Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] 'TheInet' = '{f3972e5d-4195-4a1d-8b42-88376449d277}'
Вредоносные функции:
Запускает на исполнение:
- <SYSTEM32>\regsvr32.exe /s ""%TEMP%\windll.dll""
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\TeamViewer\Version5\TeamViewer_Resource_pl.dll
- %TEMP%\TeamViewer\Version5\TeamViewer_Resource_no.dll
- %TEMP%\TeamViewer\Version5\TeamViewer_Resource_sv.dll
- %TEMP%\TeamViewer\Version5\TeamViewer_Resource_pt.dll
- %TEMP%\TeamViewer\Version5\TeamViewer_Resource_it.dll
- %TEMP%\TeamViewer\Version5\TeamViewer_Resource_fr.dll
- %TEMP%\TeamViewer\Version5\TeamViewer_Resource_nl.dll
- %TEMP%\TeamViewer\Version5\TeamViewer_Resource_ja.dll
- %TEMP%\TeamViewer\Version5\TeamViewer_Resource_tr.dll
- %APPDATA%\TeamViewer\TeamViewer5_Logfile.log
- %TEMP%\nss7.tmp\Base64.dll
- %CommonProgramFiles%\The\TheInet.dll
- %TEMP%\windll.dll
- %TEMP%\TeamViewer\Version5\TeamViewer_Resource_ko.dll
- %TEMP%\TeamViewer\Version5\TeamViewer_Resource_ru.dll
- %TEMP%\TeamViewer\Version5\TeamViewer_Resource_ar.dll
- %TEMP%\TeamViewer\Version5\TeamViewer_Resource_cs.dll
- %TEMP%\TeamViewer\Version5\TeamViewer_Resource_fi.dll
- %TEMP%\teamviewer-quicksupport-5.0.8703.log
- %TEMP%\TeamViewer\Version5\tvinfo.ini
- %TEMP%\nss7.tmp\TvGetVersion.dll
- %TEMP%\nsx6.tmp
- %TEMP%\nsg2.tmp\NSISdl.dll
- %TEMP%\teamviewer-quicksupport-5.0.8703.exe
- %TEMP%\TeamViewer\Version5\TeamViewer_.exe
- %TEMP%\nst4.tmp\TvGetVersion.dll
- %TEMP%\nss7.tmp\System.dll
- %TEMP%\TeamViewer\Version5\TeamViewer_Resource_de.dll
- %TEMP%\TeamViewer\Version5\TeamViewer_Resource_en.dll
- %TEMP%\TeamViewer\Version5\TeamViewer_Resource_es.dll
- %TEMP%\TeamViewer\Version5\TeamViewer_Resource_da.dll
- %TEMP%\TeamViewer\Version5\TeamViewer_Service.exe
- %TEMP%\TeamViewer\Version5\TeamViewer.exe
- %TEMP%\TeamViewer\Version5\SAS.exe
- %TEMP%\TeamViewer\Version5\TV.dll
Удаляет следующие файлы:
- %TEMP%\nss7.tmp\TvGetVersion.dll
- %TEMP%\windll.dll
- %TEMP%\nsg2.tmp\NSISdl.dll
- %TEMP%\nst4.tmp\TvGetVersion.dll
- %TEMP%\nss7.tmp\Base64.dll
- %TEMP%\nss7.tmp\System.dll
Сетевая активность:
Подключается к:
- 'ma####.dyngate.com':80
- 'ma#####2.teamviewer.com':80
- 'pi###.dyngate.com':80
- 'ma#####.teamviewer.com':80
- 'cu####tversion.biz':80
- 'localhost':9998
- 'pi###.dyngate.com':5938
TCP:
Запросы HTTP GET:
- ma#####2.teamviewer.com/din.aspx?s=#####################################################
- pi###.dyngate.com/din.aspx?s=#####################################################
- ma####.dyngate.com/din.aspx?s=#####################################################
- cu####tversion.biz/windows/version.php?ve##########################################
- ma#####.teamviewer.com/din.aspx?s=#####################################################
UDP:
- DNS ASK ma#####3.teamviewer.com
- DNS ASK ma#####2.teamviewer.com
- DNS ASK ma#####4.teamviewer.com
- DNS ASK ma#####6.teamviewer.com
- DNS ASK ma#####5.teamviewer.com
- DNS ASK ma#####1.teamviewer.com
- DNS ASK pi###.dyngate.com
- DNS ASK cu####tversion.biz
- DNS ASK ma#####.teamviewer.com
- DNS ASK ma#####0.teamviewer.com
- DNS ASK ma####.dyngate.com
Другое:
Ищет следующие окна:
- ClassName: 'MozillaUIWindowClass' WindowName: ''
- ClassName: 'IEFrame' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '' WindowName: 'TeamViewer Connection'
- ClassName: '' WindowName: 'TeamViewer Verbindung'
- ClassName: '' WindowName: 'TeamViewer Tray Icon'
