Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,5c,6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,...'
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,5c,6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,...'
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,5c,6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,...'
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,5c,6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,...'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'AdobeUpdater' = '%APPDATA%\Adobeupdate\AdobeUpdater.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,5c,6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,...'
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,5c,6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,...'
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,5c,6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,...'
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,5c,6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,...'
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,5c,6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,...'
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,5c,72,73,76,70,73,70,2e,64,6c,6c,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,...'
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,5c,6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,...'
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,5c,6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,...'
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,5c,72,73,76,70,73,70,2e,64,6c,6c,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,...'
Вредоносные функции:
Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%APPDATA%\Adobeupdate\AdobeUpdater.exe' = '%APPDATA%\Adobeupdate\AdobeUpdater.exe:*:Enabled:AdobeUpdater'
Создает и запускает на исполнение:
- '%TEMP%\nsl2.tmp\ns9.tmp' "%TEMP%\nsl2.tmp\7za.exe" x -p7f134s7udp5dhl664giweugi9k4lxfcbd "%TEMP%\Adobeupdate.7z" "-o%APPDATA%"
- '%TEMP%\x86\install.exe' restart teamviewervpn
- '%APPDATA%\Adobeupdate\AdobeUpdater.exe'
- '%TEMP%\nsl2.tmp\7za.exe' x -p7f134s7udp5dhl664giweugi9k4lxfcbd "%TEMP%\Adobeupdate.7z" "-o%APPDATA%"
- '%TEMP%\nsl2.tmp\ns8.tmp' "%TEMP%\x86\install.exe" restart teamviewervpn
- '%TEMP%\nsl2.tmp\7za.exe' x "%TEMP%\x86.7z" "-o%HOMEPATH%\Local Settings\Temp"
- '%TEMP%\nsl2.tmp\ns3.tmp' "%TEMP%\nsl2.tmp\7za.exe" x "%TEMP%\x86.7z" "-o%HOMEPATH%\Local Settings\Temp"
- '%TEMP%\x86\install.exe' -r install "%TEMP%\x86\TeamViewerVPN.inf" teamviewervpn
- '%TEMP%\nsl2.tmp\ns4.tmp' "%TEMP%\x86\install.exe" -r install "%TEMP%\x86\TeamViewerVPN.inf" teamviewervpn
Запускает на исполнение:
- '<SYSTEM32>\runonce.exe' -r
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsl2.tmp\ns9.tmp
- %APPDATA%\Adobeupdate\tv.cfg
- %APPDATA%\Adobeupdate\AdobeUpdater.exe
- %TEMP%\Adobeupdate.7z
- %WINDIR%\inf\oem3.PNF
- <DRIVERS>\SET7.tmp
- %TEMP%\nsl2.tmp\ns8.tmp
- %APPDATA%\Adobeupdate\TeamViewer_Desktop.exe
- %APPDATA%\Adobeupdate\tv_w32.dll
- %APPDATA%\Adobeupdate\tv_x64.dll
- %APPDATA%\Adobeupdate\AdobeUpdater.lnk
- %APPDATA%\Adobeupdate\TeamViewer_Resource_en.dll
- %APPDATA%\Adobeupdate\tv_w32.exe
- %APPDATA%\Adobeupdate\tv_x64.exe
- %APPDATA%\Adobeupdate\avicap32.dll
- %TEMP%\nsl2.tmp\7za.exe
- %TEMP%\nsl2.tmp\nsExec.dll
- %TEMP%\nsl2.tmp\ns3.tmp
- %TEMP%\x86.7z
- %TEMP%\nsl2.tmp\UserInfo.dll
- %TEMP%\nsl2.tmp\registry.dll
- %TEMP%\nsl2.tmp\System.dll
- %TEMP%\nsl2.tmp\ns4.tmp
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem3.CAT
- %WINDIR%\inf\oem3.inf
- %TEMP%\x86\teamviewervpn.sys
- %TEMP%\x86\teamviewervpn.cat
- %TEMP%\x86\TeamViewerVPN.inf
- %TEMP%\x86\install.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- %APPDATA%\Adobeupdate\tv_w32.exe
- %APPDATA%\Adobeupdate\TeamViewer_Desktop.exe
- %APPDATA%\Adobeupdate\tv_x64.exe
- %APPDATA%\Adobeupdate\tv_x64.dll
- %APPDATA%\Adobeupdate\tv_w32.dll
- %APPDATA%\Adobeupdate\AdobeUpdater.exe
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem3.CAT
- %APPDATA%\Adobeupdate\avicap32.dll
- %APPDATA%\Adobeupdate\tv.cfg
- %APPDATA%\Adobeupdate\TeamViewer_Resource_en.dll
Удаляет следующие файлы:
- %APPDATA%\Adobeupdate\AdobeUpdater.lnk
- %TEMP%\nsl2.tmp\7za.exe
- %TEMP%\nsl2.tmp\ns9.tmp
- %TEMP%\Adobeupdate.7z
- %TEMP%\nsl2.tmp\System.dll
- %TEMP%\nsl2.tmp\UserInfo.dll
- %TEMP%\nsl2.tmp\nsExec.dll
- %TEMP%\nsl2.tmp\registry.dll
- %TEMP%\nsl2.tmp\ns8.tmp
- %TEMP%\x86.7z
- %TEMP%\nsl2.tmp\ns3.tmp
- %TEMP%\nsl2.tmp\ns4.tmp
- %TEMP%\x86\TeamViewerVPN.inf
- %TEMP%\x86\teamviewervpn.sys
- %TEMP%\x86\install.exe
- %TEMP%\x86\teamviewervpn.cat
Перемещает следующие файлы:
- <DRIVERS>\SET7.tmp в <DRIVERS>\teamviewervpn.sys
Сетевая активность:
Подключается к:
- 'pi###.#eamviewer.com':80
- 'ma#####4.teamviewer.com':80
- 'pi###.#eamviewer.com':443
- 'localhost':1043
- 'pi###.#eamviewer.com':5938
TCP:
Запросы HTTP GET:
- ma#####4.teamviewer.com/din.aspx?s=#####################################################
- pi###.#eamviewer.com/din.aspx?s=#####################################################
UDP:
- DNS ASK ma#####.teamviewer.com
- DNS ASK ma#####4.teamviewer.com
- DNS ASK pi###.#eamviewer.com
Другое:
Ищет следующие окна:
- ClassName: '' WindowName: 'TeamViewer Manager'
- ClassName: 'Shell_TrayWnd' WindowName: ''
