Техническая информация
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\cacls.exe' "C:\NBMSClient\SunwardIeSafe.dll" /d Everyone
- '<SYSTEM32>\taskkill.exe' /im "C:\NBMSClient\ProcessSafe.exe" /f
- '<SYSTEM32>\attrib.exe' -R -S -H "C:\NBMSClient\ProcessSafe.exe"
- '<SYSTEM32>\cacls.exe' "<SYSTEM32>\orient.dll" /d Everyone
- '<SYSTEM32>\regsvr32.exe' /u /s "C:\NBMSClient\SunwardIeSafe.dll"
- '<SYSTEM32>\attrib.exe' +S +H "<SYSTEM32>\SunwardIeSafe.dll"
- '<SYSTEM32>\attrib.exe' -R -S -H "<SYSTEM32>\soclient.exe"
- '<SYSTEM32>\attrib.exe' +S +H "<SYSTEM32>\soclient.exe"
- '<SYSTEM32>\wscript.exe' "<SYSTEM32>\soclient.exe" /d Everyone
- '<SYSTEM32>\attrib.exe' +S +H "<SYSTEM32>\ProcessSafe.exe"
- '<SYSTEM32>\cacls.exe' "C:\NBMSClient\ProcessSafe.exe" /d Everyone
- '<SYSTEM32>\taskkill.exe' /im "<SYSTEM32>\soclient.exe" /f
- '<SYSTEM32>\cacls.exe' "<SYSTEM32>\shunwangcq.dll" /d Everyone
- '<SYSTEM32>\regsvr32.exe' /u /s "<SYSTEM32>\barbrowserconfigdownloader.dll"
- '<SYSTEM32>\attrib.exe' +S +H "<SYSTEM32>\barbrowserconfigdownloader.dll"
- '<SYSTEM32>\cacls.exe' "<SYSTEM32>\swnew.dll" /d Everyone
- '<SYSTEM32>\regsvr32.exe' /u /s "<SYSTEM32>\shunwangcq.dll"
- '<SYSTEM32>\attrib.exe' +S +H "<SYSTEM32>\shunwangcq.dll"
- '<SYSTEM32>\cacls.exe' "<SYSTEM32>\ieres.dll" /d Everyone
- '<SYSTEM32>\regsvr32.exe' /u /s "<SYSTEM32>\orient.dll"
- '<SYSTEM32>\attrib.exe' +S +H "<SYSTEM32>\orient.dll"
- '<SYSTEM32>\cacls.exe' "<SYSTEM32>\barbrowserconfigdownloader.dll" /d Everyone
- '<SYSTEM32>\regsvr32.exe' /u /s "<SYSTEM32>\ieres.dll"
- '<SYSTEM32>\attrib.exe' +S +H "<SYSTEM32>\ieres.dll"
- '<SYSTEM32>\taskkill.exe' /im "<SYSTEM32>\IeoExt.exe" /f
- '<SYSTEM32>\attrib.exe' /im "C:\╧╡═│╕№╨┬\┐═╗з╗·▓╣╢б\IeSafe\212\Share.exe" /f
- '<SYSTEM32>\attrib.exe' -R -S -H "C:\╧╡═│╕№╨┬\┐═╗з╗·▓╣╢б\IeSafe\212\Share.exe"
- '<SYSTEM32>\attrib.exe' +S +H "C:\╧╡═│╕№╨┬\┐═╗з╗·▓╣╢б\IeSafe\212\Share.exe"
- '<SYSTEM32>\cacls.exe' /pid=3380
- '<SYSTEM32>\attrib.exe' +S +H "%WINDIR%\java\Packages\urr\svchost.exe"
- '<SYSTEM32>\cacls.exe' "%WINDIR%\java\Packages\urr\svchost.exe" /d Everyone
- '<SYSTEM32>\attrib.exe' +S +H "C:\╧╡═│╕№╨┬\┐═╗з╗·▓╣╢б\SunwardPkg.idx"
- '<SYSTEM32>\cacls.exe' "C:\╧╡═│╕№╨┬\┐═╗з╗·▓╣╢б\SunwardPkg.idx" /d Everyone
- '<SYSTEM32>\RegSet.exe' <SYSTEM32>\9122671.ini
- '<SYSTEM32>\cacls.exe' "C:\╧╡═│╕№╨┬\┐═╗з╗·▓╣╢б\IeSafe\212\Share.exe"/d Everyone
- '<SYSTEM32>\attrib.exe' +S +H "C:\╧╡═│╕№╨┬\╣у╕ц╫╩╘┤\SunwardPkg.idx"
- '<SYSTEM32>\cacls.exe' "C:\╧╡═│╕№╨┬\╣у╕ц╫╩╘┤\SunwardPkg.idx" /d Everyone
- '<SYSTEM32>\taskkill.exe' /im "<SYSTEM32>\send.exe" /f
- '<SYSTEM32>\attrib.exe' -R -S -H "<SYSTEM32>\send.exe"
- '<SYSTEM32>\attrib.exe' +S +H "<SYSTEM32>\send.exe"
- '<SYSTEM32>\attrib.exe' -R -S -H "<SYSTEM32>\IeoExt.exe"
- '<SYSTEM32>\attrib.exe' +S +H "<SYSTEM32>\IeoExt.exe"
- '<SYSTEM32>\cacls.exe' "<SYSTEM32>\IeoExt.exe" /d Everyone
- '<SYSTEM32>\cacls.exe' "%APPDATA%\Realt" /d Everyone
- '<SYSTEM32>\attrib.exe' /pid=3292
- '<SYSTEM32>\attrib.exe' /pid=3328
- '<SYSTEM32>\attrib.exe' "<SYSTEM32>\send.exe" /d Everyone
- '<SYSTEM32>\cacls.exe' /pid=3216
- '<SYSTEM32>\attrib.exe' +S +H "%APPDATA%\Realt"
- '<SYSTEM32>\attrib.exe' +S +H "<SYSTEM32>\swnew.dll"
- '<SYSTEM32>\cacls.exe' <SYSTEM32>\wwgivsre.dmp /D everyone
- '<SYSTEM32>\attrib.exe' +S +H <SYSTEM32>\wgivsre.cmp
- '<SYSTEM32>\cacls.exe' <SYSTEM32>\wgivsre.cmp /D everyone
- '<SYSTEM32>\attrib.exe' +S +H <SYSTEM32>\nbnpdr.cmp
- '<SYSTEM32>\cacls.exe' <SYSTEM32>\nbnpdr.cmp /D everyone
- '<SYSTEM32>\attrib.exe' +S +H <SYSTEM32>\wwgivsre.dmp
- '<SYSTEM32>\cacls.exe' <SYSTEM32>\wtcasapi32.cmp /D everyone
- '<SYSTEM32>\attrib.exe' +S +H <SYSTEM32>\wwtcasapi32.dmp
- '<SYSTEM32>\cacls.exe' <SYSTEM32>\wwtcasapi32.dmp /D everyone
- '<SYSTEM32>\attrib.exe' +S +H <SYSTEM32>\wnbnpdr.dmp
- '<SYSTEM32>\cacls.exe' <SYSTEM32>\wnbnpdr.dmp /D everyone
- '<SYSTEM32>\attrib.exe' +S +H <SYSTEM32>\wtcasapi32.cmp
- '<SYSTEM32>\reg.exe' add "HKCU\license" /v "" /t REG_SZ /d "Good" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Start" /v "Key" /t REG_SZ /d "381255375" /f
- '<SYSTEM32>\reg.exe' add "HKCU\Register" /v "" /t REG_SZ /d "OnoKey" /f
- '<SYSTEM32>\wscript.exe' "%APPDATA%\Run_1.vbs"
- '<SYSTEM32>\cmd.exe' /c ""%APPDATA%\Swwx.bat" "
- '<SYSTEM32>\mode.com' con: COLS=15 LINES=3
- '<SYSTEM32>\cacls.exe' <SYSTEM32>\adclient.cmp /D everyone
- '<SYSTEM32>\attrib.exe' +S +H <SYSTEM32>\cltctrl.cmp
- '<SYSTEM32>\cacls.exe' <SYSTEM32>\cltctrl.cmp /D everyone
- '<SYSTEM32>\attrib.exe' +S +H <SYSTEM32>\GAClient.cmp
- '<SYSTEM32>\cacls.exe' <SYSTEM32>\GAClient.cmp /D everyone
- '<SYSTEM32>\attrib.exe' +S +H <SYSTEM32>\adclient.cmp
- '<SYSTEM32>\attrib.exe' +S +H %WINDIR%\Tools\Clsmn\temp\wxautouplist2.zip
- '<SYSTEM32>\cacls.exe' "<SYSTEM32>\iebrowserex.dll" /d Everyone
- '<SYSTEM32>\attrib.exe' +S +H "<SYSTEM32>\iebrowserex.dll.tmp"
- '<SYSTEM32>\cacls.exe' "<SYSTEM32>\iebrowserex.dll.tmp" /d Everyone
- '<SYSTEM32>\cacls.exe' "<SYSTEM32>\SWNTrace.dll.tmp" /d Everyone
- '<SYSTEM32>\regsvr32.exe' /u /s "<SYSTEM32>\iebrowserex.dll"
- '<SYSTEM32>\attrib.exe' +S +H "<SYSTEM32>\iebrowserex.dll"
- '<SYSTEM32>\attrib.exe' +S +H "<SYSTEM32>\IEOptimize.dll.tmp"
- '<SYSTEM32>\cacls.exe' "<SYSTEM32>\IEOptimize.dll.tmp" /d Everyone
- '<SYSTEM32>\regsvr32.exe' /u /s "<SYSTEM32>\swnew.dll"
- '<SYSTEM32>\regsvr32.exe' /u /s "<SYSTEM32>\IEOptimize.dll"
- '<SYSTEM32>\attrib.exe' +S +H "<SYSTEM32>\IEOptimize.dll"
- '<SYSTEM32>\cacls.exe' "<SYSTEM32>\IEOptimize.dll" /d Everyone
- '<SYSTEM32>\regsvr32.exe' /u /s "<SYSTEM32>\swaddressbar.dll"
- '<SYSTEM32>\attrib.exe' +S +H "<SYSTEM32>\swaddressbar.dll"
- '<SYSTEM32>\cacls.exe' "<SYSTEM32>\swaddressbar.dll" /d Everyone
- '<SYSTEM32>\cacls.exe' %WINDIR%\Tools\Clsmn\temp\wxautouplist2.zip /D everyone
- '<SYSTEM32>\attrib.exe' +S +H <SYSTEM32>\temp\wxautouplist2.zip
- '<SYSTEM32>\cacls.exe' <SYSTEM32>\temp\wxautouplist2.zip /D everyone
- '<SYSTEM32>\attrib.exe' +S +H "<SYSTEM32>\SWNTrace.dll"
- '<SYSTEM32>\cacls.exe' "<SYSTEM32>\SWNTrace.dll" /d Everyone
- '<SYSTEM32>\attrib.exe' +S +H "<SYSTEM32>\SWNTrace.dll.tmp"
- '<SYSTEM32>\attrib.exe' +S +H "<SYSTEM32>\swaddressbar.dll.tmp"
- '<SYSTEM32>\cacls.exe' "<SYSTEM32>\swaddressbar.dll.tmp" /d Everyone
- '<SYSTEM32>\regsvr32.exe' /u /s "<SYSTEM32>\SWNTrace.dll"
Внедряет код в
следующие системные процессы:
- <SYSTEM32>\cmd.exe
- <SYSTEM32>\cacls.exe
- <SYSTEM32>\wscript.exe
- <SYSTEM32>\attrib.exe
Изменения в файловой системе:
Создает следующие файлы:
- %APPDATA%\Run_1.vbs
- %APPDATA%\Swwx.bat
Удаляет следующие файлы:
- %APPDATA%\Run_1.vbs
Перемещает следующие системные файлы:
- <SYSTEM32>\regini.exe в <SYSTEM32>\RegSet.exe
Другое:
Ищет следующие окна:
- ClassName: '' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
