Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- %TEMP%\bisc\curl.exe -s -o "%TEMP%\bisc\mbam-v.txt" "http://www.mo###uri.com/bisc_files/files/mbam-v.txt"
- %TEMP%\bisc\curl.exe --progress-bar -o "%TEMP%\bisc\Piriform.uha" "http://www.mo###uri.com/bisc_files/files/Piriform.uha"
- %TEMP%\bisc\curl.exe --progress-bar -o "%TEMP%\bisc\Malwarebytes.uha" "http://www.mo###uri.com/bisc_files/files/Malwarebytes.uha"
- %TEMP%\bisc\curl.exe --progress-bar -o "%TEMP%\bisc\GlaryRegistryRepair.uha" "http://www.mo###uri.com/bisc_files/files/GlaryRegistryRepair.uha"
- %TEMP%\bisc\curl.exe -s -o "%TEMP%\bisc\glary-v.txt" "http://www.mo###uri.com/bisc_files/files/glary-v.txt"
- %TEMP%\bisc\curl.exe -s -o "%TEMP%\bisc\ccleaner-v.txt" "http://www.mo###uri.com/bisc_files/files/ccleaner-v.txt"
- %TEMP%\1.tmp\BiscontiComputers-start.exe
- %TEMP%\1.tmp\tasklist.exe /FI "IMAGENAME eq BiscontiComputers-start.exe" /FO CSV
- %TEMP%\afolder\uharc.exe x -t"%TEMP%\bisc" -y+ %TEMP%\afolder\curl.uha
- %TEMP%\bisc\curl.exe --progress-bar -o "%TEMP%\bisc\BiscontiComputers.exe" "http://www.mo###uri.com/bisc_files/BiscontiComputers_MZР.exe"
- %TEMP%\bisc\curl.exe --progress-bar -o "%TEMP%\bisc\aiov.txt " "http://www.mo###uri.com/bisc_files/aiov.txt "
Запускает на исполнение:
- <SYSTEM32>\mode.com con: lines=10
- <SYSTEM32>\fc.exe "<Текущая директория>\bisc_files\aiov.txt" "%TEMP%\bisc\aiov.txt"
- <SYSTEM32>\find.exe "Reply from "
- <SYSTEM32>\ping.exe -n 1 www.google.com
- <SYSTEM32>\fc.exe "bisc_files\glary-v.txt" "%TEMP%\bisc\glary-v.txt"
- <SYSTEM32>\attrib.exe +h dummy.file
- <SYSTEM32>\fc.exe "bisc_files\ccleaner-v.txt" "%TEMP%\bisc\ccleaner-v.txt"
- <SYSTEM32>\fc.exe "bisc_files\mbam-v.txt" "%TEMP%\bisc\mbam-v.txt"
- <SYSTEM32>\find.exe "BiscontiComputers-start.exe" %TEMP%\running2.log
- <SYSTEM32>\ping.exe 1.1.1.1 -n 1 -w 1000
- <SYSTEM32>\cmd.exe /c ""%TEMP%\1.tmp\BiscontiComputers.bat" <Текущая директория>\"
- <SYSTEM32>\attrib.exe +h "<Текущая директория>\\bisc_files"
- <SYSTEM32>\ping.exe 1.1.1.1 -n 1 -w 125
- <SYSTEM32>\ping.exe -n 1 www.mo###uri.com
- <SYSTEM32>\find.exe "BiscontiComputers-start.exe" %TEMP%\running.log
- <SYSTEM32>\attrib.exe +h %TEMP%\ztmp
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\bisc\libeay32.dll
- %TEMP%\bisc\dwn_util.bat
- %TEMP%\bisc\libssl32.dll
- %TEMP%\bisc\curl.exe
- %TEMP%\bisc\libcurl.dll
- %TEMP%\bisc\check_inet.bat
- %TEMP%\myfiles.txt
- %TEMP%\waiting.bat
- %TEMP%\bisc\uharc.exe
- %TEMP%\bisc\Wi-Fi-bisconticomputers.xml
- %TEMP%\bisc\tasklist.exe
- %TEMP%\bisc\bisc_setup-tmp.txt
- %TEMP%\bisc\Malwarebytes.uha
- %TEMP%\bisc\mbam-v.txt
- %TEMP%\bisc\glary-v.txt
- <Текущая директория>\BiscontiComputers.exe
- %TEMP%\bisc\GlaryRegistryRepair.uha
- %TEMP%\bisc\Piriform.uha
- %TEMP%\bisc\loaded.txt
- %TEMP%\bisc\aiov.txt
- %TEMP%\end_prog.txt
- %TEMP%\bisc\ccleaner-v.txt
- %TEMP%\bisc\BiscontiComputers.exe
- %TEMP%\afolder\check_inet.bat
- %TEMP%\afolder\AutoFix.exe
- %TEMP%\afolder\createsrp.vbs
- %TEMP%\afolder\no_dup.bat
- %TEMP%\afolder\curl.uha
- %TEMP%\running.log
- %TEMP%\1.tmp\BiscontiComputers-start.exe
- %TEMP%\1.tmp\BiscontiComputers.bat
- %TEMP%\1.tmp\tasklist.exe
- %TEMP%\tmp_dir.txt
- %TEMP%\aio_dir.bat
- %TEMP%\afolder\prog_list.exe
- %TEMP%\afolder\regjump.exe
- %TEMP%\afolder\waiting.bat
- %TEMP%\afolder\Wi-Fi-bisconticomputers.xml
- %TEMP%\ztmp\tmp8403.exe
- %TEMP%\ztmp\tmp268.bat
- %TEMP%\afolder\dwn_util.bat
- %TEMP%\afolder\say.exe
- %TEMP%\afolder\resetdma.vbs
- %TEMP%\afolder\sendmail.exe
- %TEMP%\afolder\uharc.exe
- %TEMP%\afolder\SetWallpaper.exe
Удаляет следующие файлы:
- %TEMP%\1.tmp\BiscontiComputers-start.exe
- %TEMP%\1.tmp\tasklist.exe
- %TEMP%\1.tmp\BiscontiComputers.bat
- %TEMP%\aio_dir.bat
- %TEMP%\tmp_dir.txt
- %TEMP%\bisc\bisc_setup-tmp.txt
Сетевая активность:
Подключается к:
- 'www.mo###uri.com':80
TCP:
Запросы HTTP GET:
- www.mo###uri.com/bisc_files/files/Malwarebytes.uha
- www.mo###uri.com/bisc_files/files/mbam-v.txt
- www.mo###uri.com/bisc_files/files/GlaryRegistryRepair.uha
- www.mo###uri.com/bisc_files/files/glary-v.txt
- www.mo###uri.com/bisc_files/BiscontiComputers_MZ?.e##
- www.mo###uri.com/bisc_files/aiov.txt
- www.mo###uri.com/bisc_files/files/Piriform.uha
- www.mo###uri.com/bisc_files/files/ccleaner-v.txt
UDP:
- DNS ASK www.google.com
- DNS ASK www.mo###uri.com
