Техническая информация
Вредоносные функции
Внедряет код в
следующие пользовательские процессы:
- chrome.exe
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\a450.tmp\app multi-pantallas.bat
- %TEMP%\monitor0\default\86f0.tmp
- %TEMP%\monitor1\default\top sites
- %TEMP%\etilqs_uqrdt2kx6urxmme
- %TEMP%\monitor1\default\top sites-journal
- %TEMP%\monitor3\default\top sites
- %TEMP%\etilqs_w562lobgbcs5tfs
- %TEMP%\monitor3\default\top sites-journal
- %TEMP%\monitor0\default\top sites
- %TEMP%\monitor2\default\8819.tmp
- %TEMP%\etilqs_ck55mwegqxsd8nz
- %TEMP%\etilqs_g21rujbuswjrbuc
- %TEMP%\monitor2\default\top sites-journal
- %TEMP%\monitor0\default\top sites-journal
- %TEMP%\monitor3\default\web data
- %TEMP%\monitor3\default\favicons
- %TEMP%\etilqs_zstiy3ifweccvmg
- %TEMP%\monitor3\default\web data-journal
- %TEMP%\etilqs_cvyrw8enz41zmuz
- %TEMP%\monitor2\default\top sites
- %TEMP%\monitor0\default\shortcuts-journal
- %TEMP%\monitor4\default\shortcuts-journal
- %TEMP%\monitor4\default\extension rules\manifest-000001
- %TEMP%\monitor1\default\shortcuts-journal
- %TEMP%\monitor3\default\shortcuts-journal
- %TEMP%\monitor2\default\shortcuts-journal
- %TEMP%\etilqs_jdwow1k2av1gaum
- %TEMP%\monitor4\default\history-journal
- %TEMP%\monitor4\default\top sites
- %TEMP%\etilqs_huvvqcljbzbc02s
- %TEMP%\monitor4\default\top sites-journal
- %TEMP%\monitor3\default\favicons-journal
- %TEMP%\monitor0\default\shortcuts
- %TEMP%\monitor5\default\extension rules\log
- %TEMP%\monitor5\default\extension rules\000001.dbtmp
- %TEMP%\monitor5\default\extension rules\manifest-000001
- %TEMP%\monitor4\default\web data
- %TEMP%\monitor4\default\extension rules\log
- %TEMP%\etilqs_lelfllkeclt489u
- %TEMP%\monitor4\default\web data-journal
- %TEMP%\monitor4\default\extension rules\000001.dbtmp
- %TEMP%\monitor1\default\8876.tmp
- %TEMP%\monitor3\default\88a5.tmp
- %TEMP%\monitor3\default\history
- %TEMP%\etilqs_avbl7y4fmx6rldr
- %TEMP%\monitor0\default\web data
- %TEMP%\etilqs_gkoz7rpoyinpevz
- %TEMP%\monitor0\default\favicons-journal
- %TEMP%\etilqs_zify3w5y6qevc7b
- %TEMP%\monitor0\default\web data-journal
- %TEMP%\monitor0\default\history
- %TEMP%\etilqs_vzeufa4iist4rj0
- %TEMP%\monitor0\default\history-journal
- %TEMP%\monitor0\default\favicons
- %TEMP%\monitor1\default\extension rules\log
- %TEMP%\monitor1\default\extension rules\manifest-000001
- %TEMP%\monitor2\default\extension rules\log
- %TEMP%\monitor2\default\extension rules\000001.dbtmp
- %TEMP%\monitor2\default\extension rules\manifest-000001
- %TEMP%\monitor0\default\extension rules\log
- %TEMP%\monitor0\default\extension rules\000001.dbtmp
- %TEMP%\monitor0\default\extension rules\manifest-000001
- nul
- %TEMP%\monitor1\default\extension rules\000001.dbtmp
- %TEMP%\monitor1\default\history
- %TEMP%\monitor3\default\history-journal
- %TEMP%\monitor2\default\history
- %TEMP%\monitor3\default\extension rules\log
- %TEMP%\monitor3\default\extension rules\000001.dbtmp
- %TEMP%\monitor3\default\extension rules\manifest-000001
- %TEMP%\monitor1\default\web data
- %TEMP%\etilqs_qw6xeux7au1dpgf
- %TEMP%\monitor1\default\web data-journal
- %TEMP%\monitor1\default\favicons
- %TEMP%\etilqs_zf8xuc7xftjlul5
- %TEMP%\etilqs_3qdmjomtqmtgw85
- %TEMP%\monitor1\default\favicons-journal
- %TEMP%\etilqs_chq9gtepswf7ai5
- %TEMP%\monitor1\default\history-journal
- %TEMP%\monitor2\default\favicons
- %TEMP%\monitor2\default\web data
- %TEMP%\etilqs_lsiqlsgdnsnoe1s
- %TEMP%\monitor2\default\favicons-journal
- %TEMP%\etilqs_ieo8mlarvat6iud
- %TEMP%\monitor2\default\web data-journal
- %TEMP%\monitor2\default\history-journal
- %TEMP%\monitor4\default\528.tmp
Удаляет следующие файлы
- %TEMP%\monitor0\default\86f0.tmp
- %TEMP%\monitor2\default\8819.tmp
- %TEMP%\monitor1\default\8876.tmp
- %TEMP%\monitor3\default\88a5.tmp
- %TEMP%\monitor4\default\528.tmp
Перемещает следующие файлы
- %TEMP%\monitor0\default\extension rules\000001.dbtmp в %TEMP%\monitor0\default\extension rules\current
- %TEMP%\monitor2\default\extension rules\000001.dbtmp в %TEMP%\monitor2\default\extension rules\current
- %TEMP%\monitor1\default\extension rules\000001.dbtmp в %TEMP%\monitor1\default\extension rules\current
- %TEMP%\monitor3\default\extension rules\000001.dbtmp в %TEMP%\monitor3\default\extension rules\current
- %TEMP%\monitor4\default\extension rules\000001.dbtmp в %TEMP%\monitor4\default\extension rules\current
- %TEMP%\monitor5\default\extension rules\000001.dbtmp в %TEMP%\monitor5\default\extension rules\current
Сетевая активность
UDP
- DNS ASK google.com
Другое
Ищет следующие окна
- ClassName: 'Chrome_MessageWindow' WindowName: '%TEMP%\monitor0'
- ClassName: 'Chrome_MessageWindow' WindowName: '%TEMP%\monitor2'
- ClassName: 'Chrome_MessageWindow' WindowName: '%TEMP%\monitor1'
- ClassName: 'Chrome_MessageWindow' WindowName: '%TEMP%\monitor3'
- ClassName: 'Chrome_MessageWindow' WindowName: '%TEMP%\monitor4'
- ClassName: 'Chrome_MessageWindow' WindowName: '%TEMP%\monitor5'
Создает и запускает на исполнение
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\A450.tmp\app multi-pantallas.bat" <Полный путь к файлу>"' (со скрытым окном)
Запускает на исполнение
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\A450.tmp\app multi-pantallas.bat" <Полный путь к файлу>"
- '%ProgramFiles(x86)%\google\chrome\application\chrome.exe' --type=gpu-process --channel="1936.0.111785022\882863814" --user-data-dir="%TEMP%\monitor5" --supports-dual-gpus=false --gpu-driver-bug-workarounds=1,19,42 --gpu-vendor-id=0x0000 --gpu-device-i...
- '%ProgramFiles(x86)%\google\chrome\application\chrome.exe' --new-window "universaltvbox.net" --window-position=+,0 --start-fullscreen --no-first-run --disable-translate --user-data-dir=%TEMP%\monitor6 --app=universaltvbox.net
- '%ProgramFiles(x86)%\google\chrome\application\chrome.exe' --type=gpu-process --channel="2988.0.1645903638\1950141276" --user-data-dir="%TEMP%\monitor4" --supports-dual-gpus=false --gpu-driver-bug-workarounds=1,19,42 --gpu-vendor-id=0x0000 --gpu-device...
- '%ProgramFiles(x86)%\google\chrome\application\chrome.exe' --new-window "universaltvbox.net" --window-position=+,0 --start-fullscreen --no-first-run --disable-translate --user-data-dir=%TEMP%\monitor5 --app=universaltvbox.net
- '%ProgramFiles(x86)%\google\chrome\application\chrome.exe' --type=gpu-process --channel="2656.0.1858879193\550348300" --user-data-dir="%TEMP%\monitor3" --supports-dual-gpus=false --gpu-driver-bug-workarounds=1,19,42 --gpu-vendor-id=0x0000 --gpu-device-...
- '%ProgramFiles(x86)%\google\chrome\application\chrome.exe' --new-window "universaltvbox.net" --window-position=+,0 --start-fullscreen --no-first-run --disable-translate --user-data-dir=%TEMP%\monitor4 --app=universaltvbox.net
- '%ProgramFiles(x86)%\google\chrome\application\chrome.exe' --type=gpu-process --channel="3008.0.1425295340\2109248251" --user-data-dir="%TEMP%\monitor1" --supports-dual-gpus=false --gpu-driver-bug-workarounds=1,19,42 --gpu-vendor-id=0x0000 --gpu-device...
- '%ProgramFiles(x86)%\google\chrome\application\chrome.exe' --type=gpu-process --channel="2552.0.1635560500\819582871" --user-data-dir="%TEMP%\monitor2" --supports-dual-gpus=false --gpu-driver-bug-workarounds=1,19,42 --gpu-vendor-id=0x0000 --gpu-device-...
- '%ProgramFiles(x86)%\google\chrome\application\chrome.exe' --type=gpu-process --channel="2384.0.177473771\323389155" --user-data-dir="%TEMP%\monitor0" --supports-dual-gpus=false --gpu-driver-bug-workarounds=1,19,42 --gpu-vendor-id=0x0000 --gpu-device-i...
- '%ProgramFiles(x86)%\google\chrome\application\chrome.exe' --new-window "universaltvbox.net" --window-position=+,0 --start-fullscreen --no-first-run --disable-translate --user-data-dir=%TEMP%\monitor3 --app=universaltvbox.net
- '%ProgramFiles(x86)%\google\chrome\application\chrome.exe' --type=renderer --enable-deferred-image-decoding --lang=en-US --user-data-dir="%TEMP%\monitor0" --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --...
- '%ProgramFiles(x86)%\google\chrome\application\chrome.exe' --new-window "universaltvbox.net" --window-position=+,0 --start-fullscreen --no-first-run --disable-translate --user-data-dir=%TEMP%\monitor2 --app=universaltvbox.net
- '%ProgramFiles(x86)%\google\chrome\application\chrome.exe' --new-window "universaltvbox.net" --window-position=+,0 --start-fullscreen --no-first-run --disable-translate --user-data-dir=%TEMP%\monitor0 --app=universaltvbox.net
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-Type -AssemblyName System.Windows.Forms;" "$FakeX = [System.Windows.Forms.Screen]::allscreens.bounds.X[$env:array];" "echo $FakeX;" "if ($FakeX) {$RealX = ($($FakeX) / 100) * $...
- '<SYSTEM32>\cmd.exe' /c powershell.exe -Command "Add-Type -AssemblyName System.Windows.Forms;" "$FakeX = [System.Windows.Forms.Screen]::allscreens.bounds.X[$env:array];" "echo $FakeX;" "if ($FakeX) {$RealX = ($(...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "$DPISetting = (Get-ItemProperty 'HKCU:\Control Panel\Desktop\WindowMetrics' -Name AppliedDPI).AppliedDPI;" "echo $DPISetting;" "switch ($DPISetting) {96 {$ActualDPI = 100} 120 {$Act...
- '<SYSTEM32>\cmd.exe' /c powershell.exe -Command "$DPISetting = (Get-ItemProperty 'HKCU:\Control Panel\Desktop\WindowMetrics' -Name AppliedDPI).AppliedDPI;" "echo $DPISetting;" "switch ($DPISetting) {96 {$ActualDP...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "(Get-ChildItem -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths' -Recurse | where {$_.name -match 'Chrome'}).count"
- '<SYSTEM32>\cmd.exe' /c powershell.exe -Command "(Get-ChildItem -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths' -Recurse | where {$_.name -match 'Chrome'}).count"
- '<SYSTEM32>\cscript.exe' //nologo "%TEMP%\A450.tmp\app multi-pantallas.bat?.wsf" //job:crea_pagina Messaggio.html
- '<SYSTEM32>\cscript.exe' //nologo "<Полный путь к файлу>?.wsf" //job:startup
- '<SYSTEM32>\reg.exe' query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ /s /f \chrome.exe
- '%ProgramFiles(x86)%\google\chrome\application\chrome.exe' --new-window "universaltvbox.net" --window-position=+,0 --start-fullscreen --no-first-run --disable-translate --user-data-dir=%TEMP%\monitor1 --app=universaltvbox.net
- '%ProgramFiles(x86)%\google\chrome\application\chrome.exe' --type=renderer --enable-deferred-image-decoding --lang=en-US --user-data-dir="%TEMP%\monitor4" --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --...
