Техническая информация
Для обеспечения автозапуска и распространения:
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\AmmyyAdmin] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\AmmyyAdmin] 'ImagePath' = '"C:\ProgramData\Lenovo\mgs\tmv.exe" -service'
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\taskkill.exe' /f /im rundll32.exe
- '<SYSTEM32>\taskkill.exe' /F /IM procdump.exe
- '<SYSTEM32>\taskkill.exe' /F /IM hws.exe
Изменения в файловой системе:
Создает следующие файлы:
- C:\ProgramData\Lenovo\06.dmx
- C:\ProgramData\Lenovo\serv-amm-two.reg
- C:\ProgramData\Lenovo\tmx.exe
- C:\ProgramData\Lenovo\tmy.exe
- C:\ProgramData\Lenovo\two.bat
- C:\ProgramData\Lenovo\two.reg
- C:\ProgramData\Lenovo\ua-ena.bat
- C:\ProgramData\Lenovo\ua-ena.reg
- C:\ProgramData\Lenovo\mgs\install.bat
- C:\ProgramData\Lenovo\mgs\install.exe
- C:\ProgramData\Lenovo\mgs\RDPCheck.exe
- C:\ProgramData\Lenovo\serv-amm-one.reg
- C:\ProgramData\Lenovo\serv-amm-two.bat
- C:\ProgramData\Lenovo\mgs\RDPConf.exe
- C:\ProgramData\Lenovo\mgs\uninstall.bat
- C:\ProgramData\Lenovo\mgs\uninstall.exe
- C:\ProgramData\Lenovo\mgs\update.bat
- C:\ProgramData\Lenovo\hws.txt
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\raw[1]
- C:\ProgramData\Lenovo\index.php
- %ALLUSERSPROFILE%\Application Data\AMMYY\settings3.bin
- C:\ProgramData\Lenovo\mgs\tmv.log
- C:\ProgramData\Lenovo\mgs\tmv.exe_180620_143523.dmp
- C:\ProgramData\Lenovo\mgs\02.exe
- C:\ProgramData\Lenovo\mgs\ibiza.exe
- C:\ProgramData\Lenovo\mgs\RDPWInst.exe
- C:\ProgramData\Lenovo\serv-amm-one.bat
- C:\ProgramData\AMMYY\settings3.bin
- C:\ProgramData\Lenovo\real-tk-tmv.bat
- C:\ProgramData\Lenovo\u-eng.exe
- C:\ProgramData\Lenovo\04.dmx
- C:\ProgramData\Lenovo\03.dmx
- C:\ProgramData\Lenovo\05.dmx
- C:\ProgramData\Lenovo\08.dmx
- C:\ProgramData\Lenovo\02.dmx
- C:\ProgramData\Lenovo\01.dmx
- C:\ProgramData\Lenovo\nos.exe
- C:\ProgramData\Lenovo\mgs\folder.txt
- C:\ProgramData\Lenovo\mgs\nircmd.exe
- C:\ProgramData\Lenovo\mgs\user-el.bat
- C:\ProgramData\Lenovo\07.dmx
- C:\ProgramData\Lenovo\all-d.bat
- C:\ProgramData\Lenovo\hws.bat
- C:\ProgramData\Lenovo\hws.exe
- C:\ProgramData\Lenovo\mgs\tmv.exe
- C:\ProgramData\Lenovo\mgs\t-tmv.bat
- C:\ProgramData\Lenovo\mgs\t-tmv-kill.bat
- C:\ProgramData\Lenovo\ipg.exe
- C:\ProgramData\Lenovo\mgs\pd-win.bat
- C:\ProgramData\Lenovo\mgs\procdump.exe
- C:\ProgramData\Lenovo\nircmd.exe
- C:\ProgramData\Lenovo\one.bat
- C:\ProgramData\Lenovo\one.reg
- C:\ProgramData\Lenovo\all-p.bat
- C:\ProgramData\Lenovo\mgs\u-01.exe
- C:\ProgramData\Lenovo\pdwin.dmx
Сетевая активность:
Подключается к:
- 'ip.#2.pl':80
- 'rl.##myy.com':80
- 'ft#.#ssurdo.it':21
TCP:
Запросы HTTP GET:
- http://ip.#2.pl/raw
Запросы HTTP POST:
- http://rl.##myy.com/
UDP:
- DNS ASK ip.#2.pl
- DNS ASK rl.##myy.com
- DNS ASK ft#.#ssurdo.it
Другое:
Ищет следующие окна:
- ClassName: 'EDIT' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'RegEdit_RegEdit' WindowName: ''
Создает и запускает на исполнение:
- 'C:\ProgramData\Lenovo\nos.exe'
- 'C:\ProgramData\Lenovo\nircmd.exe' exec hide C:\ProgramData\Lenovo\mgs\RDPWInst.exe -i -o
- 'C:\ProgramData\Lenovo\mgs\ibiza.exe'
- 'C:\ProgramData\Lenovo\u-eng.exe' a -hp8ay73yG6s6gHu8H -r C:\ProgramData\Lenovo\pdwin.dmx C:\ProgramData\Lenovo\mgs\*tmv.exe_* + C:\ProgramData\Lenovo\index.php + %APPDATA%\Microsoft\Devhtml\css.bat + C:\ProgramData\Lenovo\hws....
- 'C:\ProgramData\Lenovo\nircmd.exe' exec hide C:\ProgramData\Lenovo\serv-amm-two.bat
- 'C:\ProgramData\Lenovo\nircmd.exe' exec hide C:\ProgramData\Lenovo\serv-amm-one.bat
- 'C:\ProgramData\Lenovo\mgs\procdump.exe' -ma -accepteula tmv.exe
- 'C:\ProgramData\Lenovo\nircmd.exe' exec hide C:\ProgramData\Lenovo\mgs\pd-win.bat
- 'C:\ProgramData\Lenovo\nircmd.exe' exec hide C:\ProgramData\Lenovo\mgs\t-tmv-kill.bat
- 'C:\ProgramData\Lenovo\mgs\tmv.exe' -nogui
- 'C:\ProgramData\Lenovo\nircmd.exe' exec hide C:\ProgramData\Lenovo\mgs\t-tmv.bat
- 'C:\ProgramData\Lenovo\nircmd.exe' elevatecmd exec hide C:\ProgramData\Lenovo\mgs\user-el.bat
- 'C:\ProgramData\Lenovo\ipg.exe'
- 'C:\ProgramData\Lenovo\nircmd.exe' exec hide C:\ProgramData\Lenovo\ipg.exe
- 'C:\ProgramData\Lenovo\nircmd.exe' elevatecmd exec hide C:\ProgramData\Lenovo\real-tk-tmv.bat
- 'C:\ProgramData\Lenovo\nircmd.exe' exec hide C:\ProgramData\Lenovo\all-d.bat
- 'C:\ProgramData\Lenovo\hws.exe' -f hws.txt
- 'C:\ProgramData\Lenovo\nircmd.exe' exec hide C:\ProgramData\Lenovo\all-p.bat
- 'C:\ProgramData\Lenovo\nircmd.exe' exec hide C:\ProgramData\Lenovo\hws.bat
- 'C:\ProgramData\Lenovo\u-eng.exe' x -o+ -p8ay73yG6s6gHu8H 08.dmx C:\ProgramData\Lenovo\mgs
- 'C:\ProgramData\Lenovo\u-eng.exe' x -o+ -p8ay73yG6s6gHu8H 07.dmx C:\ProgramData\AMMYY
- 'C:\ProgramData\Lenovo\u-eng.exe' x -o+ -p8ay73yG6s6gHu8H 05.dmx C:\ProgramData\Lenovo\mgs
- 'C:\ProgramData\Lenovo\u-eng.exe' x -o+ -p8ay73yG6s6gHu8H 04.dmx C:\ProgramData\Lenovo\mgs
- 'C:\ProgramData\Lenovo\u-eng.exe' x -o+ -p8ay73yG6s6gHu8H 03.dmx C:\ProgramData\Lenovo\mgs
- 'C:\ProgramData\Lenovo\u-eng.exe' x -o+ -p8ay73yG6s6gHu8H 02.dmx C:\ProgramData\Lenovo\mgs
- 'C:\ProgramData\Lenovo\u-eng.exe' x -o+ -p8ay73yG6s6gHu8H 01.dmx C:\ProgramData\Lenovo
- 'C:\ProgramData\Lenovo\mgs\RDPWInst.exe' -i -o
- 'C:\ProgramData\Lenovo\u-eng.exe' x -o+ -p8ay73yG6s6gHu8H 06.dmx C:\ProgramData\Lenovo\mgs
Запускает на исполнение:
- '<SYSTEM32>\cmd.exe' /c del /F /Q C:\ProgramData\Lenovo\pdwin.dmx
- '%WINDIR%\regedit.exe' /s C:\ProgramData\Lenovo\serv-amm-two.reg
- '<SYSTEM32>\cmd.exe' /c C:\ProgramData\Lenovo\serv-amm-two.bat
- '%WINDIR%\regedit.exe' /s C:\ProgramData\Lenovo\serv-amm-one.reg
- '<SYSTEM32>\cmd.exe' /c C:\ProgramData\Lenovo\serv-amm-one.bat
- '<SYSTEM32>\cmd.exe' /c C:\ProgramData\Lenovo\mgs\pd-win.bat
- '<SYSTEM32>\cmd.exe' /c C:\ProgramData\Lenovo\mgs\t-tmv-kill.bat
- '<SYSTEM32>\cmd.exe' /c C:\ProgramData\Lenovo\mgs\t-tmv.bat
- '<SYSTEM32>\cmd.exe' /c C:\ProgramData\Lenovo\all-d.bat
- '<SYSTEM32>\cmd.exe' /c C:\ProgramData\Lenovo\u-eng.exe a -hp8ay73yG6s6gHu8H -r C:\ProgramData\Lenovo\pdwin.dmx C:\ProgramData\Lenovo\mgs\*tmv.exe_* + C:\ProgramData\Lenovo\index.php + %APPDATA%\Microsoft\Devhtml\c...
- '<SYSTEM32>\cmd.exe' /c C:\ProgramData\Lenovo\all-p.bat
- '<SYSTEM32>\cmd.exe' /c del /F /Q C:\ProgramData\Lenovo\hws.txt
- '<SYSTEM32>\cmd.exe' /c del /F /Q C:\ProgramData\Lenovo\tmy.exe
- '<SYSTEM32>\cmd.exe' /c del /F /Q C:\ProgramData\Lenovo\tmx.exe
- '<SYSTEM32>\cmd.exe' /c del /F /Q C:\ProgramData\Lenovo\mgs\*.dmp*
- '<SYSTEM32>\cmd.exe' /c del /F /Q C:\ProgramData\Lenovo\nircmd.exe
- '<SYSTEM32>\cmd.exe' /c del /F /Q C:\ProgramData\Lenovo\ipg.exe
- '<SYSTEM32>\cmd.exe' /c del /F /Q C:\ProgramData\Lenovo\*.reg*
- '<SYSTEM32>\cmd.exe' /c del /F /Q C:\ProgramData\Lenovo\*.bat*
- '<SYSTEM32>\cmd.exe' /c C:\ProgramData\Lenovo\hws.bat
- '<SYSTEM32>\cmd.exe' /c C:\ProgramData\Lenovo\mgs\ibiza.exe
