Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- 'C:\itok\apps\mbam.exe' /SP /VERYSILENT /NORESTART /SUPPRESSMSGBOXES /NOCANCEL /dir="\iTOK\Malwarebytes"
- 'C:\itok\apps\mbam.exe' (загружен из сети Интернет)
Запускает на исполнение:
- '<SYSTEM32>\cmd.exe' /c \itok\apps\mbamfix.bat
- '<SYSTEM32>\cscript.exe' \itok\apps\restorepoint.vbs
Изменения в файловой системе:
Создает следующие файлы:
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
- C:\itok\apps\mbamfix.bat
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\RestorePointSize
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
- %ALLUSERSPROFILE%\Local Settings\Temporary Internet Files\Content.IE5\W17UYEE0\desktop.ini
- %ALLUSERSPROFILE%\Local Settings\Temporary Internet Files\Content.IE5\ST6FWX6Z\desktop.ini
- %ALLUSERSPROFILE%\Local Settings\Temporary Internet Files\Content.IE5\S1EF81UZ\desktop.ini
- C:\itok\apps\niniteaio.exe
- C:\itok\apps\unzip.exe
- %ALLUSERSPROFILE%\Local Settings\History\History.IE5\desktop.ini
- %ALLUSERSPROFILE%\Local Settings\History\desktop.ini
- %ALLUSERSPROFILE%\Local Settings\Temporary Internet Files\desktop.ini
- C:\itok\Logs\09_08_2014\Tuneup_Log.txt
- %ALLUSERSPROFILE%\Local Settings\Temporary Internet Files\Content.IE5\WDCRWPOJ\desktop.ini
- %ALLUSERSPROFILE%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini
- C:\itok\resource.exe
- C:\itok\apps\mbam.exe
- C:\itok\autoruns.exe
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\rp.log
- C:\itok\apps\restorepoint.vbs
- C:\itok\apps\aio.ini
- C:\itok\apps\JRT.exe
- C:\itok\apps\toolbarcleaner.exe
- C:\itok\apps\Ccleaner.exe
- C:\itok\apps\cleanup2.exe
- C:\itok\apps\toolbarcleaner.ini
- C:\itok\apps\avr.bat
Присваивает атрибут 'скрытый' для следующих файлов:
- %ALLUSERSPROFILE%\Local Settings\Temporary Internet Files\Content.IE5\ST6FWX6Z\desktop.ini
- %ALLUSERSPROFILE%\Local Settings\Temporary Internet Files\Content.IE5\S1EF81UZ\desktop.ini
- %ALLUSERSPROFILE%\Local Settings\History\History.IE5\desktop.ini
- %ALLUSERSPROFILE%\Local Settings\Temporary Internet Files\Content.IE5\W17UYEE0\desktop.ini
- %ALLUSERSPROFILE%\Local Settings\History\desktop.ini
- %ALLUSERSPROFILE%\Local Settings\Temporary Internet Files\desktop.ini
- %ALLUSERSPROFILE%\Local Settings\Temporary Internet Files\Content.IE5\WDCRWPOJ\desktop.ini
- %ALLUSERSPROFILE%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini
Удаляет следующие файлы:
- C:\itok\apps\mbamfix.bat
Сетевая активность:
Подключается к:
- 'do######s.malwarebytes.org':80
- 'li##.##sinternals.com':80
- 'it##.###hgrouponline.com':80
TCP:
Запросы HTTP GET:
- it##.###hgrouponline.com/itok/apps/cleanup2.exe
- it##.###hgrouponline.com/itok/Master/toolbarcleaner.ini
- li##.##sinternals.com/autoruns.exe
- it##.###hgrouponline.com/itok/bin/resource.exe
- do######s.malwarebytes.org/file/mbam/
- it##.###hgrouponline.com/itok/apps/avr.bat
- it##.###hgrouponline.com/itok/Master/Niniteaio.exe
- it##.###hgrouponline.com/itok/Master/unzip.exe
- it##.###hgrouponline.com/itok/apps/CCleaner.exe
- it##.###hgrouponline.com/itok/apps/JRT.exe
- it##.###hgrouponline.com/itok/apps/ToolbarCleaner.exe
UDP:
- DNS ASK do######s.malwarebytes.org
- DNS ASK li##.##sinternals.com
- DNS ASK it##.###hgrouponline.com
Другое:
Ищет следующие окна:
- ClassName: '#32771' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'AutoHotkey' WindowName: '<Полный путь к вирусу>'
