Техническая информация
Вредоносные функции
Внедряет код в
следующие системные процессы:
- %WINDIR%\syswow64\rundll32.exe
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\rarsfx0\1041.exe
- %TEMP%\rarsfx0\3010.exe
- %TEMP%\~07056.tmp
Удаляет следующие файлы
- %TEMP%\~07056.tmp
- %TEMP%\rarsfx0\3010.exe
- %TEMP%\rarsfx0\1041.exe
Подменяет следующие файлы
- %TEMP%\~07056.tmp
Сетевая активность
TCP
Запросы HTTP GET
- http://jp##.co.kr/report_N_0046_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_78786F787567776C646E6F63_75736572_BB7153C8_0F2BEF99_0_started_ext_ALRRR_N_OSBBB_64_OSNNN_Wind...
- http://jp##.co.kr/report_N_0046_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_78786F787567776C646E6F63_75736572_BB7153C8_0F2BEF99_23_process_svchost.exe
- http://jp##.co.kr/report_N_0046_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_78786F787567776C646E6F63_75736572_BB7153C8_0F2BEF99_24_process_dwm.exe
- http://jp##.co.kr/report_N_0046_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_78786F787567776C646E6F63_75736572_BB7153C8_0F2BEF99_25_process_explorer.exe
- http://jp##.co.kr/report_N_0046_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_78786F787567776C646E6F63_75736572_BB7153C8_0F2BEF99_26_process_spoolsv.exe
- http://jp##.co.kr/report_N_0046_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_78786F787567776C646E6F63_75736572_BB7153C8_0F2BEF99_27_process_taskhost.exe
- http://jp##.co.kr/report_N_0046_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_78786F787567776C646E6F63_75736572_BB7153C8_0F2BEF99_28_process_svchost.exe
- http://jp##.co.kr/report_N_0046_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_78786F787567776C646E6F63_75736572_BB7153C8_0F2BEF99_29_process_svchost.exe
- http://jp##.co.kr/report_N_0046_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_78786F787567776C646E6F63_75736572_BB7153C8_0F2BEF99_30_process_mdm.exe
- http://jp##.co.kr/report_N_0046_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_78786F787567776C646E6F63_75736572_BB7153C8_0F2BEF99_31_process_WUDFHost.exe
- http://jp##.co.kr/report_N_0046_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_78786F787567776C646E6F63_75736572_BB7153C8_0F2BEF99_32_process_iexplore.exe
- http://jp##.co.kr/report_N_0046_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_78786F787567776C646E6F63_75736572_BB7153C8_0F2BEF99_33_process_firefox.exe
- http://jp##.co.kr/report_N_0046_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_78786F787567776C646E6F63_75736572_BB7153C8_0F2BEF99_34_process_iexplore.exe
- http://jp##.co.kr/report_N_0046_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_78786F787567776C646E6F63_75736572_BB7153C8_0F2BEF99_35_process_svchost.exe
- http://jp##.co.kr/report_N_0046_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_78786F787567776C646E6F63_75736572_BB7153C8_0F2BEF99_36_process_OSPPSVC.EXE
- http://jp##.co.kr/report_N_0046_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_78786F787567776C646E6F63_75736572_BB7153C8_0F2BEF99_37_process_audiodg.exe
- http://jp##.co.kr/report_N_0046_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_78786F787567776C646E6F63_75736572_BB7153C8_0F2BEF99_38_process_rundll32.exe
- http://jp##.co.kr/report_N_0046_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_78786F787567776C646E6F63_75736572_BB7153C8_0F2BEF99_39_process_cmd.exe
- http://jp##.co.kr/report_N_0046_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_78786F787567776C646E6F63_75736572_BB7153C8_0F2BEF99_40_process_rundll32.exe
- http://jp##.co.kr/report_N_0046_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_78786F787567776C646E6F63_75736572_BB7153C8_0F2BEF99_41_process_cmd.exe
- http://jp##.co.kr/report_N_0046_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_78786F787567776C646E6F63_75736572_BB7153C8_0F2BEF99_42_process_conhost.exe
- http://jp##.co.kr/report_N_0046_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_78786F787567776C646E6F63_75736572_BB7153C8_0F2BEF99_43_process_systeminfo.exe
- http://jp##.co.kr/report_N_0046_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_78786F787567776C646E6F63_75736572_BB7153C8_0F2BEF99_44_process_WmiPrvSE.exe
- http://jp##.co.kr/report_N_0046_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_78786F787567776C646E6F63_75736572_BB7153C8_0F2BEF99_45_process_conhost.exe
- http://jp##.co.kr/report_N_0046_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_78786F787567776C646E6F63_75736572_BB7153C8_0F2BEF99_22_process_svchost.exe
- http://jp##.co.kr/report_N_0046_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_78786F787567776C646E6F63_75736572_BB7153C8_0F2BEF99_46_process_systeminfo.exe
- http://jp##.co.kr/report_N_0046_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_78786F787567776C646E6F63_75736572_BB7153C8_0F2BEF99_21_process_svchost.exe
- http://jp##.co.kr/report_N_0046_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_78786F787567776C646E6F63_75736572_BB7153C8_0F2BEF99_19_process_svchost.exe
- http://jp##.co.kr/report_N_0046_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_78786F787567776C646E6F63_75736572_BB7153C8_0F2BEF99_1_step_0
- http://jp##.co.kr/report_N_0046_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_78786F787567776C646E6F63_75736572_BB7153C8_0F2BEF99_2_step_1
- http://jp##.co.kr/report_N_0046_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_78786F787567776C646E6F63_75736572_BB7153C8_3EF976E5_0_started_ext_ALRRR_A_OSBBB_64_OSNNN_Wind...
- http://jp##.co.kr/report_N_0046_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_78786F787567776C646E6F63_75736572_BB7153C8_0F2BEF99_3_already_ok
- http://jp##.co.kr/report_N_0046_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_78786F787567776C646E6F63_75736572_BB7153C8_3EF976E5_1_step_0
- http://jp##.co.kr/report_N_0046_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_78786F787567776C646E6F63_75736572_BB7153C8_0F2BEF99_4_mark_ok
- http://jp##.co.kr/report_N_0046_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_78786F787567776C646E6F63_75736572_BB7153C8_3EF976E5_2_step_1
- http://jp##.co.kr/report_N_0046_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_78786F787567776C646E6F63_75736572_BB7153C8_0F2BEF99_5_process__System_Process_
- http://jp##.co.kr/report_N_0046_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_78786F787567776C646E6F63_75736572_BB7153C8_3EF976E5_3_already_active
- http://jp##.co.kr/report_N_0046_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_78786F787567776C646E6F63_75736572_BB7153C8_0F2BEF99_6_process_System
- http://jp##.co.kr/report_N_0046_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_78786F787567776C646E6F63_75736572_BB7153C8_0F2BEF99_5_watch2_start_645_608
- http://jp##.co.kr/report_N_0046_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_78786F787567776C646E6F63_75736572_BB7153C8_3EF976E5_4_finished
- http://jp##.co.kr/report_N_0046_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_78786F787567776C646E6F63_75736572_BB7153C8_0F2BEF99_7_process_smss.exe
- http://jp##.co.kr/report_N_0046_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_78786F787567776C646E6F63_75736572_BB7153C8_0F2BEF99_9_process_csrss.exe
- http://jp##.co.kr/report_N_0046_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_78786F787567776C646E6F63_75736572_BB7153C8_0F2BEF99_10_process_wininit.exe
- http://jp##.co.kr/report_N_0046_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_78786F787567776C646E6F63_75736572_BB7153C8_0F2BEF99_11_process_csrss.exe
- http://jp##.co.kr/report_N_0046_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_78786F787567776C646E6F63_75736572_BB7153C8_0F2BEF99_11_watch2_finish_575_611__1
- http://jp##.co.kr/report_N_0046_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_78786F787567776C646E6F63_75736572_BB7153C8_0F2BEF99_12_process_winlogon.exe
- http://jp##.co.kr/report_N_0046_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_78786F787567776C646E6F63_75736572_BB7153C8_0F2BEF99_14_process_services.exe
- http://jp##.co.kr/report_N_0046_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_78786F787567776C646E6F63_75736572_BB7153C8_0F2BEF99_15_process_lsass.exe
- http://jp##.co.kr/report_N_0046_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_78786F787567776C646E6F63_75736572_BB7153C8_0F2BEF99_16_process_lsm.exe
- http://jp##.co.kr/report_N_0046_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_78786F787567776C646E6F63_75736572_BB7153C8_0F2BEF99_17_process_svchost.exe
- http://jp##.co.kr/report_N_0046_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_78786F787567776C646E6F63_75736572_BB7153C8_0F2BEF99_18_process_svchost.exe
- http://jp##.co.kr/report_N_0046_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_78786F787567776C646E6F63_75736572_BB7153C8_0F2BEF99_20_process_svchost.exe
- http://jp##.co.kr/report_N_0046_7CC7B0FD3104CA01-781319454D88D001-F01343A37587D001-D291988E7587D001_78786F787567776C646E6F63_75736572_BB7153C8_0F2BEF99_47_step_2
UDP
- DNS ASK jp##.co.kr
Другое
Ищет следующие окна
- ClassName: 'EDIT' WindowName: ''
Создает и запускает на исполнение
- '%TEMP%\rarsfx0\3010.exe'
- '%TEMP%\rarsfx0\1041.exe'
- '%WINDIR%\syswow64\cmd.exe' /C SYSTEMINFO && SYSTEMINFO && SYSTEMINFO && SYSTEMINFO && SYSTEMINFO && DEL "%TEMP%\RarSFX0\3010.exe"' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /C SYSTEMINFO && SYSTEMINFO && SYSTEMINFO && SYSTEMINFO && SYSTEMINFO && DEL "%TEMP%\RarSFX0\1041.exe"' (со скрытым окном)
Запускает на исполнение
- '%WINDIR%\syswow64\rundll32.exe' shell32.dll,Control_RunDLL
- '%WINDIR%\syswow64\cmd.exe' /C SYSTEMINFO && SYSTEMINFO && SYSTEMINFO && SYSTEMINFO && SYSTEMINFO && DEL "%TEMP%\RarSFX0\3010.exe"
- '%WINDIR%\syswow64\cmd.exe' /C SYSTEMINFO && SYSTEMINFO && SYSTEMINFO && SYSTEMINFO && SYSTEMINFO && DEL "%TEMP%\RarSFX0\1041.exe"
- '%WINDIR%\syswow64\systeminfo.exe'
