Техническая информация
Для обеспечения автозапуска и распространения:
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\HookSSDT] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\OKddos DDOS soft Service] 'Start' = '00000002'
Заражает следующие исполняемые системные файлы:
- <SYSTEM32>\dllcache\cplexe.exe
- <SYSTEM32>\dllcache\fpadmcgi.exe
- <SYSTEM32>\dllcache\fpcount.exe
- <SYSTEM32>\dllcache\cintsetp.exe
- <SYSTEM32>\dllcache\admin.exe
- <SYSTEM32>\dllcache\author.exe
- <SYSTEM32>\dllcache\cfgwiz.exe
- <SYSTEM32>\dllcache\fpremadm.exe
- <SYSTEM32>\dllcache\imjpdsvr.exe
- <SYSTEM32>\dllcache\imjpinst.exe
- <SYSTEM32>\dllcache\imjpmig.exe
- <SYSTEM32>\dllcache\imjpdct.exe
- <SYSTEM32>\dllcache\imekrmig.exe
- <SYSTEM32>\dllcache\imepadsv.exe
- <SYSTEM32>\dllcache\imjpdadm.exe
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\regtlibv12.exe
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\Setup.exe
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ngen.exe
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\SetupUtility.exe
- %WINDIR%\Microsoft.NET\NETFXRepair.exe
- %WINDIR%\sfk.exe
- %WINDIR%\sleep.exe
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\Setup.exe
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\SetupUtility.exe
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\vbc.exe
- <SYSTEM32>\netsetup.exe
- <SYSTEM32>\ntkrnlpa.exe
- <SYSTEM32>\ntoskrnl.exe
- <SYSTEM32>\mstsc.exe
- <SYSTEM32>\dllcache\tscupgrd.exe
- <SYSTEM32>\icardagt.exe
- <SYSTEM32>\msiexec.exe
- <SYSTEM32>\PresentationHost.exe
- <SYSTEM32>\URTTEMP\regtlib.exe
- <SYSTEM32>\XPSViewer\XPSViewer.exe
- <Служебный элемент>
- <SYSTEM32>\tscupgrd.exe
- <SYSTEM32>\spiisupd.exe
- <SYSTEM32>\spool\prtprocs\w32x86\printfilterpipelinesvc.exe
- <SYSTEM32>\spupdsvc.exe
- <SYSTEM32>\dllcache\imscinst.exe
- <SYSTEM32>\dllcache\msiexec.exe
- <SYSTEM32>\dllcache\mstsc.exe
- <SYSTEM32>\dllcache\imkrinst.exe
- <SYSTEM32>\dllcache\imjprw.exe
- <SYSTEM32>\dllcache\imjpuex.exe
- <SYSTEM32>\dllcache\imjputy.exe
- <SYSTEM32>\dllcache\netsetup.exe
- <SYSTEM32>\dllcache\tcptest.exe
- <SYSTEM32>\dllcache\tintlphr.exe
- <SYSTEM32>\dllcache\tintsetp.exe
- <SYSTEM32>\dllcache\spiisupd.exe
- <SYSTEM32>\dllcache\pintlphr.exe
- <SYSTEM32>\dllcache\printfilterpipelinesvc.exe
- <SYSTEM32>\dllcache\shtml.exe
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\csc.exe
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe
- %WINDIR%\Microsoft.NET\Framework\v1.1.4322\RegAsm.exe
- %WINDIR%\Microsoft.NET\Framework\v1.1.4322\MigPol.exe
- %WINDIR%\Microsoft.NET\Framework\v1.1.4322\MigPolWin.exe
- %WINDIR%\Microsoft.NET\Framework\v1.1.4322\ngen.exe
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\csc.exe
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ilasm.exe
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\CasPol.exe
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\aspnet_regsql.exe
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\aspnet_wp.exe
- %WINDIR%\assembly\NativeImages_v4.0.30319_32\dfsvc\b9b6069e6da06eb57e89cc544397f735\dfsvc.ni.exe
- %WINDIR%\Microsoft.NET\Framework\NETFXSBS10.exe
- %WINDIR%\Microsoft.NET\Framework\v1.1.4322\aspnet_regiis.exe
- %WINDIR%\assembly\NativeImages_v4.0.30319_32\ComSvcConfig\51819c709096229ee187a7feee395d9f\ComSvcConfig.ni.exe
- %WINDIR%\$NtUninstallKB942288-v3$\spuninst\spuninst.exe
- %WINDIR%\$NtUninstallWIC$\spuninst\spuninst.exe
- %WINDIR%\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe
- %WINDIR%\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe
- %WINDIR%\Microsoft.NET\Framework\v1.1.4322\cvtres.exe
- %WINDIR%\Microsoft.NET\Framework\v1.1.4322\ilasm.exe
- %WINDIR%\Microsoft.NET\Framework\v1.1.4322\jsc.exe
- %WINDIR%\Microsoft.NET\Framework\v1.1.4322\csc.exe
- %WINDIR%\Microsoft.NET\Framework\v1.1.4322\aspnet_wp.exe
- %WINDIR%\Microsoft.NET\Framework\v1.1.4322\CasPol.exe
- %WINDIR%\Microsoft.NET\Framework\v1.1.4322\ConfigWizards.exe
- %WINDIR%\Microsoft.NET\Framework\v3.5\DataSvcUtil.exe
- %WINDIR%\Microsoft.NET\Framework\v3.5\EdmGen.exe
- %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\DeleteTemp.exe
- %WINDIR%\Microsoft.NET\Framework\v3.5\csc.exe
- %WINDIR%\Microsoft.NET\Framework\v3.5\AddInProcess.exe
- %WINDIR%\Microsoft.NET\Framework\v3.5\AddInProcess32.exe
- %WINDIR%\Microsoft.NET\Framework\v3.5\AddInUtil.exe
- %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
- %WINDIR%\Microsoft.NET\Framework\v3.5\MSBuild.exe
- %WINDIR%\Microsoft.NET\Framework\v3.5\vbc.exe
- %WINDIR%\Microsoft.NET\Framework\v3.5\WFServicesReg.exe
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ngen.exe
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\jsc.exe
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\regtlibv12.exe
- %WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
- %WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\WsatConfig.exe
- %WINDIR%\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
- %WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelReg.exe
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe
- %WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ComSvcConfig.exe
- %WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
Вредоносные функции:
Создает и запускает на исполнение:
- <SYSTEM32>\server.exe
- %TEMP%\server.exe
Ищет следующие окна с целью
обнаружения утилит для анализа:
- ClassName: '' WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'PROCMON_WINDOW_CLASS' WindowName: ''
- ClassName: '' WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'RegmonClass' WindowName: ''
- ClassName: '' WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'GBDYLLO' WindowName: ''
- ClassName: 'OLLYDBG' WindowName: ''
- ClassName: 'FilemonClass' WindowName: ''
- ClassName: 'pediy06' WindowName: ''
Перехватывает следующие функции в SSDT (System Service Descriptor Table):
- NtDeviceIoControlFile, драйвер-обработчик: ApiHooks.sys
Изменения в файловой системе:
Создает следующие файлы:
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\A0001842.exe
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\A0001841.exe
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\A0001844.exe
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\A0001843.exe
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\A0001838.exe
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\A0001837.exe
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\A0001840.exe
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\A0001839.exe
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\A0001850.exe
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\A0001849.exe
- <Служебный элемент>
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\A0001851.exe
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\A0001846.exe
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\A0001845.exe
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\A0001848.exe
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\A0001847.exe
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\A0001836.exe
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001101.exe
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001100.exe
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001210.exe
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001131.exe
- <DRIVERS>\ApiHooks.sys
- %TEMP%\server.exe
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001099.exe
- <SYSTEM32>\server.exe
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\A0001833.exe
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\A0001832.exe
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\A0001835.EXE
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\A0001834.EXE
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001237.exe
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001213.exe
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001244.exe
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\A0001243.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- <SYSTEM32>\server.exe
Удаляет следующие файлы:
- %TEMP%\server.exe
Сетевая активность:
Подключается к:
- 'kj#####8.wowip.co.kr':8000
UDP:
- DNS ASK kj#####8.wowip.co.kr
Другое:
Ищет следующие окна:
- ClassName: '18467-41' WindowName: ''
