Техническая информация
Для обеспечения автозапуска и распространения
Создает или изменяет следующие файлы
- <SYSTEM32>\tasks\{5d23e781-6f7e-47d0-ba74-ebf1c89877f0}
Создает следующие сервисы
- [<HKLM>\System\CurrentControlSet\Services\NativeDesktopMediaService] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\NativeDesktopMediaService] 'ImagePath' = '"%ProgramFiles(x86)%\Jetmedia\NativeDesktopMediaService\desktop_media_service.exe" --service'
Вредоносные функции
Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра
- [<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DoNotAllowExceptions' = '00000000'
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\is-a79h1.tmp\<Имя файла>.tmp
- %WINDIR%\installer\msia8ff.tmp
- %WINDIR%\installer\msia91f.tmp
- %WINDIR%\installer\msia9cc.tmp
- %WINDIR%\installer\msiaa4a.tmp
- %WINDIR%\installer\msiaa6a.tmp
- %WINDIR%\installer\msiaa9a.tmp
- %WINDIR%\installer\msiab66.tmp
- C:\config.msi\1070b1.rbs
- %WINDIR%\installer\msiac24.tmp
- %TEMP%\msi6b7d.tmp
- %WINDIR%\installer\msiad7c.tmp
- %APPDATA%\jetmedia\nativedesktopmediaservice 3.6.0\install\2cf5f20\watchdog.exe
- %APPDATA%\jetmedia\nativedesktopmediaservice 3.6.0\install\2cf5f20\commonappdatafolder\jetmedia\nativedesktopmediaservice\comdata.dat
- %ProgramFiles(x86)%\jetmedia\nativedesktopmediaservice\desktop_media_service.exe
- %ProgramFiles(x86)%\jetmedia\nativedesktopmediaservice\watchdog.exe
- %PROGRAMDATA%\jetmedia\nativedesktopmediaservice\comdata.dat
- %WINDIR%\installer\msiaf23.tmp
- %WINDIR%\installer\msiafe0.tmp
- %WINDIR%\installer\msib56f.tmp
- %WINDIR%\installer\1070b2.msi
- %WINDIR%\installer\1070b0.ipi
- %WINDIR%\installer\msia8ee.tmp
- %WINDIR%\installer\msi9248.tmp
- %WINDIR%\installer\msi9218.tmp
- %WINDIR%\installer\msi8ebc.tmp
- %TEMP%\is-p4p6m.tmp\_isetup\_iscrypt.dll
- %TEMP%\is-p4p6m.tmp\ijru.dll
- %TEMP%\is-j4sl2.tmp\<Имя файла>.tmp
- %TEMP%\is-8jfc1.tmp\_isetup\_setup64.tmp
- %TEMP%\is-8jfc1.tmp\_isetup\_iscrypt.dll
- %TEMP%\is-8jfc1.tmp\ijru.dll
- %TEMP%\{70aa3717-1e52-e9c7-aafe-fdf7f2d641c3}\pse.exe
- %TEMP%\{70aa3717-1e52-e9c7-aafe-fdf7f2d641c3}\na.exe
- %APPDATA%\jetmedia\nativedesktopmediaservice 3.6.0\install\decoder.dll
- %WINDIR%\installer\msief0f.tmp
- %APPDATA%\jetmedia\nativedesktopmediaservice 3.6.0\install\2cf5f20\desktop_media_service.exe
- %APPDATA%\jetmedia\nativedesktopmediaservice 3.6.0\install\2cf5f20\networkdesktopmedia.msi
- %WINDIR%\installer\1070ad.msi
- %WINDIR%\installer\msi71b7.tmp
- %WINDIR%\installer\msi7264.tmp
- %WINDIR%\installer\msi72b3.tmp
- %TEMP%\1b896a1019e1c419e6ac.msi72b3.tmp
- %WINDIR%\installer\msi860d.tmp
- %WINDIR%\installer\msi888f.tmp
- %WINDIR%\installer\msi88de.tmp
- %WINDIR%\installer\msi891d.tmp
- %TEMP%\is-p4p6m.tmp\_isetup\_setup64.tmp
- %TEMP%\msi6cd6.tmp
- %WINDIR%\installer\msif663.tmp
Удаляет следующие файлы
- %TEMP%\{70aa3717-1e52-e9c7-aafe-fdf7f2d641c3}\pse.exe
- %TEMP%\is-j4sl2.tmp\<Имя файла>.tmp
- %TEMP%\is-a79h1.tmp\<Имя файла>.tmp
- %TEMP%\is-8jfc1.tmp\ijru.dll
- %TEMP%\is-8jfc1.tmp\_isetup\_iscrypt.dll
- %TEMP%\is-8jfc1.tmp\_isetup\_setup64.tmp
- %TEMP%\is-p4p6m.tmp\ijru.dll
- %TEMP%\is-p4p6m.tmp\_isetup\_iscrypt.dll
- %WINDIR%\installer\msiafe0.tmp
- %WINDIR%\installer\msib56f.tmp
- %TEMP%\is-p4p6m.tmp\_isetup\_setup64.tmp
- %WINDIR%\installer\msief0f.tmp
- %WINDIR%\installer\msif663.tmp
- %WINDIR%\installer\1070ad.msi
- %WINDIR%\installer\1070b0.ipi
- %APPDATA%\jetmedia\nativedesktopmediaservice 3.6.0\install\decoder.dll
- %APPDATA%\jetmedia\nativedesktopmediaservice 3.6.0\install\2cf5f20\commonappdatafolder\jetmedia\nativedesktopmediaservice\comdata.dat
- %APPDATA%\jetmedia\nativedesktopmediaservice 3.6.0\install\2cf5f20\desktop_media_service.exe
- %WINDIR%\installer\msia8ee.tmp
- C:\config.msi\1070b1.rbs
- %WINDIR%\installer\msiaf23.tmp
- %WINDIR%\installer\msiad7c.tmp
- %WINDIR%\installer\msiac24.tmp
- %TEMP%\msi6cd6.tmp
- %WINDIR%\installer\msi71b7.tmp
- %WINDIR%\installer\msi7264.tmp
- %WINDIR%\installer\msi72b3.tmp
- %WINDIR%\installer\msi860d.tmp
- %WINDIR%\installer\msi888f.tmp
- %WINDIR%\installer\msi88de.tmp
- %WINDIR%\installer\msi891d.tmp
- %TEMP%\msi6b7d.tmp
- %WINDIR%\installer\msi8ebc.tmp
- %WINDIR%\installer\msi9248.tmp
- %WINDIR%\installer\msia8ff.tmp
- %WINDIR%\installer\msia91f.tmp
- %WINDIR%\installer\msia9cc.tmp
- %WINDIR%\installer\msiaa4a.tmp
- %WINDIR%\installer\msiaa6a.tmp
- %WINDIR%\installer\msiaa9a.tmp
- %WINDIR%\installer\msiab66.tmp
- %WINDIR%\installer\msi9218.tmp
- %APPDATA%\jetmedia\nativedesktopmediaservice 3.6.0\install\2cf5f20\networkdesktopmedia.msi
- %APPDATA%\jetmedia\nativedesktopmediaservice 3.6.0\install\2cf5f20\watchdog.exe
Самоудаляется.
Сетевая активность
TCP
Запросы HTTP GET
- http://in###don.club/?ch#########################################################################################################################################################################...
- http://ip###i.com:80/json
- http://xf###cte.com/npcomdata.dat
Запросы HTTP POST
- http://tm#.###tdataxew.info/
- http://tm#.####tincoandhar.info/
- http://nt###est.com/tickets
- http://ss#.####tincoandhar.info/
- http://in##.##stdataxew.info/
- http://kr####q.com:40000/tickets
- http://mr##wic.com/tickets
- http://in##.###ntincoandhar.info/
- http://sc#.####tincoandhar.info/
UDP
- DNS ASK tm#.###tdataxew.info
- DNS ASK in##.##stdataxew.info
- DNS ASK in###don.club
- DNS ASK do#####dhostnow.info
- DNS ASK do#####dnowportal.info
- DNS ASK tm#.####tincoandhar.info
- DNS ASK nt###est.com
- DNS ASK in##.###ntincoandhar.info
- DNS ASK ip##pi.com
- DNS ASK ex##ple.com
- DNS ASK sc#.####tincoandhar.info
- DNS ASK ss#.####tincoandhar.info
- DNS ASK kr##wiq.com
- DNS ASK mr##wic.com
- DNS ASK xf###cte.com
Другое
Создает и запускает на исполнение
- '%TEMP%\is-a79h1.tmp\<Имя файла>.tmp' /SL5="$90246,1114695,121344,<Полный путь к файлу>"
- '%TEMP%\is-j4sl2.tmp\<Имя файла>.tmp' /SL5="$800DE,1114695,121344,<Полный путь к файлу>" /VERYSILENT /SL5="$90246,1114695,121344,<Полный путь к файлу>"
- '%TEMP%\{70aa3717-1e52-e9c7-aafe-fdf7f2d641c3}\pse.exe' /efd= /efl= /efd= /efd= /efd= /efd=
- '%TEMP%\{70aa3717-1e52-e9c7-aafe-fdf7f2d641c3}\na.exe' /QN VENDOR_ID="fdx"
- '%WINDIR%\installer\msi72b3.tmp' /p="%TEMP%\{70AA3717-1E52-E9C7-AAFE-FDF7F2D641C3}\na.exe" /p="%APPDATA%\Jetmedia\NativeDesktopMediaService 3.6.0\install\2CF5F20\NetworkDesktopMedia.msi" /p="%ProgramFiles(x86)%\Jetmedia\Native...
- '%TEMP%\1b896a1019e1c419e6ac.msi72b3.tmp' $$Psu5-gELsEzYovIWZuzrTPR1lKZ60LNNfo4ybtEliq1Oix9_d9NM1dV_YSKGXrYKl70sPX9TouSqzCOphkuw1fCCxRdAfqP3ZAvx-Ycmtl2FjGWbwT8duLVZEYNSEu8EB_1RoCQYfl3i4iCBUnxVVHgiiXkPX5chZ-bOtEfAGlkqbhehl3T9X1VNh7DOkU5...
- '%ProgramFiles(x86)%\jetmedia\nativedesktopmediaservice\desktop_media_service.exe' --service
- '%TEMP%\{70aa3717-1e52-e9c7-aafe-fdf7f2d641c3}\pse.exe' /efd= /efl= /efd= /efd= /efd= /efd=' (со скрытым окном)
- '%TEMP%\{70aa3717-1e52-e9c7-aafe-fdf7f2d641c3}\na.exe' /QN VENDOR_ID="fdx"' (со скрытым окном)
Запускает на исполнение
- '%WINDIR%\syswow64\regsvr32.exe' "%TEMP%\is-P4P6M.tmp\ijru.dll" /i /n /s:"$$y_aaaq3zrgBazNjhmK2LMEkdxIRjhju96UMswmQZ30uxGxgfgL44NNQ3YV4snIje_ISJtvC8dcxeKVDFEHKXCVuBqMGyUf4zziiiv-CxOZqIkPAnnT901pf-cSF8nmTU2X3glCk9ikbbX8s4jNLTyb...
- '%WINDIR%\syswow64\regsvr32.exe' "%TEMP%\is-8JFC1.tmp\ijru.dll" /i /n /s:"$$YqY-xRXDbnU5dwBPIQSuqfDmUkqPowm4P0ZGBeejL983Pq3UeNXNNK-NiJaykbCZwUo1afIBfZDONzE-8CC8ZNDR9kiuvPCeVY_LPh-gO-ABuZWG0VLm0ipY7mu2UuEl-EM8_ZM8F8w4J8firh3XRx...
- '%WINDIR%\syswow64\msiexec.exe' -Embedding 81A089C1D442DDBA6F85BB287D1B12DC C
- '%WINDIR%\syswow64\msiexec.exe' /i "%APPDATA%\Jetmedia\NativeDesktopMediaService 3.6.0\install\2CF5F20\NetworkDesktopMedia.msi" /QN VENDOR_ID=fdx AI_SETUPEXEPATH=%TEMP%\{70AA3717-1E52-E9C7-AAFE-FDF7F2D641C3}\na.exe SETUPEXEDI...
- '%WINDIR%\syswow64\msiexec.exe' -Embedding A04305DF571C20F1F454465122DCCE96
- '%WINDIR%\syswow64\msiexec.exe' -Embedding A5FC8EA79F912C850349CA9F3417D9F3 M Global\MSI0000
- '%WINDIR%\syswow64\cmd.exe' /c for /l %x in (1, 1, 2) do del /Q "<Полный путь к файлу>" & timeout /t 5
- '%WINDIR%\syswow64\cmd.exe' /c for /l %x in (1, 1, 2) do rmdir /S /Q "%TEMP%\is-8JFC1.tmp" & timeout /t 5
- '%WINDIR%\syswow64\cmd.exe' /c for /l %x in (1, 1, 2) do rmdir /S /Q "%TEMP%\is-P4P6M.tmp" & timeout /t 5
- '%WINDIR%\syswow64\timeout.exe' /t 5
