Техническая информация
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\taskkill.exe' /IM Betternet.exe /F
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\Start.bat
- %TEMP%\Betternet\ProgramFilesFolder\Betternet\4.3.1\Microsoft.Practices.ServiceLocation.dll
- %TEMP%\Betternet\ProgramFilesFolder\Betternet\4.3.1\Microsoft.Practices.Unity.Configuration.dll
- %TEMP%\Betternet\ProgramFilesFolder\Betternet\4.3.1\Microsoft.Practices.Unity.dll
- %TEMP%\Betternet\ProgramFilesFolder\Betternet\4.3.1\Microsoft.Practices.Unity.RegistrationByConvention.dll
- %TEMP%\Betternet\ProgramFilesFolder\Betternet\4.3.1\Newtonsoft.Json.dll
- %TEMP%\Betternet\ProgramFilesFolder\Betternet\4.3.1\NLog.config
- %TEMP%\Betternet\ProgramFilesFolder\Betternet\4.3.1\NLog.dll
- %TEMP%\Betternet\ProgramFilesFolder\Betternet\4.3.1\Betternet.Windows.Dialogs.dll
- %TEMP%\Betternet\ProgramFilesFolder\Betternet\4.3.1\Prism.dll
- %TEMP%\Betternet\ProgramFilesFolder\Betternet\4.3.1\Prism.Wpf.dll
- %TEMP%\Betternet\ProgramFilesFolder\Betternet\4.3.1\SimpleInjector.dll
- %TEMP%\Betternet\ProgramFilesFolder\Betternet\4.3.1\System.Collections.Immutable.dll
- %TEMP%\Betternet\ProgramFilesFolder\Betternet\4.3.1\System.Windows.Interactivity.dll
- %TEMP%\Betternet\ProgramFilesFolder\Betternet\4.3.1\tap-windows-9.21.2.exe
- %TEMP%\Betternet\ProgramFilesFolder\Betternet\4.3.1\x64\afvpn.dll
- %TEMP%\Betternet\ProgramFilesFolder\Betternet\4.3.1\x64\hydra.exe
- %TEMP%\Betternet\ProgramFilesFolder\Betternet\4.3.1\Google.ProtoBuf.dll
- %TEMP%\Betternet\ProgramFilesFolder\Betternet\4.3.1\Hardcodet.Wpf.TaskbarNotification.dll
- %TEMP%\Betternet\ProgramFilesFolder\Betternet\4.3.1\Foundation.Vpn.Sdk.dll
- %TEMP%\Betternet\ProgramFilesFolder\Betternet\4.3.1\Foundation.Vpn.dll
- %TEMP%\Betternet\ProgramFilesFolder\Betternet\4.3.1\Foundation.Vpn.Common.dll
- %TEMP%\Setup.bat
- %TEMP%\Son.vbs
- %TEMP%\Betternet\Betternet.msi
- %TEMP%\Betternet\ProgramFilesFolder\Betternet\4.3.1\afvpn.manifest
- %TEMP%\Betternet\ProgramFilesFolder\Betternet\4.3.1\afvpn.tlb
- %TEMP%\Betternet\ProgramFilesFolder\Betternet\4.3.1\AutoMapper.dll
- %TEMP%\Betternet\ProgramFilesFolder\Betternet\4.3.1\Betternet.exe
- %TEMP%\Betternet\ProgramFilesFolder\Betternet\4.3.1\x86\afvpn.dll
- %TEMP%\Betternet\ProgramFilesFolder\Betternet\4.3.1\Prism.Unity.Wpf.dll
- %TEMP%\Betternet\ProgramFilesFolder\Betternet\4.3.1\Betternet.exe.config
- %TEMP%\Betternet\ProgramFilesFolder\Betternet\4.3.1\Betternet.Windows.Sdk.dll
- %TEMP%\Betternet\ProgramFilesFolder\Betternet\4.3.1\Betternet.Windows.Services.dll
- %TEMP%\Betternet\ProgramFilesFolder\Betternet\4.3.1\Foundation.Common.dll
- %TEMP%\Betternet\ProgramFilesFolder\Betternet\4.3.1\Foundation.Common.Rpc.dll
- %TEMP%\Betternet\ProgramFilesFolder\Betternet\4.3.1\Foundation.ExtProc.Hydra.ComTypes.dll
- %TEMP%\Betternet\ProgramFilesFolder\Betternet\4.3.1\Foundation.ExtProc.Hydra.dll
- %TEMP%\Betternet\ProgramFilesFolder\Betternet\4.3.1\Foundation.UnifiedApi.dll
- %TEMP%\Setup.vbs
- %TEMP%\Betternet\ProgramFilesFolder\Betternet\4.3.1\Betternet.Windows.Infrastructure.dll
- %TEMP%\Betternet\ProgramFilesFolder\Betternet\4.3.1\x86\hydra.exe
Другое:
Ищет следующие окна:
- ClassName: 'EDIT' WindowName: ''
- ClassName: '' WindowName: ''
Запускает на исполнение:
- '<SYSTEM32>\cmd.exe' /c \"\"C:\\DOCUME~1\\%USERNAME%\\LOCALS~1\\Temp\\Start.bat\" \"
- '<SYSTEM32>\reg.exe' add \"HKCU\\Software\\Microsoft\\Windows Script Host\\Settings\" /V Enabled /T REG_DWORD /F /D 1
- '<SYSTEM32>\reg.exe' add \"HKLM\\Software\\Microsoft\\Windows Script Host\\Settings\" /V Enabled /T REG_DWORD /F /D 1
- '<SYSTEM32>\wscript.exe' \"C:\\DOCUME~1\\%USERNAME%\\LOCALS~1\\Temp\\Setup.vbs\"
- '<SYSTEM32>\cmd.exe' /c \"\"C:\\DOCUME~1\\%USERNAME%\\LOCALS~1\\Temp\\Setup.bat\" \"
