Trojan.KillFiles.25181

Техническая информация

Вредоносные функции:

Создает и запускает на исполнение:

'%TEMP%\CiscoAnyConnectVPN\anyconnect-win-3.1.06073-web-deploy-k9.exe'

Запускает на исполнение:

'<SYSTEM32>\msiexec.exe' -Embedding E9D429710E339663DC86714DC1D0C086 C
'<SYSTEM32>\msiexec.exe' /V
'<SYSTEM32>\msiexec.exe'

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\install\8D9537A\vpncommon.dll
%TEMP%\install\8D9537A\vpncommoncrypt.dll
%TEMP%\install\8D9537A\SystemFolder\vpnevents.dll
%TEMP%\install\8D9537A\vpnagentutilities.dll
%TEMP%\install\8D9537A\vpnapi.dll
%TEMP%\install\8D9537A\SystemFolder\vpncategories.dll
%TEMP%\install\8D9537A\Plugins\vpnipsec.dll
%TEMP%\install\8D9537A\acsmux.sys
%TEMP%\install\8D9537A\acsmux64.sys
%TEMP%\install\8D9537A\acsock.sys
%TEMP%\install\8D9537A\zlib1.dll
%TEMP%\install\8D9537A\acsint.sys
%TEMP%\install\8D9537A\acsint64.sys
%TEMP%\install\8D9537A\ac_sock_fltr_api.dll
%TEMP%\install\8D9537A\VACon.exe
%TEMP%\install\8D9537A\VACon64.exe
%TEMP%\install\8D9537A\vpnagent.exe
%TEMP%\install\8D9537A\InstallHelper64.exe
%TEMP%\install\8D9537A\ManifestTool.exe
%TEMP%\install\8D9537A\Uninstall.exe
%TEMP%\install\8D9537A\vpncli.exe
%TEMP%\install\8D9537A\acciscossl.dll
%TEMP%\install\8D9537A\Plugins\acfeedback.dll
%TEMP%\install\8D9537A\Plugins\actoast.dll
%TEMP%\install\8D9537A\vpndownloader.exe
%TEMP%\install\8D9537A\vpnui.exe
%TEMP%\install\8D9537A\acciscocrypto.dll
%TEMP%\install\8D9537A\acsmux64.inf
%TEMP%\install\8D9537A\acsock.inf
%TEMP%\install\8D9537A\acsock64.inf
%TEMP%\install\8D9537A\acsint.inf
%TEMP%\install\8D9537A\acsint64.inf
%TEMP%\install\8D9537A\acsmux.inf
%TEMP%\install\8D9537A\vpnva-6.inf
%TEMP%\3d94a.msi
%TEMP%\MSI2.tmp
%TEMP%\MSI3d94b.LOG
%TEMP%\install\8D9537A\vpnva.inf
%TEMP%\install\8D9537A\vpnva64.inf
%TEMP%\install\8D9537A\WinSetup-Release-web-deploy.msi
%TEMP%\install\8D9537A\vpnva64.cat
%TEMP%\install\8D9537A\vpnva64-6.sys
%TEMP%\install\8D9537A\vpnva64.sys
%TEMP%\install\8D9537A\acsint.cat
%TEMP%\install\8D9537A\acsock64.sys
%TEMP%\install\8D9537A\vpnva-6.sys
%TEMP%\install\8D9537A\vpnva.sys
%TEMP%\install\8D9537A\acsint64.cat
%TEMP%\install\8D9537A\acsock64.cat
%TEMP%\install\8D9537A\vpnva-6.cat
%TEMP%\install\8D9537A\vpnva.cat
%TEMP%\install\8D9537A\acsmux.cat
%TEMP%\install\8D9537A\acsmux64.cat
%TEMP%\install\8D9537A\acsock.cat
%TEMP%\install\8D9537A\res\gradient.png
%TEMP%\install\8D9537A\res\mftogglebtn-down-solid.png
%TEMP%\install\8D9537A\res\mftogglebtn-down.png
%TEMP%\install\8D9537A\res\app_logo.png
%TEMP%\install\8D9537A\res\company_logo.png
%TEMP%\install\8D9537A\res\company_logo_alt.png
%TEMP%\install\8D9537A\res\mftogglebtn.png
%TEMP%\install\8D9537A\res\status_ico_neutral.png
%TEMP%\install\8D9537A\res\status_ico_transition.png
%TEMP%\install\8D9537A\res\status_ico_trusted.png
%TEMP%\install\8D9537A\res\status_ico_attention.png
%TEMP%\install\8D9537A\res\status_ico_error.png
%TEMP%\install\8D9537A\res\status_ico_good.png
%TEMP%\install\8D9537A\res\about_hover.png
%TEMP%\pb38442B50\pbremove.dat
%TEMP%\pb38442B50\PBCore.dll
%TEMP%\CiscoAnyConnectVPN\vpnuninstall.cmd
%TEMP%\pb38442B50\pbheader.bmp
%TEMP%\pb38442B50\pbdlg.dat
%TEMP%\pb38442B50\pblng.dat
%TEMP%\CiscoAnyConnectVPN\anyconnect-win-3.1.06073-web-deploy-k9.exe
%TEMP%\install\decoder.dll
%TEMP%\install\8D9537A\res\cues_bg.jpg
%TEMP%\install\8D9537A\res\about.png
%TEMP%\CiscoAnyConnectVPN\PBRem.exe
%TEMP%\pbu1.tmp
%TEMP%\CiscoAnyConnectVPN\PBRem.log
%TEMP%\install\8D9537A\res\vpn_connected.ico
%TEMP%\install\8D9537A\acsock.xml
%TEMP%\install\8D9537A\CommonAppDataFolder\Microsoft\Event Viewer\Views\Cisco\CiscoAnyConnect.xml
%TEMP%\install\8D9537A\res\transition_1.ico
%TEMP%\install\8D9537A\res\transition_2.ico
%TEMP%\install\8D9537A\res\transition_3.ico
%TEMP%\install\8D9537A\CommonAppDataFolder\Cisco\Cisco AnyConnect Secure Mobility Client\VPNManifestClient.xml
%TEMP%\install\8D9537A\CommonAppDataFolder\Cisco\Cisco AnyConnect Secure Mobility Client\eula.txt
%TEMP%\install\8D9537A\CommonAppDataFolder\Cisco\Cisco AnyConnect Secure Mobility Client\update.txt
%TEMP%\install\8D9537A\InstallHelper.exe
%TEMP%\install\8D9537A\CommonAppDataFolder\Cisco\Cisco AnyConnect Secure Mobility Client\AnyConnectLocalPolicy.xsd
%TEMP%\install\8D9537A\CommonAppDataFolder\Cisco\Cisco AnyConnect Secure Mobility Client\Profile\AnyConnectProfile.xsd
%TEMP%\install\8D9537A\OpenSource.html
%TEMP%\install\8D9537A\res\neutral.ico
%TEMP%\install\8D9537A\res\toolbar_about.png
%TEMP%\install\8D9537A\res\toolbar_about_hover.png
%TEMP%\install\8D9537A\res\toolbar_help.png
%TEMP%\install\8D9537A\res\toast_nam.png
%TEMP%\install\8D9537A\res\toast_vpn.png
%TEMP%\install\8D9537A\res\toolbar.png
%TEMP%\install\8D9537A\res\toolbar_help_hover.png
%TEMP%\install\8D9537A\res\attention.ico
%TEMP%\install\8D9537A\res\error.ico
%TEMP%\install\8D9537A\res\GUI.ico
%TEMP%\install\8D9537A\res\toolbar_prefs.png
%TEMP%\install\8D9537A\res\toolbar_prefs_hover.png
%TEMP%\install\8D9537A\res\vpn_logo.png