Trojan.DownLoader9.61622

Техническая информация

Вредоносные функции:

Создает и запускает на исполнение:

'%TEMP%\TeamViewer\Version6\TeamViewer.exe'
'C:\temp1\anthem\TeamViewerQS.exe'

Запускает на исполнение:

'<SYSTEM32>\find.exe' /I /N "teamviewer.exe"
'<SYSTEM32>\taskkill.exe' /f /im teamviewer.exe
'<SYSTEM32>\cmd.exe' /c ""c:\temp1\anthem\teamviewer.bat" "
'<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq teamviewer.exe"

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\Cab18.tmp
%TEMP%\Cab1A.tmp
%TEMP%\Cab14.tmp
%TEMP%\Cab16.tmp
%TEMP%\Cab20.tmp
%TEMP%\Cab22.tmp
%TEMP%\Cab1C.tmp
%TEMP%\Cab1E.tmp
%TEMP%\Cab8.tmp
%TEMP%\CabA.tmp
%TEMP%\Cab4.tmp
%TEMP%\Cab6.tmp
%TEMP%\Cab10.tmp
%TEMP%\Cab12.tmp
%TEMP%\CabC.tmp
%TEMP%\CabE.tmp
%TEMP%\Cab38.tmp
%APPDATA%\TeamViewer\TeamViewer6_Logfile.log
%TEMP%\Cab34.tmp
%TEMP%\Cab36.tmp
%TEMP%\Cab3E.tmp
%TEMP%\Cab40.tmp
%TEMP%\Cab3A.tmp
%TEMP%\Cab3C.tmp
%TEMP%\Cab28.tmp
%TEMP%\Cab2A.tmp
%TEMP%\Cab24.tmp
%TEMP%\Cab26.tmp
%TEMP%\Cab30.tmp
%TEMP%\Cab32.tmp
%TEMP%\Cab2C.tmp
%TEMP%\Cab2E.tmp
%TEMP%\TeamViewer\Version6\x64\TVMonitor.inf
%TEMP%\TeamViewer\Version6\x86\TVMonitor.inf
%TEMP%\TeamViewer\Version6\x64\tvmonitor.cat
%TEMP%\TeamViewer\Version6\x86\tvmonitor.cat
%TEMP%\TeamViewer\Version6\TeamViewer_Service.exe
%TEMP%\TeamViewer\Version6\tv_w32.exe
%TEMP%\TeamViewer\Version6\TeamViewer.exe
%TEMP%\TeamViewer\Version6\TeamViewer_Desktop.exe
C:\temp1\anthem\closetv.bat
%TEMP%\nsj2.tmp
C:\temp1\anthem\teamviewer.bat
C:\temp1\anthem\TeamViewerQS.exe
%TEMP%\TeamViewer\Version6\tvqsfiles.7z
%TEMP%\nsj3.tmp\nsis7z.dll
%TEMP%\nsj3.tmp\TvGetVersion.dll
%TEMP%\nsj3.tmp\System.dll
%TEMP%\TeamViewer\Version6\TeamViewer98.ini
%TEMP%\TeamViewer\Version6\tvinfo.ini
%TEMP%\TeamViewer\Version6\logo.bmp
%TEMP%\TeamViewer\Version6\TeamViewer.ini
%APPDATA%\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
%APPDATA%\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
%APPDATA%\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004
%APPDATA%\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004
%TEMP%\TeamViewer\Version6\tv_w32.dll
%TEMP%\TeamViewer\Version6\tv_x64.dll
%TEMP%\TeamViewer\Version6\tv_x64.exe
%TEMP%\TeamViewer\Version6\TeamViewer_Resource_en.dll
%TEMP%\nsj3.tmp\ReadCustomerData.dll
%TEMP%\TeamViewer\Version6\custom.7z
%TEMP%\TeamViewer\Version6\x64\TVMonitor.sys
%TEMP%\TeamViewer\Version6\x86\TVMonitor.sys

Удаляет следующие файлы:

%TEMP%\Cab28.tmp
%TEMP%\Cab26.tmp
%TEMP%\Cab2C.tmp
%TEMP%\Cab2A.tmp
%TEMP%\Cab24.tmp
%TEMP%\Cab1E.tmp
%TEMP%\Cab1C.tmp
%TEMP%\Cab22.tmp
%TEMP%\Cab20.tmp
%TEMP%\Cab2E.tmp
%TEMP%\Cab3C.tmp
%TEMP%\Cab3A.tmp
%TEMP%\Cab40.tmp
%TEMP%\Cab3E.tmp
%TEMP%\Cab38.tmp
%TEMP%\Cab32.tmp
%TEMP%\Cab30.tmp
%TEMP%\Cab36.tmp
%TEMP%\Cab34.tmp
%TEMP%\nsj3.tmp\TvGetVersion.dll
%TEMP%\nsj3.tmp\System.dll
%TEMP%\Cab6.tmp
%TEMP%\Cab4.tmp
%TEMP%\nsj3.tmp\ReadCustomerData.dll
%TEMP%\TeamViewer\Version6\custom.7z
%TEMP%\TeamViewer\Version6\tvqsfiles.7z
%TEMP%\nsj3.tmp\nsis7z.dll
%TEMP%\TeamViewer\Version6\TeamViewer98.ini
%TEMP%\Cab8.tmp
%TEMP%\Cab16.tmp
%TEMP%\Cab14.tmp
%TEMP%\Cab1A.tmp
%TEMP%\Cab18.tmp
%TEMP%\Cab12.tmp
%TEMP%\CabC.tmp
%TEMP%\CabA.tmp
%TEMP%\Cab10.tmp
%TEMP%\CabE.tmp

Сетевая активность:

Подключается к:

'pi###.#eamviewer.com':80
'pi###.#eamviewer.com':443
'ma#####.teamviewer.com':80
'ma#####4.teamviewer.com':80
'www.download.windowsupdate.com':80
'wp#d':80
'pi###.#eamviewer.com':5938
'localhost':1039

TCP:

Запросы HTTP GET:

ma#####.teamviewer.com/din.aspx?s=####################################################
ma#####4.teamviewer.com/din.aspx?s=####################################################
ma#####.teamviewer.com/din.aspx?s=###################################################
pi###.#eamviewer.com/din.aspx?s=#################################################
pi###.#eamviewer.com/din.aspx?s=####################################################
www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt
wp#d/wpad.dat
pi###.#eamviewer.com/din.aspx?s=###################################################
www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab

UDP: