Trojan.DownLoader11.43978

Техническая информация

Для обеспечения автозапуска и распространения:

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\mv2] 'Start' = '00000001'

Вредоносные функции:

Создает и запускает на исполнение:

'%TEMP%\VNC\driver\xp\setupdrv.exe' install
'%TEMP%\VNC\cert\CertMgr.Exe' -add vnc_cer.cer -c -s -r localMachine TrustedPublisher

Запускает на исполнение:

'<SYSTEM32>\secedit.exe' /configure /db %TEMP%\secedit.sdb /cfg %TEMP%\VNC\secedit.inf /quiet

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\VNC\driver\vista64\setupdrv.exe
%TEMP%\aut54.tmp
%TEMP%\VNC\driver\vista\driver\mv2.sys
%TEMP%\aut55.tmp
%TEMP%\VNC\driver\vista64\driver\mv2.dll
%TEMP%\aut56.tmp
%TEMP%\VNC\driver\vista64\driver\mv2.cat
%TEMP%\aut51.tmp
%TEMP%\VNC\driver\vista\driver\mv2.cat
%TEMP%\aut50.tmp
%TEMP%\VNC\driver\vista\driver\mv2.dll
%TEMP%\aut53.tmp
%TEMP%\VNC\driver\vista\driver\mv2.inf
%TEMP%\aut52.tmp
%TEMP%\VNC\driver\w2K\driver\mv2.dll
%TEMP%\aut5B.tmp
%TEMP%\VNC\driver\w2K\driver\mv2.cat
%TEMP%\aut5C.tmp
%TEMP%\VNC\driver\w2K\driver\mv2.sys
%TEMP%\aut5D.tmp
%TEMP%\VNC\driver\w2K\driver\mv2.inf
%TEMP%\aut58.tmp
%TEMP%\VNC\driver\vista64\driver\mv2.inf
%TEMP%\aut57.tmp
%TEMP%\VNC\driver\vista64\driver\mv2.sys
%TEMP%\aut5A.tmp
%TEMP%\VNC\driver\w2K\setupdrv.exe
%TEMP%\aut59.tmp
%TEMP%\VNC\driver\vista\setupdrv.exe
%TEMP%\aut45.tmp
%TEMP%\VNC\Install_win8_x86\ldapauth.dll
%TEMP%\aut44.tmp
%TEMP%\VNC\Install_win8_x86\logging.dll
%TEMP%\aut47.tmp
%TEMP%\VNC\Install_win8_x86\logmessages.dll
%TEMP%\aut46.tmp
%TEMP%\aut41.tmp
%TEMP%\VNC\Install_win8_x86\MSLogonACL.exe
%TEMP%\aut40.tmp
%TEMP%\aut42.tmp
%TEMP%\VNC\Install_win8_x86\authSSP.dll
%TEMP%\aut43.tmp
%TEMP%\VNC\Install_win8_x86\authadmin.dll
%TEMP%\aut4D.tmp
%TEMP%\VNC\Install_win8_x86\repeater.exe
%TEMP%\aut4B.tmp
%TEMP%\VNC\cert\CertMgr.Exe
%TEMP%\aut4F.tmp
%TEMP%\VNC\cert\vnc_cer.cer
%TEMP%\aut4E.tmp
%TEMP%\VNC\Install_win8_x86\vnchooks.dll
%TEMP%\aut48.tmp
%TEMP%\VNC\Install_win8_x86\SCHook.dll
%TEMP%\aut49.tmp
%TEMP%\VNC\Install_win8_x86\SecureVNCPlugin.dsm
%TEMP%\aut4A.tmp
%TEMP%\VNC\Install_win8_x86\workgrpdomnt4.dll
%WINDIR%\security\tmp.edb
%WINDIR%\security\edb.log
%WINDIR%\security\res1.log
%WINDIR%\security\edb.chk
%APPDATA%\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004
%APPDATA%\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004
%TEMP%\secedit.sdb
%PROGRAM_FILES%\UltraVNC\vnchooks.dll
%PROGRAM_FILES%\UltraVNC\setcad.exe
%PROGRAM_FILES%\UltraVNC\SecureVNCPlugin.dsm
%PROGRAM_FILES%\UltraVNC\winvnc.exe
%WINDIR%\security\res2.log
%WINDIR%\security\edbtmp.log
%PROGRAM_FILES%\UltraVNC\workgrpdomnt4.dll
%WINDIR%\inf\oem3.inf
%TEMP%\Cab76.tmp
%TEMP%\Cab74.tmp
%WINDIR%\inf\oem3.PNF
%TEMP%\Cab7A.tmp
<SYSTEM32>\SET79.tmp
<DRIVERS>\SET78.tmp
%TEMP%\Cab68.tmp
%APPDATA%\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
%APPDATA%\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
%TEMP%\Cab6A.tmp
%TEMP%\Cab72.tmp
%TEMP%\Cab70.tmp
%TEMP%\Cab6C.tmp
%PROGRAM_FILES%\UltraVNC\SCHook.dll
%TEMP%\VNC\driver\xp\driver\mv2.sys
%TEMP%\aut62.tmp
%TEMP%\VNC\driver\xp\driver\mv2.inf
%TEMP%\aut63.tmp
%TEMP%\VNC\driver\xp64\driver\mv2.cat
%TEMP%\aut64.tmp
%TEMP%\VNC\driver\xp64\setupdrv.exe
%TEMP%\aut5F.tmp
%TEMP%\VNC\driver\xp\setupdrv.exe
%TEMP%\aut5E.tmp
%TEMP%\VNC\driver\xp\driver\mv2.cat
%TEMP%\aut61.tmp
%TEMP%\VNC\driver\xp\driver\mv2.dll
%TEMP%\aut60.tmp
%PROGRAM_FILES%\UltraVNC\logging.dll
%PROGRAM_FILES%\UltraVNC\ldapauth.dll
%PROGRAM_FILES%\UltraVNC\authSSP.dll
%PROGRAM_FILES%\UltraVNC\logmessages.dll
%PROGRAM_FILES%\UltraVNC\sas.dll
%PROGRAM_FILES%\UltraVNC\repeater.exe
%PROGRAM_FILES%\UltraVNC\MSLogonACL.exe
%TEMP%\aut66.tmp
%TEMP%\VNC\driver\xp64\driver\mv2.dll
%TEMP%\aut65.tmp
%TEMP%\VNC\driver\xp64\driver\mv2.inf
%PROGRAM_FILES%\UltraVNC\authadmin.dll
%TEMP%\VNC\driver\xp64\driver\mv2.sys
%TEMP%\aut67.tmp
%TEMP%\aut16.tmp
%TEMP%\VNC\Install_2000\authSSP.dll
%TEMP%\aut15.tmp
%TEMP%\VNC\Install_2000\ldapauth.dll
%TEMP%\aut18.tmp
%TEMP%\VNC\Install_2000\logging.dll
%TEMP%\aut17.tmp
%TEMP%\VNC\Install_2000\winvnc.exe
%TEMP%\aut12.tmp
%TEMP%\VNC\Install\repeater.exe
%TEMP%\aut13.tmp
%TEMP%\VNC\Install_2000\authadmin.dll
%TEMP%\aut14.tmp
%TEMP%\VNC\Install_2000\MSLogonACL.exe
%TEMP%\aut1E.tmp
%TEMP%\VNC\Install_2000\SecureVNCPlugin.dsm
%TEMP%\aut1C.tmp
%TEMP%\VNC\Install_2000\repeater.exe
%TEMP%\aut20.tmp
%TEMP%\VNC\Install_x64\winvnc.exe
%TEMP%\aut1F.tmp
%TEMP%\VNC\Install_2000\SCHook.dll
%TEMP%\aut19.tmp
%TEMP%\VNC\Install_2000\logmessages.dll
%TEMP%\aut1A.tmp
%TEMP%\VNC\Install_2000\workgrpdomnt4.dll
%TEMP%\aut1B.tmp
%TEMP%\VNC\Install_2000\vnchooks.dll
%TEMP%\aut11.tmp
%TEMP%\VNC\Install\winvnc.exe
%TEMP%\aut6.tmp
%TEMP%\VNC\Install\sas.dll
%TEMP%\aut7.tmp
%TEMP%\VNC\Install\authSSP.dll
%TEMP%\aut8.tmp
%TEMP%\VNC\Install\authadmin.dll
%TEMP%\aut3.tmp
%TEMP%\VNC\secedit.inf
%TEMP%\aut2.tmp
%TEMP%\VNC\Install\MSLogonACL.exe
%TEMP%\aut5.tmp
%TEMP%\VNC\Install\setcad.exe
%TEMP%\aut4.tmp
%TEMP%\VNC\Install\vnchooks.dll
%TEMP%\autD.tmp
%TEMP%\VNC\Install\SCHook.dll
%TEMP%\autE.tmp
%TEMP%\VNC\Install\SecureVNCPlugin.dsm
%TEMP%\autF.tmp
%TEMP%\VNC\Install\workgrpdomnt4.dll
%TEMP%\autA.tmp
%TEMP%\VNC\Install\ldapauth.dll
%TEMP%\aut9.tmp
%TEMP%\VNC\Install\logging.dll
%TEMP%\autC.tmp
%TEMP%\VNC\Install\logmessages.dll
%TEMP%\autB.tmp
%TEMP%\VNC\Install_win8_x64\ldapauth.dll
%TEMP%\aut35.tmp
%TEMP%\VNC\Install_win8_x64\authSSP.dll
%TEMP%\aut36.tmp
%TEMP%\VNC\Install_win8_x64\logmessages.dll
%TEMP%\aut37.tmp
%TEMP%\VNC\Install_win8_x64\logging.dll
%TEMP%\VNC\Install_win8_x64\MSLogonACL.exe
%TEMP%\aut31.tmp
%TEMP%\VNC\Install_win8_x64\setcad.exe
%TEMP%\aut32.tmp
%TEMP%\aut34.tmp
%TEMP%\VNC\Install_win8_x64\authadmin.dll
%TEMP%\aut33.tmp
%TEMP%\VNC\Install_win8_x64\repeater.exe
%TEMP%\aut3C.tmp
%TEMP%\VNC\Install_win8_x64\SecureVNCPlugin64.dsm
%TEMP%\aut3E.tmp
%TEMP%\VNC\Install_win8_x86\setcad.exe
%TEMP%\aut3F.tmp
%TEMP%\VNC\Install_win8_x86\winvnc.exe
%TEMP%\aut39.tmp
%TEMP%\VNC\Install_win8_x64\SCHook64.dll
%TEMP%\aut38.tmp
%TEMP%\VNC\Install_win8_x64\vnchooks.dll
%TEMP%\aut3B.tmp
%TEMP%\VNC\Install_win8_x64\workgrpdomnt4.dll
%TEMP%\aut3A.tmp
%TEMP%\aut30.tmp
%TEMP%\VNC\Install_x64\authSSP.dll
%TEMP%\aut25.tmp
%TEMP%\VNC\Install_x64\authadmin.dll
%TEMP%\aut26.tmp
%TEMP%\VNC\Install_x64\logging.dll
%TEMP%\aut27.tmp
%TEMP%\VNC\Install_x64\ldapauth.dll
%TEMP%\VNC\Install_x64\setcad.exe
%TEMP%\aut21.tmp
%TEMP%\VNC\Install_x64\MSLogonACL.exe
%TEMP%\aut22.tmp
%TEMP%\aut24.tmp
%TEMP%\aut23.tmp
%TEMP%\VNC\Install_x64\sas.dll
%TEMP%\VNC\Install_x64\SecureVNCPlugin64.dsm
%TEMP%\aut2C.tmp
%TEMP%\VNC\Install_x64\workgrpdomnt4.dll
%TEMP%\aut2D.tmp
%TEMP%\VNC\Install_win8_x64\winvnc.exe
%TEMP%\aut2F.tmp
%TEMP%\VNC\Install_x64\repeater.exe
%TEMP%\aut29.tmp
%TEMP%\VNC\Install_x64\logmessages.dll
%TEMP%\aut28.tmp
%TEMP%\VNC\Install_x64\SCHook64.dll
%TEMP%\aut2B.tmp
%TEMP%\VNC\Install_x64\vnchooks.dll
%TEMP%\aut2A.tmp

Удаляет следующие файлы:

%TEMP%\aut4B.tmp
%TEMP%\aut4D.tmp
%TEMP%\aut4E.tmp
%TEMP%\aut48.tmp
%TEMP%\aut49.tmp
%TEMP%\aut4A.tmp
%TEMP%\aut4F.tmp
%TEMP%\aut53.tmp
%TEMP%\aut54.tmp
%TEMP%\aut55.tmp
%TEMP%\aut50.tmp
%TEMP%\aut51.tmp
%TEMP%\aut52.tmp
%TEMP%\aut3E.tmp
%TEMP%\aut3F.tmp
%TEMP%\aut40.tmp
%TEMP%\aut3A.tmp
%TEMP%\aut3B.tmp
%TEMP%\aut3C.tmp
%TEMP%\aut41.tmp
%TEMP%\aut45.tmp
%TEMP%\aut46.tmp
%TEMP%\aut47.tmp
%TEMP%\aut42.tmp
%TEMP%\aut43.tmp
%TEMP%\aut44.tmp
%TEMP%\aut56.tmp
%TEMP%\aut67.tmp
%TEMP%\secedit.sdb
%TEMP%\Cab68.tmp
%TEMP%\aut64.tmp
%TEMP%\aut65.tmp
%TEMP%\aut66.tmp
%TEMP%\Cab6A.tmp
%TEMP%\Cab74.tmp
%TEMP%\Cab76.tmp
%TEMP%\Cab7A.tmp
%TEMP%\Cab6C.tmp
%TEMP%\Cab70.tmp
%TEMP%\Cab72.tmp
%TEMP%\aut5A.tmp
%TEMP%\aut5B.tmp
%TEMP%\aut5C.tmp
%TEMP%\aut57.tmp
%TEMP%\aut58.tmp
%TEMP%\aut59.tmp
%TEMP%\aut5D.tmp
%TEMP%\aut61.tmp
%TEMP%\aut62.tmp
%TEMP%\aut63.tmp
%TEMP%\aut5E.tmp
%TEMP%\aut5F.tmp
%TEMP%\aut60.tmp
%TEMP%\aut13.tmp
%TEMP%\aut14.tmp
%TEMP%\aut15.tmp
%TEMP%\autF.tmp
%TEMP%\aut11.tmp
%TEMP%\aut12.tmp
%TEMP%\aut16.tmp
%TEMP%\aut1A.tmp
%TEMP%\aut1B.tmp
%TEMP%\aut1C.tmp
%TEMP%\aut17.tmp
%TEMP%\aut18.tmp
%TEMP%\aut19.tmp
%TEMP%\aut5.tmp
%TEMP%\aut6.tmp
%TEMP%\aut7.tmp
%TEMP%\aut2.tmp
%TEMP%\aut3.tmp
%TEMP%\aut4.tmp
%TEMP%\aut8.tmp
%TEMP%\autC.tmp
%TEMP%\autD.tmp
%TEMP%\autE.tmp
%TEMP%\aut9.tmp
%TEMP%\autA.tmp
%TEMP%\autB.tmp
%TEMP%\aut1E.tmp
%TEMP%\aut30.tmp
%TEMP%\aut31.tmp
%TEMP%\aut32.tmp
%TEMP%\aut2C.tmp
%TEMP%\aut2D.tmp
%TEMP%\aut2F.tmp
%TEMP%\aut33.tmp
%TEMP%\aut37.tmp
%TEMP%\aut38.tmp
%TEMP%\aut39.tmp
%TEMP%\aut34.tmp
%TEMP%\aut35.tmp
%TEMP%\aut36.tmp
%TEMP%\aut22.tmp
%TEMP%\aut23.tmp
%TEMP%\aut24.tmp
%TEMP%\aut1F.tmp
%TEMP%\aut20.tmp
%TEMP%\aut21.tmp
%TEMP%\aut25.tmp
%TEMP%\aut29.tmp
%TEMP%\aut2A.tmp
%TEMP%\aut2B.tmp
%TEMP%\aut26.tmp
%TEMP%\aut27.tmp
%TEMP%\aut28.tmp

Перемещает следующие файлы:

<SYSTEM32>\SET79.tmp в <SYSTEM32>\mv2.dll
<DRIVERS>\SET78.tmp в <DRIVERS>\mv2.sys
%WINDIR%\security\edbtmp.log в %WINDIR%\security\edb.log

Сетевая активность:

Подключается к:

'www.download.windowsupdate.com':80
'wp#d':80

TCP:

Запросы HTTP GET:

www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt
wp#d/wpad.dat

UDP:

DNS ASK www.download.windowsupdate.com
DNS ASK wp#d

Другое:

Ищет следующие окна:

ClassName: '' WindowName: 'Software Installation'
ClassName: '' WindowName: 'Hardware Installation'
ClassName: 'Shell_TrayWnd' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней