Tool.Cain.57

Техническая информация

Вредоносные функции:

Создает и запускает на исполнение:

'%TEMP%\RarSFX0\WinPcap_4_1_beta5.exe'
'%TEMP%\RarSFX0\_setup.exe' /silent
'%TEMP%\RarSFX0\WinborgXP-App-Installer.exe'

Запускает на исполнение:

'<SYSTEM32>\runonce.exe' -r

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\Cain\Install.log
%HOMEPATH%\Desktop\Cain.lnk
%HOMEPATH%\Start Menu\Programs\Cain\Uninstall Cain.lnk
%TEMP%\nsz7.tmp\UserInfo.dll
%TEMP%\NetSol.jpg
%TEMP%\CACE_Logo.gif
%TEMP%\CACE_Banner.htm
%PROGRAM_FILES%\Cain\Driver\~GLH0018.TMP
%PROGRAM_FILES%\Cain\Winrtgen\~GLH0017.TMP
%PROGRAM_FILES%\Cain\Winrtgen\~GLH0016.TMP
%HOMEPATH%\Start Menu\Programs\Cain\Winrtgen.lnk
%HOMEPATH%\Start Menu\Programs\Cain\Whatsnew.lnk
%HOMEPATH%\Start Menu\Programs\Cain\Cain.lnk
%HOMEPATH%\Start Menu\Programs\Cain\CA_UserManual.lnk
%TEMP%\nsz7.tmp\ioSpecial.ini
<SYSTEM32>\Packet.dll
%TEMP%\nsz7.tmp\System.dll
<SYSTEM32>\pthreadVC.dll
<DRIVERS>\npf.sys
%PROGRAM_FILES%\WinPcap\Uninstall.exe
%ALLUSERSPROFILE%\Start Menu\Programs\WinPcap\Uninstall WinPcap 4.1 beta5.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\WinPcap\WinPcap Web Site.url
%TEMP%\nsz7.tmp\nsWeb.dll
%TEMP%\nsz7.tmp\modern-header.bmp
%TEMP%\nsz7.tmp\modern-wizard.bmp
%TEMP%\nsz7.tmp\InstallOptions.dll
<SYSTEM32>\wpcap.dll
%PROGRAM_FILES%\WinPcap\WinPcapInstall.dll
%PROGRAM_FILES%\WinPcap\rpcapd.exe
%PROGRAM_FILES%\Cain\Winrtgen\~GLH0015.TMP
%TEMP%\GLG3.tmp
%TEMP%\GL_1.EXE
%WINDIR%\~GLH0001.TMP
%TEMP%\~GLH0002.TMP
%PROGRAM_FILES%\Cain\~GLH0005.TMP
%PROGRAM_FILES%\Cain\~GLH0004.TMP
%TEMP%\~GLH0003.TMP
%TEMP%\RarSFX0\WinPcap_4_1_beta5.exe
%TEMP%\RarSFX0\WinborgXP-App-Installer.exe
%TEMP%\RarSFX0\_setup.exe
%TEMP%\RarSFX0\WinborgXP-App-Installer.au3
%WINDIR%\~GLH0000.TMP
%WINDIR%\~GLC0000.TMP
%TEMP%\RarSFX0\Icon.ico
%PROGRAM_FILES%\Cain\~GLH0006.TMP
%PROGRAM_FILES%\Cain\~GLH0010.TMP
%PROGRAM_FILES%\Cain\~GLH000f.TMP
%PROGRAM_FILES%\Cain\~GLH000e.TMP
%PROGRAM_FILES%\Cain\~GLH0011.TMP
%PROGRAM_FILES%\Cain\~GLH0014.TMP
%PROGRAM_FILES%\Cain\~GLH0013.TMP
%PROGRAM_FILES%\Cain\~GLH0012.TMP
%PROGRAM_FILES%\Cain\~GLH0009.TMP
%PROGRAM_FILES%\Cain\~GLH0008.TMP
%PROGRAM_FILES%\Cain\~GLH0007.TMP
%PROGRAM_FILES%\Cain\Wordlists\~GLH000a.TMP
%PROGRAM_FILES%\Cain\~GLH000d.TMP
%PROGRAM_FILES%\Cain\~GLH000c.TMP
%PROGRAM_FILES%\Cain\~GLH000b.TMP

Удаляет следующие файлы:

%HOMEPATH%\Desktop\Cain.lnk
%TEMP%\NetSol.jpg
%TEMP%\CACE_Logo.gif
%TEMP%\RarSFX0\Icon.ico
%PROGRAM_FILES%\WinPcap\WinPcapInstall.dll
%TEMP%\RarSFX0\WinborgXP-App-Installer.exe
%TEMP%\RarSFX0\WinborgXP-App-Installer.au3
%TEMP%\CACE_Banner.htm
%TEMP%\GL_1.EXE
%WINDIR%\~GLH0001.TMP
%TEMP%\GLG3.tmp
%WINDIR%\~GLH0000.TMP
%WINDIR%\~GLC0000.TMP
%TEMP%\GLF5.tmp
%TEMP%\GLF4.tmp

Перемещает следующие файлы:

%PROGRAM_FILES%\Cain\~GLH0011.TMP в %PROGRAM_FILES%\Cain\Abel64.dll
%PROGRAM_FILES%\Cain\~GLH0012.TMP в %PROGRAM_FILES%\Cain\Abel64.dll.sig
%PROGRAM_FILES%\Cain\~GLH0010.TMP в %PROGRAM_FILES%\Cain\Abel.exe.sig
%PROGRAM_FILES%\Cain\~GLH000e.TMP в %PROGRAM_FILES%\Cain\Abel.dll.sig
%PROGRAM_FILES%\Cain\~GLH000f.TMP в %PROGRAM_FILES%\Cain\Abel.exe
%PROGRAM_FILES%\Cain\~GLH0013.TMP в %PROGRAM_FILES%\Cain\Abel64.exe
%PROGRAM_FILES%\Cain\Winrtgen\~GLH0017.TMP в %PROGRAM_FILES%\Cain\Winrtgen\Winrtgen.exe.sig
%PROGRAM_FILES%\Cain\Driver\~GLH0018.TMP в %PROGRAM_FILES%\Cain\Driver\WinPcap_4_1_1.exe
%PROGRAM_FILES%\Cain\Winrtgen\~GLH0016.TMP в %PROGRAM_FILES%\Cain\Winrtgen\Winrtgen.exe
%PROGRAM_FILES%\Cain\~GLH0014.TMP в %PROGRAM_FILES%\Cain\Abel64.exe.sig
%PROGRAM_FILES%\Cain\Winrtgen\~GLH0015.TMP в %PROGRAM_FILES%\Cain\Winrtgen\charset.txt
%PROGRAM_FILES%\Cain\~GLH000d.TMP в %PROGRAM_FILES%\Cain\Abel.dll
%PROGRAM_FILES%\Cain\~GLH0005.TMP в %PROGRAM_FILES%\Cain\Cain.exe
%PROGRAM_FILES%\Cain\~GLH0006.TMP в %PROGRAM_FILES%\Cain\Cain.exe.sig
%PROGRAM_FILES%\Cain\~GLH0004.TMP в %PROGRAM_FILES%\Cain\UNINSTAL.EXE
%TEMP%\~GLH0002.TMP в %TEMP%\GLF4.tmp
%TEMP%\~GLH0003.TMP в %TEMP%\GLF5.tmp
%PROGRAM_FILES%\Cain\~GLH0007.TMP в %PROGRAM_FILES%\Cain\Whatsnew.txt
%PROGRAM_FILES%\Cain\~GLH000b.TMP в %PROGRAM_FILES%\Cain\CA_UserManual.chm
%PROGRAM_FILES%\Cain\~GLH000c.TMP в %PROGRAM_FILES%\Cain\lame_enc.dll
%PROGRAM_FILES%\Cain\Wordlists\~GLH000a.TMP в %PROGRAM_FILES%\Cain\Wordlists\Wordlist.txt
%PROGRAM_FILES%\Cain\~GLH0008.TMP в %PROGRAM_FILES%\Cain\charset.txt
%PROGRAM_FILES%\Cain\~GLH0009.TMP в %PROGRAM_FILES%\Cain\oui.txt