid.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\gradient.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\about.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\vpncommon.dll
- %ALLUSERSPROFILE%\cisco\cisco anyconnect secure mobility client\update.txt
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\vpndownloader.exe
- %ALLUSERSPROFILE%\cisco\cisco anyconnect secure mobility client\profile\anyconnectprofile.xsd
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\vacon64.exe
- %ALLUSERSPROFILE%\microsoft\event viewer\views\cisco\ciscoanyconnect.xml
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\vpncommoncrypt.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\acciscossl.dll
- %TEMP%\{403bbff1-b057-5d1b-76a2-823c43bacf48}\set7244.tmp
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\vpncli.exe
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\zlib1.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\vpnui.exe
- %WINDIR%\syswow64\vpnevents.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\vpnagent.exe
- %HOMEPATH%\downloads\cisco.msi
- %WINDIR%\temp\27b69.mst
- %WINDIR%\temp\27b68.mst
- %WINDIR%\temp\tar3851.tmp
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\acciscocrypto.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\plugins\acdownloader.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\vpnapi.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\vpnagentutilities.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\gui.ico
- %ALLUSERSPROFILE%\cisco\cisco anyconnect secure mobility client\vpnmanifestclient.xml
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\status_ico_transition.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\status_ico_neutral.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\status_ico_good.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\status_ico_error.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\status_ico_attention.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\acsock64.inf
- %ALLUSERSPROFILE%\cisco\cisco anyconnect secure mobility client\anyconnectlocalpolicy.xsd
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\acsock64.cat
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\installhelper.exe
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\mftogglebtn-down.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\mftogglebtn.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\company_logo.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\manifesttool.exe
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\cues_bg.jpg
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\plugins\vpnipsec.dll
- %WINDIR%\syswow64\vpncategories.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\acsock64.sys
- <SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem2.cat
Присваивает атрибут 'скрытый' для следующих файлов
- <SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem2.cat
Удаляет следующие файлы
- %WINDIR%\temp\cab3850.tmp
- %WINDIR%\temp\tar3851.tmp
- %WINDIR%\temp\27b68.mst
- %WINDIR%\temp\27b69.mst
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\cisco\cisco anyconnect secure mobility client\cisco anyconnect secure mobility client.lnk~rf112bf0.tmp
- %WINDIR%\temp\udd472d.tmp
- %TEMP%\{403bbff1-b057-5d1b-76a2-823c43bacf48}\vpnva-6.cat
- %TEMP%\{403bbff1-b057-5d1b-76a2-823c43bacf48}\vpnva-6.inf
- %TEMP%\{403bbff1-b057-5d1b-76a2-823c43bacf48}\vpnva64-6.sys
Перемещает следующие файлы
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\cisco\cisco anyconnect secure mobility client\cisco anyconnect secure mobility client.lnk в %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\cisco\cisco anyconnect secure mobility client\cisco anyconnect secure mobility client.lnk~rf112bf0.tmp
- <DRIVERS>\set3a61.tmp в <DRIVERS>\acsock64.sys
- %TEMP%\{403bbff1-b057-5d1b-76a2-823c43bacf48}\set6ab4.tmp в %TEMP%\{403bbff1-b057-5d1b-76a2-823c43bacf48}\vpnva64-6.sys
- %TEMP%\{403bbff1-b057-5d1b-76a2-823c43bacf48}\set7178.tmp в %TEMP%\{403bbff1-b057-5d1b-76a2-823c43bacf48}\vpnva-6.cat
- %TEMP%\{403bbff1-b057-5d1b-76a2-823c43bacf48}\set7244.tmp в %TEMP%\{403bbff1-b057-5d1b-76a2-823c43bacf48}\vpnva-6.inf
Изменяет следующие файлы
- %LOCALAPPDATA%\microsoft\windows\explorer\explorerstartuplog_runonce.etl
Подменяет следующие файлы
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\cisco\cisco anyconnect secure mobility client\cisco anyconnect secure mobility client.lnk
Сетевая активность
Подключается к
- 'microsoft.com':80
- 'vc#######re.s3.amazonaws.com':80
- 'mu#.#isco.com':80
UDP
- DNS ASK microsoft.com
- DNS ASK vc#######re.s3.amazonaws.com
- DNS ASK mu#.#isco.com
Другое
Запускает на исполнение
- '<SYSTEM32>\msiexec.exe' /i "%HOMEPATH%\Downloads\Cisco.msi" /qn
- '%WINDIR%\syswow64\msiexec.exe' /Y "%ProgramFiles(x86)%\Cisco\Cisco AnyConnect Secure Mobility Client\vpnapi.dll"
- '<SYSTEM32>\runonce.exe' -r
- '<SYSTEM32>\grpconv.exe' -o
