Trojan.DownLoader11.52069

Техническая информация

Вредоносные функции:

Создает и запускает на исполнение:

'%TEMP%\nsg3.tmp\ns4.tmp' regsvr32 /s "%CommonProgramFiles%\Anvisoft\CommonComponent\1.0\CommonComponent.dll"
'%TEMP%\adbusetup.exe'
'%TEMP%\Anvi.Exe'

Запускает на исполнение:

'<SYSTEM32>\regsvr32.exe' /s "%CommonProgramFiles%\Anvisoft\CommonComponent\1.0\CommonComponent.dll"
'<SYSTEM32>\wbem\wmiadap.exe' /R /T
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\Anvi AD Blocker Ultimate v3.1.0.0.bat" > NUL"
'<SYSTEM32>\taskkill.exe' /f /t /im adblocker2.exe

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\Anvisoft\Anvi AD Blocker Ultimate\BugReport.exe
%PROGRAM_FILES%\Anvisoft\Anvi AD Blocker Ultimate\zlibwapi.dll
%PROGRAM_FILES%\Anvisoft\Anvi AD Blocker Ultimate\Qt5Network.dll
%CommonProgramFiles%\Anvisoft\CommonComponent\1.0\libglog.dll
%CommonProgramFiles%\Anvisoft\CommonComponent\1.0\CommonComponent.dll
%PROGRAM_FILES%\Anvisoft\Anvi AD Blocker Ultimate\product.ini
%PROGRAM_FILES%\Anvisoft\Anvi AD Blocker Ultimate\Qt5Core.dll
%PROGRAM_FILES%\Anvisoft\Anvi AD Blocker Ultimate\msvcr100.dll
%PROGRAM_FILES%\Anvisoft\Anvi AD Blocker Ultimate\msvcp100.dll
%PROGRAM_FILES%\Anvisoft\Anvi AD Blocker Ultimate\Qt5Widgets.dll
%PROGRAM_FILES%\Anvisoft\Anvi AD Blocker Ultimate\Qt5Svg.dll
%PROGRAM_FILES%\Anvisoft\Anvi AD Blocker Ultimate\Qt5Gui.dll
%ALLUSERSPROFILE%\Start Menu\Programs\Anvisoft\Anvi AD Blocker Ultimate\Uninstall.lnk
%ALLUSERSPROFILE%\Desktop\Anvi AD Blocker Ultimate.lnk
%TEMP%\nsg3.tmp\inetc.dll
%PROGRAM_FILES%\Anvisoft\Anvi AD Blocker Ultimate\Uninstall.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Anvisoft\Anvi AD Blocker Ultimate\Anvi AD Blocker Ultimate.lnk
%CommonProgramFiles%\Anvisoft\CommonComponent\1.0\msvcr100.dll
%CommonProgramFiles%\Anvisoft\CommonComponent\1.0\msvcp100.dll
%CommonProgramFiles%\Anvisoft\CommonComponent\1.0\libcurl.dll
%TEMP%\nsg3.tmp\ns4.tmp
%TEMP%\nsg3.tmp\nsExec.dll
%CommonProgramFiles%\Anvisoft\CommonComponent\1.0\atl100.dll
%PROGRAM_FILES%\Anvisoft\Anvi AD Blocker Ultimate\libcurl.dll
%TEMP%\nsg3.tmp\nsProcess.dll
%TEMP%\nsg3.tmp\nsDialogs.dll
%TEMP%\nsg3.tmp\modern-wizard.bmp
%PROGRAM_FILES%\Anvisoft\Anvi AD Blocker Ultimate\rules.db
%PROGRAM_FILES%\Anvisoft\Anvi AD Blocker Ultimate\Changelog.txt
%PROGRAM_FILES%\Anvisoft\Anvi AD Blocker Ultimate\qt.conf
%TEMP%\License.exe
%TEMP%\Anvi.Exe
%TEMP%\adbusetup.exe
%TEMP%\nsg3.tmp\System.dll
%TEMP%\nsl2.tmp
%TEMP%\Anvi AD Blocker Ultimate v3.1.0.0.bat
%PROGRAM_FILES%\Anvisoft\Anvi AD Blocker Ultimate\icudt51.dll
%PROGRAM_FILES%\Anvisoft\Anvi AD Blocker Ultimate\adbmon.dll
%PROGRAM_FILES%\Anvisoft\Anvi AD Blocker Ultimate\ADBSrv.exe
%PROGRAM_FILES%\Anvisoft\Anvi AD Blocker Ultimate\libglog.dll
%PROGRAM_FILES%\Anvisoft\Anvi AD Blocker Ultimate\icuuc51.dll
%PROGRAM_FILES%\Anvisoft\Anvi AD Blocker Ultimate\icuin51.dll
%PROGRAM_FILES%\Anvisoft\Anvi AD Blocker Ultimate\plugins\imageformats\qico.dll
%PROGRAM_FILES%\Anvisoft\Anvi AD Blocker Ultimate\css\style_light.css
%PROGRAM_FILES%\Anvisoft\Anvi AD Blocker Ultimate\css\style_dark.css
%PROGRAM_FILES%\Anvisoft\Anvi AD Blocker Ultimate\adblocker2.exe
%PROGRAM_FILES%\Anvisoft\Anvi AD Blocker Ultimate\plugins\platforms\qwindows.dll
%PROGRAM_FILES%\Anvisoft\Anvi AD Blocker Ultimate\plugins\imageformats\qjpeg.dll

Удаляет следующие файлы:

<SYSTEM32>\PerfStringBackup.TMP
<SYSTEM32>\wbem\Performance\WmiApRpl.ini
%TEMP%\nsg3.tmp\ns4.tmp

Сетевая активность:

Подключается к:

'www.an###oft.com':80
'localhost':1038

TCP:

Запросы HTTP GET:

www.an###oft.com/api2/instal_count.php?pr################################################################################################
www.an###oft.com/promotions/adbactivity.php

UDP: