Техническая информация
Для обеспечения автозапуска и распространения
Создает или изменяет следующие файлы
- <SYSTEM32>\tasks\nvngxupdatecheckdaily_{78821544-1544-1544-1544-788215441544}
Вредоносные функции
Внедряет код в
следующие системные процессы:
- <SYSTEM32>\cmd.exe
следующие пользовательские процессы:
- 4358.tmp.exe
Завершает или пытается завершить
следующие пользовательские процессы:
- firefox.exe
Ищет ветки реестра, отвечающие за хранение паролей сторонними программами
- [<HKCU>\Software\Martin Prikryl]
- [<HKLM>\Software\Martin Prikryl]
- [<HKCU>\Software\Microsoft\Internet Account Manager\Accounts]
- [<HKCU>\Identities\{A393BE9D-3F97-4C05-BBA1-37C8B8CA0B32}\Software\Microsoft\Internet Account Manager\Accounts]
- [<HKLM>\Software\Microsoft\Internet Account Manager]
- [<HKCU>\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts]
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings]
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook]
Читает файлы, отвечающие за хранение паролей сторонними программами
- %APPDATA%\mozilla\firefox\profiles.ini
- <LS_APPDATA>\google\chrome\user data\default\cookies
- <LS_APPDATA>\google\chrome\user data\default\web data
- <LS_APPDATA>\chromium\user data\default\web data
- %APPDATA%\thunderbird\profiles.ini
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\4dd3.tmp
- %TEMP%\adlibs\msvcp140.dll
- %TEMP%\adlibs\nss3.dll
- %TEMP%\adlibs\nssckbi.dll
- %TEMP%\adlibs\api-ms-win-core-namedpipe-l1-1-0.dll
- %TEMP%\adlibs\api-ms-win-core-processenvironment-l1-1-0.dll
- %TEMP%\adlibs\api-ms-win-core-processthreads-l1-1-0.dll
- %TEMP%\adlibs\api-ms-win-core-processthreads-l1-1-1.dll
- %TEMP%\adlibs\mozglue.dll
- %TEMP%\adlibs\api-ms-win-core-profile-l1-1-0.dll
- %TEMP%\adlibs\mozmapi32_inuse.dll
- %TEMP%\adlibs\api-ms-win-core-string-l1-1-0.dll
- %TEMP%\adlibs\api-ms-win-core-synch-l1-2-0.dll
- %TEMP%\adlibs\api-ms-win-core-sysinfo-l1-1-0.dll
- %TEMP%\adlibs\api-ms-win-core-timezone-l1-1-0.dll
- %TEMP%\adlibs\api-ms-win-core-util-l1-1-0.dll
- %TEMP%\adlibs\api-ms-win-crt-conio-l1-1-0.dll
- %TEMP%\adlibs\api-ms-win-crt-convert-l1-1-0.dll
- %TEMP%\adlibs\api-ms-win-crt-environment-l1-1-0.dll
- %TEMP%\adlibs\api-ms-win-core-rtlsupport-l1-1-0.dll
- %TEMP%\adlibs\api-ms-win-crt-filesystem-l1-1-0.dll
- %TEMP%\adlibs\api-ms-win-core-synch-l1-1-0.dll
- %TEMP%\adlibs\mozmapi32.dll
- %TEMP%\adlibs\mapiproxy_inuse.dll
- %TEMP%\adlibs\mapiproxy.dll
- %TEMP%\q7shekcnbo
- %TEMP%\llc0g8g8ru
- %TEMP%\snmnty8kzx
- %TEMP%\adlibs\ff-funcs.zip
- %PROGRAMDATA%\msvcp140.dll
- %TEMP%\adlibs\nssdbm3.dll
- %TEMP%\adlibs\prldap60.dll
- %TEMP%\adlibs\qipcap.dll
- %TEMP%\d2yvlzrhbi
- %TEMP%\adlibs\softokn3.dll
- %TEMP%\adlibs\vcruntime140.dll
- %TEMP%\adlibs\accessiblehandler.dll
- %TEMP%\adlibs\accessiblemarshal.dll
- %TEMP%\adlibs\breakpadinjector.dll
- %TEMP%\adlibs\freebl3.dll
- %TEMP%\adlibs\ia2marshal.dll
- %TEMP%\adlibs\ldap60.dll
- %TEMP%\adlibs\ldif60.dll
- %TEMP%\adlibs\lgpllibs.dll
- %TEMP%\adlibs\ucrtbase.dll
- %TEMP%\adlibs\libegl.dll
- %TEMP%\7dmpdonxrw
- %TEMP%\o74sokyoss
- %TEMP%\adlibs\api-ms-win-crt-heap-l1-1-0.dll
- %TEMP%\adlibs\api-ms-win-crt-private-l1-1-0.dll
- %PROGRAMDATA%\wyvmwoszm3t5u9xlz2ntpa3hl\historych
- %PROGRAMDATA%\wyvmwoszm3t5u9xlz2ntpa3hl\files\history\google chrome_default.txt
- %PROGRAMDATA%\wyvmwoszm3t5u9xlz2ntpa3hl\files\cookies\google chrome_default.txt
- %PROGRAMDATA%\wyvmwoszm3t5u9xlz2ntpa3hl\wd
- %PROGRAMDATA%\wyvmwoszm3t5u9xlz2ntpa3hl\files\history\chromium_default.txt
- %PROGRAMDATA%\wyvmwoszm3t5u9xlz2ntpa3hl\files\history\opera_stable.txt
- %PROGRAMDATA%\wyvmwoszm3t5u9xlz2ntpa3hl\files\telegram\d877f783d5d3ef8c1
- %PROGRAMDATA%\wyvmwoszm3t5u9xlz2ntpa3hl\files\telegram\map0
- %PROGRAMDATA%\wyvmwoszm3t5u9xlz2ntpa3hl\files\history\history_mozilla firefox_k0im4xo3.default.txt
- %PROGRAMDATA%\wyvmwoszm3t5u9xlz2ntpa3hl\ld
- %PROGRAMDATA%\wyvmwoszm3t5u9xlz2ntpa3hl\files\cookie_list.txt
- %TEMP%\firefox_cookie.txt
- %TEMP%\bm1e9n
- %TEMP%\bm1e9n-shm
- %PROGRAMDATA%\wyvmwoszm3t5u9xlz2ntpa3hl\files\information.txt
- %PROGRAMDATA%\wyvmwoszm3t5u9xlz2ntpa3hl\files\files\default.zip
- %PROGRAMDATA%\wyvmwoszm3t5u9xlz2ntpa3hl\files\files\velichko maksim vladimirovich.zip
- %PROGRAMDATA%\wyvmwoszm3t5u9xlz2ntpa3hl\files\files\fffgggg.zip
- %TEMP%\machineinfo.txt
- %TEMP%\71zwmk
- %TEMP%\71zwmk-shm
- %PROGRAMDATA%\wyvmwoszm3t5u9xlz2ntpa3hl\history-shm
- %PROGRAMDATA%\wyvmwoszm3t5u9xlz2ntpa3hl\files\cookies\cookies_mozilla firefox_k0im4xo3.default.txt
- %TEMP%\1076988470888412633333.tmp
- %TEMP%\adlibs\api-ms-win-crt-process-l1-1-0.dll
- %TEMP%\adlibs\api-ms-win-crt-runtime-l1-1-0.dll
- %TEMP%\adlibs\api-ms-win-crt-stdio-l1-1-0.dll
- %TEMP%\adlibs\api-ms-win-crt-string-l1-1-0.dll
- %TEMP%\adlibs\api-ms-win-crt-time-l1-1-0.dll
- %TEMP%\adlibs\api-ms-win-crt-utility-l1-1-0.dll
- %TEMP%\adlibs\api-ms-win-core-file-l1-2-0.dll
- %TEMP%\adlibs\api-ms-win-core-file-l2-1-0.dll
- %TEMP%\adlibs\api-ms-win-core-handle-l1-1-0.dll
- %TEMP%\adlibs\api-ms-win-core-heap-l1-1-0.dll
- %TEMP%\adlibs\api-ms-win-core-interlocked-l1-1-0.dll
- %TEMP%\adlibs\api-ms-win-core-libraryloader-l1-1-0.dll
- %TEMP%\adlibs\api-ms-win-core-localization-l1-2-0.dll
- %TEMP%\adlibs\api-ms-win-core-memory-l1-1-0.dll
- %PROGRAMDATA%\nss3.dll
- %PROGRAMDATA%\softokn3.dll
- %PROGRAMDATA%\vcruntime140.dll
- %PROGRAMDATA%\wyvmwoszm3t5u9xlz2ntpa3hl\c
- %PROGRAMDATA%\wyvmwoszm3t5u9xlz2ntpa3hl\c-shm
- %TEMP%\adlibs\api-ms-win-crt-locale-l1-1-0.dll
- %TEMP%\adlibs\api-ms-win-crt-multibyte-l1-1-0.dll
- %TEMP%\adlibs\api-ms-win-crt-math-l1-1-0.dll
- %TEMP%\1apgjk9lvk
- %TEMP%\850e.tmp-shm
- %TEMP%\850e.tmp
- %TEMP%\9466e55e\api-ms-win-core-processthreads-l1-1-0.dll
- %TEMP%\9466e55e\api-ms-win-core-processthreads-l1-1-1.dll
- %TEMP%\9466e55e\api-ms-win-core-profile-l1-1-0.dll
- %TEMP%\9466e55e\api-ms-win-core-rtlsupport-l1-1-0.dll
- %TEMP%\9466e55e\api-ms-win-core-string-l1-1-0.dll
- %TEMP%\9466e55e\api-ms-win-core-synch-l1-1-0.dll
- %TEMP%\9466e55e\api-ms-win-core-synch-l1-2-0.dll
- %TEMP%\9466e55e\api-ms-win-core-memory-l1-1-0.dll
- %TEMP%\9466e55e\api-ms-win-core-sysinfo-l1-1-0.dll
- %TEMP%\9466e55e\api-ms-win-core-processenvironment-l1-1-0.dll
- %TEMP%\9466e55e\api-ms-win-core-util-l1-1-0.dll
- %TEMP%\9466e55e\api-ms-win-crt-convert-l1-1-0.dll
- %TEMP%\9466e55e\api-ms-win-crt-environment-l1-1-0.dll
- %TEMP%\9466e55e\api-ms-win-crt-filesystem-l1-1-0.dll
- %TEMP%\9466e55e\api-ms-win-crt-heap-l1-1-0.dll
- %TEMP%\9466e55e\api-ms-win-crt-locale-l1-1-0.dll
- %TEMP%\9466e55e\api-ms-win-crt-math-l1-1-0.dll
- %TEMP%\9466e55e\api-ms-win-crt-multibyte-l1-1-0.dll
- %TEMP%\9466e55e\api-ms-win-core-timezone-l1-1-0.dll
- %TEMP%\9466e55e\api-ms-win-core-localization-l1-2-0.dll
- %TEMP%\9466e55e\api-ms-win-crt-conio-l1-1-0.dll
- %TEMP%\9466e55e\api-ms-win-core-libraryloader-l1-1-0.dll
- %TEMP%\9466e55e\api-ms-win-core-interlocked-l1-1-0.dll
- %APPDATA%\vhtruvv
- %APPDATA%\jcjhwcw
- %TEMP%\fb50.tmp.exe
- %TEMP%\6ef.tmp.exe
- %TEMP%\172c.tmp.exe
- %TEMP%\2e9b.tmp.exe
- %TEMP%\4358.tmp.exe
- %PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
- %PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
- %PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
- %APPDATA%\eetcwdv
- <LS_APPDATA>\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
- %TEMP%\9466e55e\api-ms-win-core-datetime-l1-1-0.dll
- %TEMP%\9466e55e\api-ms-win-core-debug-l1-1-0.dll
- %TEMP%\9466e55e\api-ms-win-core-errorhandling-l1-1-0.dll
- %TEMP%\9466e55e\api-ms-win-core-file-l1-1-0.dll
- %TEMP%\9466e55e\api-ms-win-core-file-l1-2-0.dll
- %TEMP%\9466e55e\api-ms-win-core-file-l2-1-0.dll
- %TEMP%\9466e55e\api-ms-win-core-handle-l1-1-0.dll
- %TEMP%\9466e55e\api-ms-win-core-heap-l1-1-0.dll
- %TEMP%\9466e55e\api-ms-win-crt-private-l1-1-0.dll
- %TEMP%\9466e55e\api-ms-win-core-console-l1-1-0.dll
- %TEMP%\9466e55e\api-ms-win-crt-process-l1-1-0.dll
- %TEMP%\9466e55e\api-ms-win-core-namedpipe-l1-1-0.dll
- %TEMP%\9466e55e\api-ms-win-crt-runtime-l1-1-0.dll
- %TEMP%\107728998513392365642.tmp
- %TEMP%\10773695979852781441457.tmp
- %TEMP%\1077439217399331398259.tmp
- %TEMP%\1077509830356528798573.tmp
- %TEMP%\10780703171818518769514.tmp
- %TEMP%\10780703171818518769514.tmp-shm
- %PROGRAMDATA%\freebl3.dll
- %TEMP%\sqlite3.dll
- %PROGRAMDATA%\mozglue.dll
- %TEMP%\800c.tmp
- %TEMP%\800d.tmp
- %TEMP%\8091.tmp
- %TEMP%\p1kalmig2k
- %TEMP%\809c.tmp
- %TEMP%\827d.tmp
- %TEMP%\82b0.tmp
- %TEMP%\b7fzp5tm1q
- %TEMP%\8424.tmp
- %TEMP%\bi6dss92c3
- %TEMP%\84c6.tmp
- %TEMP%\10771085813850299579756.tmp
- %TEMP%\9466e55e\api-ms-win-crt-stdio-l1-1-0.dll
- %TEMP%\10772999404125570994363.tmp
- %PROGRAMDATA%\wyvmwoszm3t5u9xlz2ntpa3hl\history
- %TEMP%\log.zip
- %TEMP%\10769783913984524418833.tmp
- %TEMP%\9466e55e\api-ms-win-crt-time-l1-1-0.dll
- %TEMP%\9466e55e\api-ms-win-crt-utility-l1-1-0.dll
- %TEMP%\9466e55e\freebl3.dll
- %TEMP%\9466e55e\mozglue.dll
- %TEMP%\9466e55e\msvcp140.dll
- %TEMP%\9466e55e\nss3.dll
- %TEMP%\9466e55e\nssdbm3.dll
- %TEMP%\9466e55e\softokn3.dll
- %TEMP%\9466e55e\ucrtbase.dll
- %TEMP%\9466e55e\api-ms-win-crt-string-l1-1-0.dll
- %TEMP%\9466e55e\vcruntime140.dll
- %TEMP%\10745152256495784055161.tmp
- %TEMP%\68e2.tmp
- %TEMP%\68e2.tmp-shm
- %TEMP%\68f7.tmp
- %TEMP%\1076307200504357301665.tmp
- %TEMP%\10764873776385398589838.tmp
- %TEMP%\10766489906839633472804.tmp
- %TEMP%\10766489906839633472804.tmp-shm
- %TEMP%\1076908593241484723984.tmp
- %TEMP%\1074404918444205373560.tmp
- %TEMP%\10770189714495415354730.tmp
- nul
Присваивает атрибут 'скрытый' для следующих файлов
- %APPDATA%\vhtruvv
- %APPDATA%\eetcwdv
- %APPDATA%\jcjhwcw
Удаляет следующие файлы
- %TEMP%\1074404918444205373560.tmp
- %TEMP%\adlibs\api-ms-win-core-file-l1-2-0.dll
- %TEMP%\adlibs\api-ms-win-core-file-l2-1-0.dll
- %TEMP%\adlibs\api-ms-win-core-handle-l1-1-0.dll
- %TEMP%\adlibs\api-ms-win-core-heap-l1-1-0.dll
- %TEMP%\adlibs\api-ms-win-core-interlocked-l1-1-0.dll
- %TEMP%\adlibs\api-ms-win-core-libraryloader-l1-1-0.dll
- %TEMP%\adlibs\accessiblehandler.dll
- %TEMP%\adlibs\accessiblemarshal.dll
- %TEMP%\adlibs\api-ms-win-core-localization-l1-2-0.dll
- %TEMP%\adlibs\api-ms-win-core-processenvironment-l1-1-0.dll
- %TEMP%\adlibs\api-ms-win-core-processthreads-l1-1-0.dll
- %TEMP%\adlibs\api-ms-win-core-processthreads-l1-1-1.dll
- %TEMP%\adlibs\api-ms-win-core-profile-l1-1-0.dll
- %TEMP%\adlibs\api-ms-win-core-rtlsupport-l1-1-0.dll
- %TEMP%\adlibs\api-ms-win-core-string-l1-1-0.dll
- %TEMP%\adlibs\api-ms-win-core-memory-l1-1-0.dll
- %TEMP%\adlibs\api-ms-win-core-namedpipe-l1-1-0.dll
- %TEMP%\machineinfo.txt
- %TEMP%\bm1e9n
- %TEMP%\adlibs\api-ms-win-core-synch-l1-2-0.dll
- %TEMP%\llc0g8g8ru
- %TEMP%\snmnty8kzx
- %TEMP%\2e9b.tmp.exe
- %TEMP%\adlibs\ff-funcs.zip
- %PROGRAMDATA%\wyvmwoszm3t5u9xlz2ntpa3hl\c-shm
- %PROGRAMDATA%\wyvmwoszm3t5u9xlz2ntpa3hl\history-shm
- %PROGRAMDATA%\freebl3.dll
- %PROGRAMDATA%\mozglue.dll
- %PROGRAMDATA%\msvcp140.dll
- %PROGRAMDATA%\nss3.dll
- %PROGRAMDATA%\softokn3.dll
- %PROGRAMDATA%\vcruntime140.dll
- %TEMP%\71zwmk-shm
- %TEMP%\71zwmk
- %TEMP%\bm1e9n-shm
- %TEMP%\adlibs\api-ms-win-core-synch-l1-1-0.dll
- %TEMP%\o74sokyoss
- %TEMP%\firefox_cookie.txt
- %TEMP%\9466e55e\api-ms-win-crt-string-l1-1-0.dll
- %TEMP%\adlibs\api-ms-win-core-sysinfo-l1-1-0.dll
- %TEMP%\adlibs\lgpllibs.dll
- %TEMP%\adlibs\libegl.dll
- %TEMP%\adlibs\mapiproxy.dll
- %TEMP%\adlibs\mapiproxy_inuse.dll
- %TEMP%\adlibs\mozglue.dll
- %TEMP%\adlibs\mozmapi32.dll
- %TEMP%\adlibs\mozmapi32_inuse.dll
- %TEMP%\adlibs\msvcp140.dll
- %TEMP%\adlibs\nss3.dll
- %TEMP%\adlibs\nssckbi.dll
- %TEMP%\adlibs\nssdbm3.dll
- %TEMP%\adlibs\prldap60.dll
- %TEMP%\adlibs\qipcap.dll
- %TEMP%\adlibs\softokn3.dll
- %TEMP%\adlibs\ucrtbase.dll
- %TEMP%\adlibs\vcruntime140.dll
- %TEMP%\sqlite3.dll
- %TEMP%\adlibs\ldif60.dll
- %TEMP%\d2yvlzrhbi
- %TEMP%\q7shekcnbo
- %TEMP%\adlibs\freebl3.dll
- %TEMP%\adlibs\api-ms-win-core-util-l1-1-0.dll
- %TEMP%\adlibs\api-ms-win-crt-conio-l1-1-0.dll
- %TEMP%\adlibs\api-ms-win-crt-convert-l1-1-0.dll
- %TEMP%\adlibs\api-ms-win-crt-environment-l1-1-0.dll
- %TEMP%\adlibs\api-ms-win-crt-filesystem-l1-1-0.dll
- %TEMP%\adlibs\api-ms-win-crt-heap-l1-1-0.dll
- %TEMP%\adlibs\api-ms-win-crt-locale-l1-1-0.dll
- %TEMP%\adlibs\api-ms-win-crt-math-l1-1-0.dll
- %TEMP%\adlibs\api-ms-win-crt-multibyte-l1-1-0.dll
- %TEMP%\adlibs\api-ms-win-crt-private-l1-1-0.dll
- %TEMP%\adlibs\api-ms-win-crt-process-l1-1-0.dll
- %TEMP%\adlibs\api-ms-win-crt-runtime-l1-1-0.dll
- %TEMP%\adlibs\api-ms-win-crt-stdio-l1-1-0.dll
- %TEMP%\adlibs\api-ms-win-crt-string-l1-1-0.dll
- %TEMP%\adlibs\api-ms-win-crt-time-l1-1-0.dll
- %TEMP%\adlibs\api-ms-win-crt-utility-l1-1-0.dll
- %TEMP%\adlibs\breakpadinjector.dll
- %TEMP%\adlibs\ia2marshal.dll
- %TEMP%\adlibs\api-ms-win-core-timezone-l1-1-0.dll
- %TEMP%\7dmpdonxrw
- %TEMP%\1apgjk9lvk
- %TEMP%\850e.tmp
- %TEMP%\9466e55e\api-ms-win-core-console-l1-1-0.dll
- %TEMP%\9466e55e\api-ms-win-core-datetime-l1-1-0.dll
- %TEMP%\9466e55e\api-ms-win-core-debug-l1-1-0.dll
- %TEMP%\9466e55e\api-ms-win-core-errorhandling-l1-1-0.dll
- %TEMP%\9466e55e\api-ms-win-core-file-l1-1-0.dll
- %TEMP%\9466e55e\api-ms-win-core-file-l1-2-0.dll
- %TEMP%\9466e55e\api-ms-win-core-file-l2-1-0.dll
- %TEMP%\9466e55e\api-ms-win-core-handle-l1-1-0.dll
- %TEMP%\9466e55e\api-ms-win-core-heap-l1-1-0.dll
- %TEMP%\9466e55e\api-ms-win-core-interlocked-l1-1-0.dll
- %TEMP%\9466e55e\api-ms-win-core-libraryloader-l1-1-0.dll
- %TEMP%\9466e55e\api-ms-win-core-localization-l1-2-0.dll
- %TEMP%\9466e55e\api-ms-win-core-memory-l1-1-0.dll
- %TEMP%\9466e55e\api-ms-win-core-namedpipe-l1-1-0.dll
- %TEMP%\9466e55e\api-ms-win-core-processenvironment-l1-1-0.dll
- %TEMP%\800c.tmp
- %TEMP%\10780703171818518769514.tmp-shm
- %TEMP%\8091.tmp
- %TEMP%\log.zip
- %TEMP%\9466e55e\api-ms-win-core-processthreads-l1-1-0.dll
- %TEMP%\1077509830356528798573.tmp
- %TEMP%\68e2.tmp-shm
- %TEMP%\68e2.tmp
- %TEMP%\68f7.tmp
- %TEMP%\1076307200504357301665.tmp
- %TEMP%\10764873776385398589838.tmp
- %TEMP%\10766489906839633472804.tmp-shm
- %TEMP%\10766489906839633472804.tmp
- %TEMP%\10745152256495784055161.tmp
- %TEMP%\1076908593241484723984.tmp
- %TEMP%\1076988470888412633333.tmp
- %TEMP%\10770189714495415354730.tmp
- %TEMP%\10771085813850299579756.tmp
- %TEMP%\107728998513392365642.tmp
- %TEMP%\10772999404125570994363.tmp
- %TEMP%\10773695979852781441457.tmp
- %TEMP%\1077439217399331398259.tmp
- %TEMP%\10769783913984524418833.tmp
- %TEMP%\10780703171818518769514.tmp
- %TEMP%\adlibs\ldap60.dll
- %TEMP%\9466e55e\api-ms-win-core-processthreads-l1-1-1.dll
- %TEMP%\9466e55e\api-ms-win-core-string-l1-1-0.dll
- %TEMP%\9466e55e\mozglue.dll
- %TEMP%\9466e55e\msvcp140.dll
- %TEMP%\9466e55e\nss3.dll
- %TEMP%\9466e55e\nssdbm3.dll
- %TEMP%\9466e55e\softokn3.dll
- %TEMP%\9466e55e\ucrtbase.dll
- %TEMP%\9466e55e\vcruntime140.dll
- %TEMP%\p1kalmig2k
- %TEMP%\809c.tmp
- %TEMP%\827d.tmp
- %TEMP%\82b0.tmp
- %TEMP%\b7fzp5tm1q
- %TEMP%\8424.tmp
- %TEMP%\bi6dss92c3
- %TEMP%\84c6.tmp
- %TEMP%\850e.tmp-shm
- %TEMP%\9466e55e\api-ms-win-core-profile-l1-1-0.dll
- %TEMP%\9466e55e\freebl3.dll
- %TEMP%\9466e55e\api-ms-win-core-rtlsupport-l1-1-0.dll
- %TEMP%\9466e55e\api-ms-win-crt-utility-l1-1-0.dll
- %TEMP%\800d.tmp
- %TEMP%\9466e55e\api-ms-win-core-synch-l1-1-0.dll
- %TEMP%\9466e55e\api-ms-win-core-synch-l1-2-0.dll
- %TEMP%\9466e55e\api-ms-win-core-sysinfo-l1-1-0.dll
- %TEMP%\9466e55e\api-ms-win-core-timezone-l1-1-0.dll
- %TEMP%\9466e55e\api-ms-win-core-util-l1-1-0.dll
- %TEMP%\9466e55e\api-ms-win-crt-conio-l1-1-0.dll
- %TEMP%\9466e55e\api-ms-win-crt-convert-l1-1-0.dll
- %TEMP%\9466e55e\api-ms-win-crt-environment-l1-1-0.dll
- %TEMP%\9466e55e\api-ms-win-crt-filesystem-l1-1-0.dll
- %TEMP%\9466e55e\api-ms-win-crt-heap-l1-1-0.dll
- %TEMP%\9466e55e\api-ms-win-crt-locale-l1-1-0.dll
- %TEMP%\9466e55e\api-ms-win-crt-math-l1-1-0.dll
- %TEMP%\9466e55e\api-ms-win-crt-multibyte-l1-1-0.dll
- %TEMP%\9466e55e\api-ms-win-crt-private-l1-1-0.dll
- %TEMP%\9466e55e\api-ms-win-crt-process-l1-1-0.dll
- %TEMP%\9466e55e\api-ms-win-crt-runtime-l1-1-0.dll
- %TEMP%\9466e55e\api-ms-win-crt-stdio-l1-1-0.dll
- %TEMP%\9466e55e\api-ms-win-crt-time-l1-1-0.dll
- %TEMP%\6ef.tmp.exe
Самоудаляется.
Сетевая активность
TCP
Запросы HTTP GET
- http://www.ms###csi.com/ncsi.txt
- http://ne######r2-service.space/raccon.exe
- http://ne######r2-service.space/azor24.exe
- http://ne######r2-service.space/reestr.exe
- http://wr####ychicago.org/freebl3.dll
- http://ne###fday2.site/
- http://wr####ychicago.org/mozglue.dll
- http://wr####ychicago.org/msvcp140.dll
- http://35.##6.189.253/gate/libs.zip
- http://wr####ychicago.org/nss3.dll
- http://wr####ychicago.org/softokn3.dll
- http://wr####ychicago.org/vcruntime140.dll
- http://35.##6.189.253/gate/sqlite3.dll
Запросы HTTP POST
- http://ne######r1-service.space/
- http://ne###fday2.site/
- http://35.##6.189.253/gate/log.php
- http://ne######r2-service.space/
UDP
- DNS ASK ne######r1-service.space
- DNS ASK ne######r2-service.space
- DNS ASK drive.google.com
- DNS ASK ne###fday2.site
- DNS ASK wr####ychicago.org
- DNS ASK do#########ocs.googleusercontent.com
- DNS ASK ip##pi.com
Другое
Создает и запускает на исполнение
- '%TEMP%\fb50.tmp.exe'
- '%TEMP%\6ef.tmp.exe'
- '%TEMP%\172c.tmp.exe'
- '%TEMP%\2e9b.tmp.exe'
- '%TEMP%\4358.tmp.exe'
- '<SYSTEM32>\cmd.exe' /c <SYSTEM32>\timeout.exe 3 & del "2E9B.tmp.exe"' (со скрытым окном)
Запускает на исполнение
- '%WINDIR%\explorer.exe'
- '<SYSTEM32>\cmd.exe' /c <SYSTEM32>\timeout.exe 3 & del "2E9B.tmp.exe"
- '<SYSTEM32>\timeout.exe' 3
- '<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "%TEMP%\6EF.tmp.exe"
- '<SYSTEM32>\ping.exe' 1.1.1.1 -n 1 -w 3000
