Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Local Security Authority Subsystem Service' = '"%APPDATA%\Microsoft\Windows\lsass.exe" *'
Вредоносные функции
Для затруднения выявления своего присутствия в системе
удаляет теневые копии разделов.
Внедряет код в
следующие системные процессы:
- %WINDIR%\syswow64\cmd.exe
- <SYSTEM32>\conhost.exe
следующие пользовательские процессы:
- lsass.exe
Ищет ветки реестра, отвечающие за хранение паролей сторонними программами
- [<HKCU>\Software\Martin Prikryl\WinSCP 2\Sessions]
Читает файлы, отвечающие за хранение паролей сторонними программами
- %APPDATA%\mozilla\firefox\profiles.ini
- <LS_APPDATA>\google\chrome\user data\default\cookies
- <LS_APPDATA>\google\chrome\user data\default\web data
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\4dd3.tmp
- %TEMP%\5ba3.tmp.exe
- %TEMP%\10717184228838288323811.tmp
- %TEMP%\10716564217109728741990.tmp
- %TEMP%\5748da1e\vcruntime140.dll
- %TEMP%\5748da1e\ucrtbase.dll
- %TEMP%\5748da1e\softokn3.dll
- %TEMP%\5748da1e\nssdbm3.dll
- %PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
- %TEMP%\5748da1e\nss3.dll
- %TEMP%\5748da1e\mozglue.dll
- %TEMP%\5748da1e\freebl3.dll
- %TEMP%\5748da1e\api-ms-win-crt-utility-l1-1-0.dll
- %TEMP%\5748da1e\api-ms-win-crt-time-l1-1-0.dll
- %TEMP%\5748da1e\api-ms-win-crt-string-l1-1-0.dll
- %TEMP%\5748da1e\api-ms-win-crt-stdio-l1-1-0.dll
- %TEMP%\5748da1e\api-ms-win-crt-runtime-l1-1-0.dll
- %TEMP%\5748da1e\msvcp140.dll
- %PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
- %PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
- <LS_APPDATA>\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
- %TEMP%\8ca64e03.buran
- %APPDATA%\microsoft\windows\cookies\user@instacamroulette[1].txt
- %TEMP%\1075062489228478562355.tmp-shm
- %TEMP%\1075062489228478562355.tmp
- %TEMP%\1075031891437402381395.tmp
- %TEMP%\10750004612694259534112.tmp
- %TEMP%\10749846688272294645282.tmp
- %TEMP%\10749684934360843182362.tmp
- %TEMP%\1074953522180055953147.tmp
- %TEMP%\1074937254318289458725.tmp
- %TEMP%\107493752562742683613.tmp
- %TEMP%\10748124436294992981755.tmp-shm
- %TEMP%\10748124436294992981755.tmp
- %TEMP%\10747187011519072252030.tmp
- %TEMP%\1074718678520669865118.tmp
- %TEMP%\5e5e.tmp-shm
- %TEMP%\5e5e.tmp
- %TEMP%\5748da1e\api-ms-win-crt-process-l1-1-0.dll
- %APPDATA%\microsoft\windows\lsass.exe
- %TEMP%\5748da1e\api-ms-win-crt-private-l1-1-0.dll
- %TEMP%\5748da1e\api-ms-win-crt-math-l1-1-0.dll
- %TEMP%\5748da1e\api-ms-win-core-interlocked-l1-1-0.dll
- %TEMP%\5748da1e\api-ms-win-core-heap-l1-1-0.dll
- %TEMP%\5748da1e\api-ms-win-core-handle-l1-1-0.dll
- %TEMP%\5748da1e\api-ms-win-core-file-l2-1-0.dll
- %TEMP%\5748da1e\api-ms-win-core-file-l1-2-0.dll
- %TEMP%\5748da1e\api-ms-win-core-file-l1-1-0.dll
- %TEMP%\5748da1e\api-ms-win-core-errorhandling-l1-1-0.dll
- %TEMP%\5748da1e\api-ms-win-core-libraryloader-l1-1-0.dll
- %TEMP%\5748da1e\api-ms-win-core-debug-l1-1-0.dll
- %TEMP%\5748da1e\api-ms-win-core-console-l1-1-0.dll
- %TEMP%\54bc.tmp.exe
- %TEMP%\4e53.tmp.exe
- %TEMP%\4bd1.tmp.exe
- %TEMP%\4817.tmp.exe
- %APPDATA%\dcgsdrf
- %APPDATA%\ubfwvrd
- %TEMP%\5748da1e\api-ms-win-core-datetime-l1-1-0.dll
- %TEMP%\5748da1e\api-ms-win-core-localization-l1-2-0.dll
- %TEMP%\5748da1e\api-ms-win-core-memory-l1-1-0.dll
- %TEMP%\5748da1e\api-ms-win-core-namedpipe-l1-1-0.dll
- %TEMP%\5748da1e\api-ms-win-crt-locale-l1-1-0.dll
- %TEMP%\5748da1e\api-ms-win-crt-heap-l1-1-0.dll
- %TEMP%\5748da1e\api-ms-win-crt-filesystem-l1-1-0.dll
- %TEMP%\5748da1e\api-ms-win-crt-environment-l1-1-0.dll
- %TEMP%\5748da1e\api-ms-win-crt-convert-l1-1-0.dll
- %TEMP%\5748da1e\api-ms-win-crt-conio-l1-1-0.dll
- %TEMP%\5748da1e\api-ms-win-core-util-l1-1-0.dll
- %TEMP%\5748da1e\api-ms-win-core-timezone-l1-1-0.dll
- %TEMP%\5748da1e\api-ms-win-core-sysinfo-l1-1-0.dll
- %TEMP%\5748da1e\api-ms-win-core-synch-l1-2-0.dll
- %TEMP%\5748da1e\api-ms-win-core-synch-l1-1-0.dll
- %TEMP%\5748da1e\api-ms-win-core-string-l1-1-0.dll
- %TEMP%\5748da1e\api-ms-win-core-rtlsupport-l1-1-0.dll
- %TEMP%\5748da1e\api-ms-win-core-profile-l1-1-0.dll
- %TEMP%\5748da1e\api-ms-win-core-processthreads-l1-1-1.dll
- %TEMP%\5748da1e\api-ms-win-core-processthreads-l1-1-0.dll
- %TEMP%\5748da1e\api-ms-win-core-processenvironment-l1-1-0.dll
- %TEMP%\5748da1e\api-ms-win-crt-multibyte-l1-1-0.dll
- %TEMP%\49196560.buran
Присваивает атрибут 'скрытый' для следующих файлов
- %APPDATA%\ubfwvrd
- %APPDATA%\dcgsdrf
Удаляет следующие файлы
- %TEMP%\10716564217109728741990.tmp
- %TEMP%\5748da1e\api-ms-win-core-synch-l1-2-0.dll
- %TEMP%\5748da1e\api-ms-win-core-sysinfo-l1-1-0.dll
- %TEMP%\5748da1e\api-ms-win-core-timezone-l1-1-0.dll
- %TEMP%\5748da1e\api-ms-win-core-util-l1-1-0.dll
- %TEMP%\5748da1e\api-ms-win-crt-conio-l1-1-0.dll
- %TEMP%\5748da1e\api-ms-win-crt-convert-l1-1-0.dll
- %TEMP%\5748da1e\api-ms-win-crt-environment-l1-1-0.dll
- %TEMP%\5748da1e\api-ms-win-crt-filesystem-l1-1-0.dll
- %TEMP%\5748da1e\api-ms-win-crt-heap-l1-1-0.dll
- %TEMP%\5748da1e\api-ms-win-crt-locale-l1-1-0.dll
- %TEMP%\5748da1e\api-ms-win-crt-math-l1-1-0.dll
- %TEMP%\5748da1e\api-ms-win-crt-multibyte-l1-1-0.dll
- %TEMP%\5748da1e\api-ms-win-crt-private-l1-1-0.dll
- %TEMP%\5748da1e\api-ms-win-core-datetime-l1-1-0.dll
- %TEMP%\5748da1e\api-ms-win-crt-process-l1-1-0.dll
- %TEMP%\5748da1e\api-ms-win-crt-stdio-l1-1-0.dll
- %TEMP%\5748da1e\api-ms-win-crt-string-l1-1-0.dll
- %TEMP%\5748da1e\api-ms-win-crt-time-l1-1-0.dll
- %TEMP%\5748da1e\api-ms-win-crt-utility-l1-1-0.dll
- %TEMP%\5748da1e\freebl3.dll
- %TEMP%\5748da1e\mozglue.dll
- %TEMP%\5748da1e\msvcp140.dll
- %TEMP%\5748da1e\nss3.dll
- %TEMP%\5748da1e\nssdbm3.dll
- %TEMP%\5748da1e\softokn3.dll
- %TEMP%\5748da1e\ucrtbase.dll
- %TEMP%\5748da1e\vcruntime140.dll
- %TEMP%\8ca64e03.buran
- %TEMP%\5748da1e\api-ms-win-core-string-l1-1-0.dll
- %TEMP%\5748da1e\api-ms-win-core-synch-l1-1-0.dll
- %TEMP%\5748da1e\api-ms-win-core-rtlsupport-l1-1-0.dll
- %TEMP%\5748da1e\api-ms-win-core-profile-l1-1-0.dll
- %TEMP%\5748da1e\api-ms-win-core-processthreads-l1-1-1.dll
- %TEMP%\1074718678520669865118.tmp
- %TEMP%\10747187011519072252030.tmp
- %TEMP%\10748124436294992981755.tmp-shm
- %TEMP%\10748124436294992981755.tmp
- %TEMP%\107493752562742683613.tmp
- %TEMP%\1074937254318289458725.tmp
- %TEMP%\1074953522180055953147.tmp
- %TEMP%\10749684934360843182362.tmp
- %TEMP%\10749846688272294645282.tmp
- %TEMP%\10750004612694259534112.tmp
- %TEMP%\1075031891437402381395.tmp
- %TEMP%\1075062489228478562355.tmp-shm
- %TEMP%\1075062489228478562355.tmp
- %TEMP%\5ba3.tmp.exe
- %TEMP%\5748da1e\api-ms-win-crt-runtime-l1-1-0.dll
- %TEMP%\5748da1e\api-ms-win-core-console-l1-1-0.dll
- %TEMP%\5748da1e\api-ms-win-core-errorhandling-l1-1-0.dll
- %TEMP%\5748da1e\api-ms-win-core-file-l1-1-0.dll
- %TEMP%\5748da1e\api-ms-win-core-file-l1-2-0.dll
- %TEMP%\5748da1e\api-ms-win-core-file-l2-1-0.dll
- %TEMP%\5748da1e\api-ms-win-core-handle-l1-1-0.dll
- %TEMP%\5748da1e\api-ms-win-core-heap-l1-1-0.dll
- %TEMP%\5748da1e\api-ms-win-core-interlocked-l1-1-0.dll
- %TEMP%\5748da1e\api-ms-win-core-libraryloader-l1-1-0.dll
- %TEMP%\5748da1e\api-ms-win-core-localization-l1-2-0.dll
- %TEMP%\5748da1e\api-ms-win-core-memory-l1-1-0.dll
- %TEMP%\5748da1e\api-ms-win-core-namedpipe-l1-1-0.dll
- %TEMP%\5748da1e\api-ms-win-core-processenvironment-l1-1-0.dll
- %TEMP%\5748da1e\api-ms-win-core-processthreads-l1-1-0.dll
- %TEMP%\10717184228838288323811.tmp
- %TEMP%\5748da1e\api-ms-win-core-debug-l1-1-0.dll
- %TEMP%\49196560.buran
Самоудаляется.
Сетевая активность
Подключается к
- 'ip##gger.ru':443
TCP
Запросы HTTP GET
- http://www.ms###csi.com/ncsi.txt
- http://pr####t-01252505.ml/azor.exe
- http://ge###tool.com/
- http://ip##pi.com/json
- http://ip##gger.ru/1c6647.html
Запросы HTTP POST
- http://te######vice012505.ru.com/
- http://pr####t-01252505.ml/
- http://vi####nage101.tk/webaz.php
- http://in#####mroulette.com/api/check.get
- http://in#####mroulette.com/api/gate.get?p1############################################
UDP
- DNS ASK pr####t-01242505.tk
- DNS ASK al######service012505.ru
- DNS ASK vs######service012505.ru
- DNS ASK ne######service012505.ru
- DNS ASK bi######service012505.ru
- DNS ASK te######vice01shop2505.ru
- DNS ASK te######vice01info2505.ru
- DNS ASK te######vice01plus2505.ru
- DNS ASK te######vice01club2505.ru
- DNS ASK te######vice01torg2505.ru
- DNS ASK te######vice01land2505.ru
- DNS ASK te######vice01life2505.ru
- DNS ASK te######vice01blog2505.ru
- DNS ASK me######-service012505.ru
- DNS ASK in######-service012505.ru
- DNS ASK be######-service012505.ru
- DNS ASK sh######-service012505.ru
- DNS ASK ku######-service012505.ru
- DNS ASK pr######-service012505.ru
- DNS ASK cl######-service012505.ru
- DNS ASK my######ervice01242505.ru
- DNS ASK ru######ervice01242505.ru
- DNS ASK te######vice01stroy2505.ru
- DNS ASK te######vice01forum2505.ru
- DNS ASK su######t-service012505.ru
- DNS ASK pr######service01242505.ru
- DNS ASK pr####t-01252505.ml
- DNS ASK vi####nage101.tk
- DNS ASK ge###tool.com
- DNS ASK ip##pi.com
- DNS ASK to######service012505.ru
- DNS ASK in#####mroulette.com
- DNS ASK mo######service012505.ru
- DNS ASK te#####rvice012505.host
- DNS ASK te######vice012505.ru.com
- DNS ASK te#####rvice012505.pw
- DNS ASK te#####rvice012505.com
- DNS ASK te#####rvice012505.site
- DNS ASK te######vice012505.store
- DNS ASK te#####rvice01242505.ru
- DNS ASK my#####service012505.ru
- DNS ASK te#####rvice012505.su
- DNS ASK te#####rvice012505.info
- DNS ASK te#####rvice012505.net
- DNS ASK te#####rvice012505.tech
- DNS ASK te######vice012505.online
- DNS ASK ru#####service012505.ru
- DNS ASK te######vice01dom2505.ru
- DNS ASK te######vice012505.website
- DNS ASK te#####rvice012505.xyz
- DNS ASK te######vice01pro2505.ru
- DNS ASK te######vice01rus2505.ru
- DNS ASK te#####rvice012505.eu
- DNS ASK te######vice012505.press
- DNS ASK pr######service012505.ru
- DNS ASK ru######service012505.ru
- DNS ASK te#######ice012505.net2505.ru
- DNS ASK te######vice012505.space
- DNS ASK do######service012505.ru
- DNS ASK mi######service012505.ru
- DNS ASK te#######ice012505.org2505.ru
- DNS ASK te#######ice012505.pp2505.ru
- DNS ASK te#####rvice012505.pro
- DNS ASK te#####rvice012505.fun
- DNS ASK ip##gger.ru
Другое
Создает и запускает на исполнение
- '%TEMP%\4817.tmp.exe'
- '%TEMP%\4bd1.tmp.exe'
- '%TEMP%\4e53.tmp.exe'
- '%TEMP%\54bc.tmp.exe'
- '%TEMP%\5ba3.tmp.exe'
- '%APPDATA%\microsoft\windows\lsass.exe' *
- '%WINDIR%\syswow64\cmd.exe' /e:on /c md "%APPDATA%\Microsoft\Windows" & copy "%TEMP%\5BA3.tmp.exe" "%APPDATA%\Microsoft\Windows\lsass.exe" & reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Local Security ...' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c for /l %x in (1,1,999) do ( ping -n 3 127.1 & del "%TEMP%\5BA3.tmp.exe" & if not exist "%TEMP%\5BA3.tmp.exe" exit )' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /C bcdedit /set {default} bootstatuspolicy ignoreallfailures' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /C bcdedit /set {default} recoveryenabled no' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /C wbadmin delete catalog -quiet' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /C wbadmin delete systemstatebackup' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /C wbadmin delete systemstatebackup -keepversions:0' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /C wbadmin delete backup' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /C wmic shadowcopy delete' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /C vssadmin delete shadows /all /quiet' (со скрытым окном)
Запускает на исполнение
- '%WINDIR%\syswow64\explorer.exe'
- '%WINDIR%\explorer.exe'
- '%WINDIR%\syswow64\dllhost.exe'
- '%WINDIR%\syswow64\cmd.exe' /e:on /c md "%APPDATA%\Microsoft\Windows" & copy "%TEMP%\5BA3.tmp.exe" "%APPDATA%\Microsoft\Windows\lsass.exe" & reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Local Security ...
- '%WINDIR%\syswow64\reg.exe' add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Local Security Authority Subsystem Service" /t REG_SZ /F /D "\"%APPDATA%\Microsoft\Windows\lsass.exe\" *"
- '%WINDIR%\syswow64\cmd.exe' /c for /l %x in (1,1,999) do ( ping -n 3 127.1 & del "%TEMP%\5BA3.tmp.exe" & if not exist "%TEMP%\5BA3.tmp.exe" exit )
- '%WINDIR%\syswow64\ping.exe' -n 3 127.1
- '%WINDIR%\syswow64\cmd.exe' /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
- '%WINDIR%\syswow64\cmd.exe' /C bcdedit /set {default} recoveryenabled no
- '%WINDIR%\syswow64\cmd.exe' /C wbadmin delete catalog -quiet
- '%WINDIR%\syswow64\cmd.exe' /C wbadmin delete systemstatebackup
- '%WINDIR%\syswow64\cmd.exe' /C wbadmin delete systemstatebackup -keepversions:0
- '%WINDIR%\syswow64\cmd.exe' /C wbadmin delete backup
- '%WINDIR%\syswow64\cmd.exe' /C wmic shadowcopy delete
- '<SYSTEM32>\vssvc.exe'
- '%WINDIR%\syswow64\cmd.exe' /C vssadmin delete shadows /all /quiet
