Trojan.DownLoader4.47997

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] 'TheInet' = '{f3972e5d-4195-4a1d-8b42-88376449d277}'

Вредоносные функции:

Запускает на исполнение:

<SYSTEM32>\regsvr32.exe /s ""%TEMP%\windll.dll""

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\TeamViewer\Version5\TeamViewer_Resource_pl.dll
%TEMP%\TeamViewer\Version5\TeamViewer_Resource_no.dll
%TEMP%\TeamViewer\Version5\TeamViewer_Resource_sv.dll
%TEMP%\TeamViewer\Version5\TeamViewer_Resource_pt.dll
%TEMP%\TeamViewer\Version5\TeamViewer_Resource_it.dll
%TEMP%\TeamViewer\Version5\TeamViewer_Resource_fr.dll
%TEMP%\TeamViewer\Version5\TeamViewer_Resource_nl.dll
%TEMP%\TeamViewer\Version5\TeamViewer_Resource_ja.dll
%TEMP%\TeamViewer\Version5\TeamViewer_Resource_tr.dll
%APPDATA%\TeamViewer\TeamViewer5_Logfile.log
%TEMP%\nss7.tmp\Base64.dll
%CommonProgramFiles%\The\TheInet.dll
%TEMP%\windll.dll
%TEMP%\TeamViewer\Version5\TeamViewer_Resource_ko.dll
%TEMP%\TeamViewer\Version5\TeamViewer_Resource_ru.dll
%TEMP%\TeamViewer\Version5\TeamViewer_Resource_ar.dll
%TEMP%\TeamViewer\Version5\TeamViewer_Resource_cs.dll
%TEMP%\TeamViewer\Version5\TeamViewer_Resource_fi.dll
%TEMP%\teamviewer-quicksupport-5.0.8703.log
%TEMP%\TeamViewer\Version5\tvinfo.ini
%TEMP%\nss7.tmp\TvGetVersion.dll
%TEMP%\nsx6.tmp
%TEMP%\nsg2.tmp\NSISdl.dll
%TEMP%\teamviewer-quicksupport-5.0.8703.exe
%TEMP%\TeamViewer\Version5\TeamViewer_.exe
%TEMP%\nst4.tmp\TvGetVersion.dll
%TEMP%\nss7.tmp\System.dll
%TEMP%\TeamViewer\Version5\TeamViewer_Resource_de.dll
%TEMP%\TeamViewer\Version5\TeamViewer_Resource_en.dll
%TEMP%\TeamViewer\Version5\TeamViewer_Resource_es.dll
%TEMP%\TeamViewer\Version5\TeamViewer_Resource_da.dll
%TEMP%\TeamViewer\Version5\TeamViewer_Service.exe
%TEMP%\TeamViewer\Version5\TeamViewer.exe
%TEMP%\TeamViewer\Version5\SAS.exe
%TEMP%\TeamViewer\Version5\TV.dll

Удаляет следующие файлы:

%TEMP%\nss7.tmp\TvGetVersion.dll
%TEMP%\windll.dll
%TEMP%\nsg2.tmp\NSISdl.dll
%TEMP%\nst4.tmp\TvGetVersion.dll
%TEMP%\nss7.tmp\Base64.dll
%TEMP%\nss7.tmp\System.dll

Сетевая активность:

Подключается к:

'ma####.dyngate.com':80
'ma#####2.teamviewer.com':80
'pi###.dyngate.com':80
'ma#####.teamviewer.com':80
'cu####tversion.biz':80
'localhost':9998
'pi###.dyngate.com':5938

TCP:

Запросы HTTP GET:

ma#####2.teamviewer.com/din.aspx?s=#####################################################
pi###.dyngate.com/din.aspx?s=#####################################################
ma####.dyngate.com/din.aspx?s=#####################################################
cu####tversion.biz/windows/version.php?ve##########################################
ma#####.teamviewer.com/din.aspx?s=#####################################################

UDP: