Техническая информация
Вредоносные функции
Запускает на исполнение
- '<SYSTEM32>\taskkill.exe' -f /im svshost.exe
- '<SYSTEM32>\taskkill.exe' -f /im svshosb.exe
Изменения в файловой системе
Создает следующие файлы
- %WINDIR%\debug\system\skycmd.bat
- %WINDIR%\debug\system\start.bat
- %WINDIR%\debug\system\start2.bat
- %WINDIR%\debug\system\down.bat
- %WINDIR%\debug\system\hosts
- %WINDIR%\debug\system\install3.bat
- %WINDIR%\debug\system\open.bat
- %WINDIR%\debug\system\qc.bat
- C:\programdata\microsoft\test\down.bat
- C:\programdata\microsoft\test\open.bat
- C:\programdata\microsoft\test\hosts
- nul
Присваивает атрибут 'скрытый' для следующих файлов
- C:\programdata\microsoft\test\down.bat
- C:\programdata\microsoft\test\hosts
- C:\programdata\microsoft\test\open.bat
Другое
Ищет следующие окна
- ClassName: 'EDIT' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
Создает и запускает на исполнение
- '<SYSTEM32>\cmd.exe' /c ""%WINDIR%\debug\SYSTEM\install3.bat" h"' (со скрытым окном)
Запускает на исполнение
- '<SYSTEM32>\cmd.exe' /c ""%WINDIR%\debug\SYSTEM\start.bat" "
- '<SYSTEM32>\netsh.exe' ipsec static add filteraction name=deny action=block
- '<SYSTEM32>\netsh.exe' ipsec static add filteraction name=Allow action=permit
- '<SYSTEM32>\netsh.exe' ipsec static add filter filterlist=denylist srcaddr=any dstaddr=me description=not protocol=tcp mirrored=yes dstport=445
- '<SYSTEM32>\netsh.exe' ipsec static add filter filterlist=denylist srcaddr=any dstaddr=me description=not protocol=tcp mirrored=yes dstport=139
- '<SYSTEM32>\netsh.exe' ipsec static add filter filterlist=denylist srcaddr=any dstaddr=me description=not protocol=tcp mirrored=yes dstport=138
- '<SYSTEM32>\netsh.exe' ipsec static add filter filterlist=denylist srcaddr=any dstaddr=me description=not protocol=tcp mirrored=yes dstport=137
- '<SYSTEM32>\netsh.exe' ipsec static add filter filterlist=denylist srcaddr=any dstaddr=me description=not protocol=tcp mirrored=yes dstport=135
- '<SYSTEM32>\netsh.exe' ipsec static add filterlist name=denylist
- '<SYSTEM32>\netsh.exe' ipsec static add filterlist name=Allowlist
- '<SYSTEM32>\netsh.exe' ipsec static add policy name=win
- '<SYSTEM32>\cmd.exe' /c sc query FTPUPDATE
- '<SYSTEM32>\sc.exe' QUERY FTPUPDATE
- '<SYSTEM32>\cmd.exe' /c ""%WINDIR%\debug\SYSTEM\install3.bat" h"
- '<SYSTEM32>\mshta.exe' vbscript:createobject("wscript.shell").run("""install3.bat"" h",0)(window.close)
- '<SYSTEM32>\netsh.exe' ipsec static add rule name=deny1 policy=win filterlist=denylist filteraction=deny
- '<SYSTEM32>\attrib.exe' +S +H %WINDIR%\debug\SYSTEM
- '<SYSTEM32>\attrib.exe' +S +H C:\ProgramData\Microsoft\test\open.bat
- '<SYSTEM32>\attrib.exe' +S +H C:\ProgramData\Microsoft\test\down.bat
- '<SYSTEM32>\attrib.exe' +S +H %WINDIR%\Tasks\hook
- '<SYSTEM32>\attrib.exe' +S +H C:\ProgramData\Microsoft\test\*
- '<SYSTEM32>\attrib.exe' +S +H C:\ProgramData\Microsoft\test
- '<SYSTEM32>\schtasks.exe' /F /create /ru system /sc HOURLY /mo 23 /tn skycmd /tr C:\ProgramData\Microsoft\test\skycmd.bat
- '<SYSTEM32>\schtasks.exe' /F /create /ru system /sc HOURLY /mo 1 /tn DNS /tr C:\ProgramData\Microsoft\test\open.bat
- '<SYSTEM32>\schtasks.exe' /F /create /ru system /sc HOURLY /mo 12 /tn SYSTEM /tr C:\ProgramData\Microsoft\test\down.bat
- '<SYSTEM32>\attrib.exe' -S -H %WINDIR%\debug\SYSTEM\*
- '<SYSTEM32>\attrib.exe' -S -H C:\ProgramData\Microsoft\test\*
- '<SYSTEM32>\netsh.exe' interface ip set dns ▒╛╡╪┴Вј╜╙3 static 114.114.114.114
- '<SYSTEM32>\netsh.exe' interface ip set dns ▒╛╡╪┴Вј╜╙2 static 114.114.114.114
- '<SYSTEM32>\netsh.exe' interface ip set dns ▒╛╡╪┴Вј╜╙1 static 114.114.114.114
- '<SYSTEM32>\netsh.exe' interface ip set dns ▒╛╡╪┴Вј╜╙ static 114.114.114.114
- '<SYSTEM32>\cmd.exe' /K start2.bat
- '<SYSTEM32>\netsh.exe' ipsec static set policy name=win assign=y
