Trojan.Siggen6.54592

Техническая информация

Вредоносные функции

Запускает на исполнение

'%WINDIR%\syswow64\net.exe' stop TeamViewer
'%WINDIR%\syswow64\taskkill.exe' /im teamviewer.exe /f /t

Изменения в файловой системе

Создает следующие файлы

%WINDIR%\temp\teamviewer\teamviewer.ini
%WINDIR%\temp\teamviewer\teamviewer_resource_th.dll
%WINDIR%\temp\teamviewer\teamviewer_resource_tr.dll
%WINDIR%\temp\teamviewer\teamviewer_resource_uk.dll
%WINDIR%\temp\teamviewer\teamviewer_resource_vi.dll
%WINDIR%\temp\teamviewer\teamviewer_resource_zhcn.dll
%WINDIR%\temp\teamviewer\teamviewer_resource_zhtw.dll
%WINDIR%\temp\teamviewer\teamviewer.exe
%WINDIR%\temp\teamviewer\teamviewer_desktop.exe
%WINDIR%\temp\teamviewer\tv_w32.exe
%WINDIR%\temp\teamviewer\teamviewer_resource_sr.dll
%WINDIR%\temp\teamviewer\teamviewer_resource_sv.dll
%WINDIR%\temp\teamviewer\tv_x64.exe
%WINDIR%\temp\teamviewer\tv_w32.dll
%WINDIR%\temp\teamviewer\tv_x64.dll
%WINDIR%\temp\teamviewer\tvidcl.exe
%WINDIR%\temp\cab710a.tmp
%WINDIR%\temp\tar711b.tmp
%WINDIR%\temp\cab734d.tmp
%WINDIR%\temp\tar734e.tmp
%WINDIR%\temp\cab73bc.tmp
%WINDIR%\temp\tar73bd.tmp
%WINDIR%\temp\teamviewer\teamviewer_resource_ru.dll
%WINDIR%\temp\teamviewer\teamviewer_staticres.dll
%WINDIR%\temp\teamviewer\teamviewer_resource_sk.dll
%WINDIR%\temp\teamviewer\teamviewer_resource_ro.dll
%WINDIR%\temp\teamviewer\teamviewer_resource_pt.dll
%WINDIR%\temp\teamviewer\tv.ini
%WINDIR%\temp\teamviewer\teamviewer_resource_ar.dll
%WINDIR%\temp\teamviewer\teamviewer_resource_bg.dll
%WINDIR%\temp\teamviewer\teamviewer_resource_cs.dll
%WINDIR%\temp\teamviewer\teamviewer_resource_da.dll
%WINDIR%\temp\teamviewer\teamviewer_resource_de.dll
%WINDIR%\temp\teamviewer\teamviewer_resource_el.dll
%WINDIR%\temp\teamviewer\teamviewer_resource_en.dll
%WINDIR%\temp\teamviewer\teamviewer_resource_es.dll
%WINDIR%\temp\teamviewer\teamviewer_resource_fi.dll
%WINDIR%\temp\teamviewer\teamviewer11.otf
%WINDIR%\temp\teamviewer\teamviewer_resource_fr.dll
%WINDIR%\temp\teamviewer\teamviewer_resource_hr.dll
%WINDIR%\temp\teamviewer\teamviewer_resource_hu.dll
%WINDIR%\temp\teamviewer\teamviewer_resource_id.dll
%WINDIR%\temp\teamviewer\teamviewer_resource_it.dll
%WINDIR%\temp\teamviewer\teamviewer_resource_ja.dll
%WINDIR%\temp\teamviewer\teamviewer_resource_ko.dll
%WINDIR%\temp\teamviewer\teamviewer_resource_lt.dll
%WINDIR%\temp\teamviewer\teamviewer_resource_nl.dll
%WINDIR%\temp\teamviewer\teamviewer_resource_no.dll
%WINDIR%\temp\teamviewer\teamviewer_resource_pl.dll
%WINDIR%\temp\teamviewer\teamviewer_resource_he.dll
%WINDIR%\temp\cab74f6.tmp
%WINDIR%\temp\tar7507.tmp

Удаляет следующие файлы

%WINDIR%\temp\cab710a.tmp
%WINDIR%\temp\tar711b.tmp
%WINDIR%\temp\cab734d.tmp
%WINDIR%\temp\tar734e.tmp
%WINDIR%\temp\cab73bc.tmp
%WINDIR%\temp\tar73bd.tmp
%WINDIR%\temp\cab74f6.tmp
%WINDIR%\temp\tar7507.tmp

Изменяет следующие файлы

%LOCALAPPDATA%\microsoft\windows\usrclass.dat.log1
%LOCALAPPDATA%\microsoft\windows\usrclass.dat
C:\system volume information\syscache.hve.log1
C:\system volume information\syscache.hve

Сетевая активность

Подключается к

'pi###.#eamviewer.com':5938
'ma#####.teamviewer.com':5938
'at#########r002.router.teamviewer.com':5938
'cl####.teamviewer.com':443
'localhost':49187

TCP

Другие

'pi###.#eamviewer.com':5938
'ma#####.teamviewer.com':5938
'at#########r002.router.teamviewer.com':5938
'localhost':49187
'cl####.teamviewer.com':443

UDP

DNS ASK pi###.#eamviewer.com
DNS ASK ma#####.teamviewer.com
DNS ASK at#########r002.router.teamviewer.com
DNS ASK cl####.teamviewer.com

Другое

Ищет следующие окна

ClassName: '' WindowName: ''
ClassName: '' WindowName: 'TeamViewer Manager'
ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebCheckMonitor' WindowName: ''

Создает и запускает на исполнение

'%WINDIR%\temp\teamviewer\tvidcl.exe'
'%WINDIR%\temp\teamviewer\teamviewer.exe'
'%WINDIR%\temp\teamviewer\tv_w32.exe' --action hooks --deferlog --log %APPDATA%\TeamViewer\TeamViewer11_Logfile.log
'%WINDIR%\temp\teamviewer\tv_x64.exe' --action hooks --deferlog --log %APPDATA%\TeamViewer\TeamViewer11_Logfile.log

Запускает на исполнение

'%WINDIR%\syswow64\cmd.exe' /c net stop TeamViewer (со скрытым окном)
'%WINDIR%\syswow64\net1.exe' stop TeamViewer
'%WINDIR%\syswow64\cmd.exe' /c sc delete TeamViewer (со скрытым окном)
'%WINDIR%\syswow64\sc.exe' delete TeamViewer
'%WINDIR%\syswow64\cmd.exe' /c taskkill /im teamviewer.exe /f /t (со скрытым окном)
'%WINDIR%\syswow64\cmd.exe' /c start teamviewer.exe (со скрытым окном)