Trojan.KillProc.22752

Техническая информация

Вредоносные функции:

Создает и запускает на исполнение:

%HOMEPATH%\temp\TeamViewer\Version4\TeamViewer.exe --qsc --pw ""
%HOMEPATH%\temp\TeamViewer\Version4\TeamViewer_.exe
%TEMP%\RarSFX0\TeamViewerQS.exe

Запускает на исполнение:

<SYSTEM32>\taskkill.exe /f /im teamviewer.exe
<SYSTEM32>\cmd.exe /c ""%TEMP%\RarSFX0\run.cmd" "

Изменения в файловой системе:

Создает следующие файлы:

%HOMEPATH%\temp\TeamViewer\Version4\TeamViewer_resource_pt.dll
%HOMEPATH%\temp\TeamViewer\Version4\TeamViewer_resource_pl.dll
%HOMEPATH%\temp\TeamViewer\Version4\TeamViewer_resource_tr.dll
%HOMEPATH%\temp\TeamViewer\Version4\TeamViewer_resource_sv.dll
%HOMEPATH%\temp\TeamViewer\Version4\TeamViewer_resource_ja.dll
%HOMEPATH%\temp\TeamViewer\Version4\TeamViewer_resource_it.dll
%HOMEPATH%\temp\TeamViewer\Version4\TeamViewer_resource_no.dll
%HOMEPATH%\temp\TeamViewer\Version4\TeamViewer_resource_nl.dll
%APPDATA%\Microsoft\CryptnetUrlCache\MetaData\A8FABA189DB7D25FBA7CAC806625FD30
%APPDATA%\Microsoft\CryptnetUrlCache\Content\60E31627FDA0A46932B0E5948949F2A5
%APPDATA%\TeamViewer\TeamViewer4_Logfile.log
%APPDATA%\Microsoft\CryptnetUrlCache\Content\A8FABA189DB7D25FBA7CAC806625FD30
%HOMEPATH%\temp\TeamViewer\Version4\TeamViewer.ini
%HOMEPATH%\temp\TeamViewer\Version4\logo.bmp
%APPDATA%\Microsoft\CryptnetUrlCache\MetaData\60E31627FDA0A46932B0E5948949F2A5
%TEMP%\nsz4.tmp\Base64.dll
%TEMP%\nsz4.tmp\System.dll
%TEMP%\nsz4.tmp\TvGetVersion.dll
%HOMEPATH%\temp\TeamViewer\Version4\TeamViewer_Service.exe
%HOMEPATH%\temp\TeamViewer\Version4\TeamViewer.exe
%TEMP%\RarSFX0\run.cmd
%TEMP%\RarSFX0\TeamViewerQS.exe
%TEMP%\nsj3.tmp
%HOMEPATH%\temp\TeamViewer\Version4\TeamViewer_.exe
%HOMEPATH%\temp\TeamViewer\Version4\TeamViewer_resource_es.dll
%HOMEPATH%\temp\TeamViewer\Version4\TeamViewer_resource_da.dll
%HOMEPATH%\temp\TeamViewer\Version4\TeamViewer_resource_fr.dll
%HOMEPATH%\temp\TeamViewer\Version4\TeamViewer_resource_fi.dll
%HOMEPATH%\temp\TeamViewer\Version4\TV.dll
%HOMEPATH%\temp\TeamViewer\Version4\SAS.exe
%HOMEPATH%\temp\TeamViewer\Version4\TeamViewer_resource_de.dll
%HOMEPATH%\temp\TeamViewer\Version4\TeamViewer_resource_en.dll

Удаляет следующие файлы:

%TEMP%\RarSFX0\run.cmd
%TEMP%\RarSFX0\TeamViewerQS.exe
%HOMEPATH%\temp\TeamViewer\Version4\logo.bmp
%TEMP%\nsz4.tmp\Base64.dll
%TEMP%\nsz4.tmp\System.dll
%TEMP%\nsz4.tmp\TvGetVersion.dll

Сетевая активность:

Подключается к:

'ma#####.teamviewer.com':80
'ma####.dyngate.com':80
'pi###.dyngate.com':80
'pi###.dyngate.com':5938
'wp#d':80
'crl.verisign.com':80
'cs######4-crl.verisign.com':80

TCP:

Запросы HTTP GET:

ma####.dyngate.com/din.aspx?s=####################################################
ma####.dyngate.com/din.aspx?s=#####################################################
pi###.dyngate.com/din.aspx?s=####################################################
pi###.dyngate.com/din.aspx?s=###################################################
pi###.dyngate.com/din.aspx?s=#####################################################
crl.verisign.com/pca3.crl
wp#d/wpad.dat
cs######4-crl.verisign.com/CSC3-2004.crl
ma#####.teamviewer.com/din.aspx?s=#####################################################
ma#####.teamviewer.com/din.aspx?s=####################################################

UDP: