Trojan.DownLoader8.13792

Техническая информация

Вредоносные функции:

Создает и запускает на исполнение:

%PROGRAM_FILES%\Eduware\FTDI Drivers\dpinst32.exe /c /q /sa /sw /PATH "%PROGRAM_FILES%\Eduware\FTDI Drivers"

Изменения в файловой системе:

Создает следующие файлы:

<SYSTEM32>\DRVSTORE\ftdibus_118A55261B69F7B89BB91BE915A947C0AFB10811\ftdibus.inf
%APPDATA%\Microsoft\CryptnetUrlCache\Content\3130B1871A126520A8C47861EFE3ED4D
%APPDATA%\Microsoft\CryptnetUrlCache\MetaData\3130B1871A126520A8C47861EFE3ED4D
<SYSTEM32>\DRVSTORE\ftdibus_118A55261B69F7B89BB91BE915A947C0AFB10811\i386\FTLang.Dll
<SYSTEM32>\DRVSTORE\ftdibus_118A55261B69F7B89BB91BE915A947C0AFB10811\i386\ftd2xx.dll
<SYSTEM32>\DRVSTORE\ftdibus_118A55261B69F7B89BB91BE915A947C0AFB10811\ftdibus.cat
%TEMP%\nsv2.tmp\System.dll
%PROGRAM_FILES%\Eduware\FTDI Drivers\i386\ftserui2.dll
%PROGRAM_FILES%\Eduware\FTDI Drivers\i386\ftser2k.sys
%APPDATA%\Microsoft\CryptnetUrlCache\Content\570FB14ABC805C46708F32F92F10C3B4
%APPDATA%\Microsoft\CryptnetUrlCache\MetaData\570FB14ABC805C46708F32F92F10C3B4
%WINDIR%\DPINST.LOG
<SYSTEM32>\DRVSTORE\ftdibus_118A55261B69F7B89BB91BE915A947C0AFB10811\i386\ftdibus.sys
<SYSTEM32>\DRVSTORE\ftdiport_1FF4D6769D672A1A3C2412579E6305882F1B6222\i386\ftserui2.dll
<SYSTEM32>\DRVSTORE\ftdiport_1FF4D6769D672A1A3C2412579E6305882F1B6222\i386\ftcserco.dll
<SYSTEM32>\DRVSTORE\ftdiport_1FF4D6769D672A1A3C2412579E6305882F1B6222\i386\ftser2k.sys
%WINDIR%\inf\oem4.PNF
%WINDIR%\inf\oem4.inf
<SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem4.CAT
%WINDIR%\inf\oem3.inf
<SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem3.CAT
<SYSTEM32>\DRVSTORE\ftdibus_118A55261B69F7B89BB91BE915A947C0AFB10811\i386\ftbusui.dll
<SYSTEM32>\DRVSTORE\ftdiport_1FF4D6769D672A1A3C2412579E6305882F1B6222\ftdiport.cat
<SYSTEM32>\DRVSTORE\ftdiport_1FF4D6769D672A1A3C2412579E6305882F1B6222\ftdiport.inf
%WINDIR%\inf\oem3.PNF
%PROGRAM_FILES%\Eduware\FTDI Drivers\ftdiport.inf
%PROGRAM_FILES%\Eduware\FTDI Drivers\ftdiport.cat
%PROGRAM_FILES%\Eduware\FTDI Drivers\ftdibus.inf
%PROGRAM_FILES%\Eduware\FTDI Drivers\amd64\ftbusui.dll
%PROGRAM_FILES%\Eduware\FTDI Drivers\Static\i386\ftd2xx.lib
%PROGRAM_FILES%\Eduware\FTDI Drivers\Static\amd64\ftd2xx.lib
%PROGRAM_FILES%\Eduware\FTDI Drivers\dpinst32.exe
%PROGRAM_FILES%\Eduware\FTDI Drivers\LogoVerificationReport.pdf
%PROGRAM_FILES%\Eduware\FTDI Drivers\CDM 2 08 02 Release Info.rtf
%PROGRAM_FILES%\Eduware\FTDI Drivers\ftdibus.cat
%PROGRAM_FILES%\Eduware\FTDI Drivers\ftd2xx.h
%PROGRAM_FILES%\Eduware\FTDI Drivers\dpinst64.exe
%PROGRAM_FILES%\Eduware\FTDI Drivers\amd64\ftcserco.dll
%PROGRAM_FILES%\Eduware\FTDI Drivers\i386\ftd2xx.dll
%PROGRAM_FILES%\Eduware\FTDI Drivers\i386\ftcserco.dll
%PROGRAM_FILES%\Eduware\FTDI Drivers\i386\ftbusui.dll
%PROGRAM_FILES%\Eduware\FTDI Drivers\i386\ftlang.dll
%PROGRAM_FILES%\Eduware\FTDI Drivers\i386\ftdibus.sys
%PROGRAM_FILES%\Eduware\FTDI Drivers\i386\ftd2xx.lib
%PROGRAM_FILES%\Eduware\FTDI Drivers\amd64\ftdibus.sys
%PROGRAM_FILES%\Eduware\FTDI Drivers\amd64\ftd2xx64.dll
%PROGRAM_FILES%\Eduware\FTDI Drivers\amd64\ftd2xx.lib
%PROGRAM_FILES%\Eduware\FTDI Drivers\amd64\ftserui2.dll
%PROGRAM_FILES%\Eduware\FTDI Drivers\amd64\ftser2k.sys
%PROGRAM_FILES%\Eduware\FTDI Drivers\amd64\ftlang.dll