Trojan.DownLoader6.44221

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004] 'PackedCatalogItem' = ''

Вредоносные функции:

Создает и запускает на исполнение:

%TEMP%\TCDMHA5.tmp\App\driver\files\nicmgr.exe poneyhot config
%TEMP%\TCDMHA5.tmp\App\driver\files\nicmgr.exe poneyhot install "%TEMP%\TCDMHA5.tmp\App\driver\files\hamachi.inf"
%TEMP%\TCDMHA5.tmp\App\hamachi\hamachi.exe -no-splash -config "%TEMP%\TCDMHA5.tmp\App\config"
%TEMP%\TCDMHA5.tmp\App\driver\files\nicmgr.exe poneyhot rename Hamachi
%TEMP%\TCDMHA5.tmp\App\driver\tapinstall.exe status hamachi
%TEMP%\nsx3.tmp\ns4.tmp "%TEMP%\TCDMHA5.tmp\App\driver\tapinstall.exe" status hamachi
%TEMP%\nsq7.tmp\ns8.tmp "%TEMP%\TCDMHA5.tmp\App\driver\tapinstall.exe" status hamachi
%TEMP%\TCDMHA5.tmp\App\driver\install.exe

Запускает на исполнение:

<SYSTEM32>\runonce.exe -r

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsq7.tmp\ns8.tmp
%TEMP%\nsq7.tmp\nsExec.dll
%TEMP%\TCDMHA5_ins.tmp\drv\getTime.dll
%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\ec702f375e1b12d218f67ab9ef19ca23_23ef5514-3059-436f-a4a7-4cefaab20eb1
%APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\Preferred
%APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\f8dd1446-b56e-441c-905a-e643ecdb7317
%TEMP%\TCDMHA5.tmp\App\hamachi\place hamachi files here.txt
%TEMP%\TCDMHA5.tmp\App\hamachi\nicmgr.exe
%TEMP%\TCDMHA5.tmp\App\hamachi\license.txt
%TEMP%\nsv6.tmp
%TEMP%\nsx3.tmp\ns4.tmp
%TEMP%\nsx3.tmp\nsExec.dll
%APPDATA%\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004
<DRIVERS>\SET11.tmp
%WINDIR%\inf\oem3.PNF
%WINDIR%\inf\oem3.inf
%TEMP%\nsq7.tmp\nsProcess.dll
%TEMP%\Cab14.tmp
%TEMP%\Cab12.tmp
%APPDATA%\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
%APPDATA%\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
%APPDATA%\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004
%TEMP%\CabF.tmp
%TEMP%\CabD.tmp
%TEMP%\Cab9.tmp
%TEMP%\TCDMHA5.tmp\App\hamachi\hamachi.wav
%TEMP%\TCDMHA5.tmp\App\config\peers.ini
%TEMP%\TCDMHA5.tmp\App\config\hamachi.ini
%TEMP%\TCDMHA5.tmp\App\config\client.pub
%TEMP%\TCDMHA5.tmp\App\config\RSA Keys\5.79.222.249.pub
%TEMP%\TCDMHA5.tmp\App\config\RSA Keys\5.178.113.94.pub
%TEMP%\TCDMHA5.tmp\App\config\place hamachi config files here.txt
%TEMP%\nsx3.tmp\newadvsplash.dll
%TEMP%\nsx3.tmp\BuriSplash.jpg
%TEMP%\nsh2.tmp
%TEMP%\TCDMHA5.tmp\App\config\client.pri
%TEMP%\TCDMHA5.tmp\App\config\client.id
%TEMP%\TCDMHA5.tmp\App\driver\install.exe
%TEMP%\TCDMHA5.tmp\App\hamachi\hamachi.exe
%TEMP%\TCDMHA5.tmp\App\driver\files\place driver files here.txt
%TEMP%\TCDMHA5.tmp\App\driver\files\nicmgr.exe
%TEMP%\TCDMHA5.tmp\App\hamachi\hamachi.ttf
%TEMP%\TCDMHA5.tmp\App\hamachi\hamachi.lng
%TEMP%\TCDMHA5.tmp\App\hamachi\hamachi.key
%TEMP%\TCDMHA5.tmp\App\driver\files\eula.txt
%TEMP%\TCDMHA5.tmp\App\driver\tapinstall.exe
%TEMP%\TCDMHA5.tmp\App\driver\remove.exe
%TEMP%\TCDMHA5.tmp\App\driver\files\hamachi.sys
%TEMP%\TCDMHA5.tmp\App\driver\files\hamachi.inf
%TEMP%\TCDMHA5.tmp\App\driver\files\hamachi.cat

Удаляет следующие файлы:

%TEMP%\nsq7.tmp\nsExec.dll
%TEMP%\TCDMHA5_ins.tmp\drv\getTime.dll
%TEMP%\Cab14.tmp
%TEMP%\TCDMHA5.tmp\App\config\hamachi-old.ini
%TEMP%\TCDMHA5.tmp\App\driver\install.exe
%TEMP%\nsq7.tmp\nsProcess.dll
%TEMP%\Cab9.tmp
%TEMP%\nsq7.tmp\ns8.tmp
%TEMP%\nsx3.tmp\ns4.tmp
%TEMP%\Cab12.tmp
%TEMP%\CabF.tmp
%TEMP%\CabD.tmp

Сетевая активность:

Подключается к:

'bi##.hamachi.cc':12975
'ss####.hamachi.cc':443
'wp#d':80
'www.download.windowsupdate.com':80

TCP:

Запросы HTTP GET:

www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt
wp#d/wpad.dat

UDP: