Trojan.DownLoader12.20915

Техническая информация

Вредоносные функции:

Создает и запускает на исполнение:

'%PROGRAM_FILES%\TAP-Windows\bin\devcon.exe' hwids tap0901
'%TEMP%\nsm5.tmp\ns7.tmp' "%PROGRAM_FILES%\TAP-Windows\bin\devcon.exe" install "%PROGRAM_FILES%\TAP-Windows\driver\OemWin2k.inf" tap0901
'%PROGRAM_FILES%\TAP-Windows\bin\devcon.exe' install "%PROGRAM_FILES%\TAP-Windows\driver\OemWin2k.inf" tap0901
'%TEMP%\nse2.tmp\ns3.tmp' "%PROGRAM_FILES%\ZenVPN OpenVPN bundle\bin\tap-windows.exe" /S
'%PROGRAM_FILES%\ZenVPN OpenVPN bundle\bin\tap-windows.exe' /S
'%TEMP%\nsm5.tmp\ns6.tmp' "%PROGRAM_FILES%\TAP-Windows\bin\devcon.exe" hwids tap0901

Запускает на исполнение:

'<SYSTEM32>\wbem\wmiadap.exe' /R /T

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\CabA.tmp
%TEMP%\Cab8.tmp
%APPDATA%\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
%TEMP%\Cab10.tmp
%TEMP%\CabE.tmp
%TEMP%\CabC.tmp
%APPDATA%\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
%TEMP%\nsm5.tmp\ns6.tmp
%TEMP%\nsm5.tmp\nsExec.dll
%PROGRAM_FILES%\TAP-Windows\icon.ico
%APPDATA%\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004
%APPDATA%\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004
%TEMP%\nsm5.tmp\ns7.tmp
%TEMP%\Cab12.tmp
%TEMP%\Cab28.tmp
%TEMP%\Cab26.tmp
%TEMP%\Cab24.tmp
%TEMP%\Cab2E.tmp
%TEMP%\Cab2C.tmp
%TEMP%\Cab2A.tmp
%TEMP%\Cab22.tmp
%TEMP%\Cab18.tmp
%TEMP%\Cab16.tmp
%TEMP%\Cab14.tmp
%TEMP%\Cab20.tmp
%TEMP%\Cab1E.tmp
%TEMP%\Cab1C.tmp
%PROGRAM_FILES%\ZenVPN OpenVPN bundle\bin\libeay32.dll
%PROGRAM_FILES%\ZenVPN OpenVPN bundle\log\README.txt
%PROGRAM_FILES%\ZenVPN OpenVPN bundle\config\README.txt
%PROGRAM_FILES%\ZenVPN OpenVPN bundle\bin\libpkcs11-helper-1.dll
%PROGRAM_FILES%\ZenVPN OpenVPN bundle\bin\liblzo2-2.dll
%PROGRAM_FILES%\ZenVPN OpenVPN bundle\bin\libssl32.dll
%PROGRAM_FILES%\ZenVPN OpenVPN bundle\bin\openvpnserv.exe
%PROGRAM_FILES%\ZenVPN OpenVPN bundle\bin\zenclient.exe
%TEMP%\nse2.tmp\modern-header.bmp
%TEMP%\nse2.tmp\UserInfo.dll
%PROGRAM_FILES%\ZenVPN OpenVPN bundle\config\zenvpn.json
%PROGRAM_FILES%\ZenVPN OpenVPN bundle\config\zenvpn.ovpn
%PROGRAM_FILES%\ZenVPN OpenVPN bundle\bin\openvpn.exe
%PROGRAM_FILES%\ZenVPN OpenVPN bundle\bin\ssleay32.dll
%PROGRAM_FILES%\TAP-Windows\driver\OemWin2k.inf
%PROGRAM_FILES%\TAP-Windows\bin\devcon.exe
%TEMP%\nsm5.tmp\System.dll
%PROGRAM_FILES%\TAP-Windows\license.txt
%PROGRAM_FILES%\TAP-Windows\driver\tap0901.sys
%PROGRAM_FILES%\TAP-Windows\driver\tap0901.cat
%TEMP%\nsm5.tmp\UserInfo.dll
%HOMEPATH%\Start Menu\Programs\ZenVPN.lnk
%PROGRAM_FILES%\ZenVPN OpenVPN bundle\bin\tap-windows.exe
%PROGRAM_FILES%\ZenVPN OpenVPN bundle\bin\openssl.exe
%TEMP%\nse2.tmp\ns3.tmp
%TEMP%\nse2.tmp\nsExec.dll
%PROGRAM_FILES%\ZenVPN OpenVPN bundle\openvpn-2.3.2.zip

Удаляет следующие файлы:

%TEMP%\Cab24.tmp
%TEMP%\Cab26.tmp
%TEMP%\Cab22.tmp
%TEMP%\Cab1E.tmp
%TEMP%\Cab20.tmp
%TEMP%\Cab28.tmp
<SYSTEM32>\wbem\Performance\WmiApRpl.ini
<SYSTEM32>\PerfStringBackup.TMP
%TEMP%\Cab2E.tmp
%TEMP%\Cab2A.tmp
%TEMP%\Cab2C.tmp
%TEMP%\CabC.tmp
%TEMP%\CabE.tmp
%TEMP%\CabA.tmp
%TEMP%\nsm5.tmp\ns6.tmp
%TEMP%\Cab8.tmp
%TEMP%\Cab10.tmp
%TEMP%\Cab18.tmp
%TEMP%\Cab1C.tmp
%TEMP%\Cab16.tmp
%TEMP%\Cab12.tmp
%TEMP%\Cab14.tmp

Сетевая активность:

Подключается к:

'ca#####.digicert.com':80
'www.download.windowsupdate.com':80
'wp#d':80

TCP:

Запросы HTTP GET:

www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
ca#####.digicert.com/DigiCertAssuredIDRootCA.crt
wp#d/wpad.dat
www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt

UDP: