Техническая информация
Для обеспечения автозапуска и распространения
Создает или изменяет следующие файлы
- <SYSTEM32>\tasks\mdm
- <SYSTEM32>\tasks\wmiprvse
- <SYSTEM32>\tasks\svchost
- <SYSTEM32>\tasks\explorer
- <SYSTEM32>\tasks\lsass
Вредоносные функции
Читает файлы, отвечающие за хранение паролей сторонними программами
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %HOMEPATH%\desktop\508softwareandos.doc
- %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
- %HOMEPATH%\desktop\issi2013_template_for_posters.docx
Изменения в файловой системе
Создает следующие файлы
- C:\perflogs\admin\mdm.exe
- %WINDIR%\debug\wia\mitzssiuip
- %WINDIR%\debug\wia\pmntgummku
- %WINDIR%\debug\wia\vbwa1ihtvs
- %WINDIR%\debug\wia\np9sescojd
- %WINDIR%\debug\wia\ytiwakyrtw
- %WINDIR%\debug\wia\ig51nnyyga
- %WINDIR%\debug\wia\a4adbi5oy1
- %WINDIR%\debug\wia\rpqw3eu6fb
- %WINDIR%\debug\wia\iogcohmfum
- %WINDIR%\debug\wia\i4ea5v1vi7
- %WINDIR%\debug\wia\r51u7ko3jz
- %WINDIR%\debug\wia\8z7bx9cdzv
- %WINDIR%\debug\wia\erozzgiqvb
- %WINDIR%\debug\wia\6j6im1bus9
- %WINDIR%\debug\wia\z7fxrj0d1p
- %PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
- %WINDIR%\debug\wia\lokg2uizul
- %WINDIR%\debug\wia\sltjkczbpx
- %WINDIR%\debug\wia\g218qprxvb
- %WINDIR%\debug\wia\wcwxsh7s1k
- %WINDIR%\debug\wia\i8djjfvlqz
- %WINDIR%\debug\wia\w530jfh97n
- %WINDIR%\debug\wia\sby4qnftev
- %WINDIR%\debug\wia\lln5gioiua
- %WINDIR%\debug\wia\dfkyeq42em
- %LOCALAPPDATA%\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
- %PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
- %PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
- %WINDIR%\debug\wia\jwminllvud
- %WINDIR%\debug\wia\h9gn8akgoa
- %WINDIR%\debug\wia\1jhlzttxnu
- %WINDIR%\debug\wia\mmgcw7cirj
- %WINDIR%\debug\wia\mupzdyxrwz
- %WINDIR%\debug\wia\nsyhbnu4ey
- %WINDIR%\debug\wia\ulbvraox99
- %WINDIR%\debug\wia\lsass.exe
- %ProgramFiles%\fshelp\f4d236fdec2fd03914189c3b26e5cb0dfea9d761
- %ProgramFiles%\fshelp\svchost.exe
- <Текущая директория>\7a0fd90576e08807bde2cc57bcf9854bbce05fe3
- <Текущая директория>\explorer.exe
- C:\totalcmd\language\24dbde2999530ef5fd907494bc374d663924116c
- C:\totalcmd\language\wmiprvse.exe
- %ProgramFiles%\pmagic\svchost.exe
- C:\users\default\desktop\f4d236fdec2fd03914189c3b26e5cb0dfea9d761
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\f4d236fdec2fd03914189c3b26e5cb0dfea9d761
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\svchost.exe
- C:\far2\addons\macros\24dbde2999530ef5fd907494bc374d663924116c
- C:\far2\addons\macros\wmiprvse.exe
- %TEMP%\54efeb7418e033f74ea87305efdf25fd.tmp
- C:\perflogs\admin\559fba5f8e44108851927af432f0edac6117c574
- C:\users\default\desktop\svchost.exe
- %WINDIR%\debug\wia\ziryd8bus7
- %WINDIR%\debug\wia\racdbnm6bq
- %WINDIR%\debug\wia\6203df4a6bafc7c328ee7f6f8ca0a8a838a8a1b9
- %WINDIR%\debug\wia\etoul2cmtk
- %WINDIR%\debug\wia\r6560jgxzq
- %WINDIR%\debug\wia\u3hk2fr48m
- %WINDIR%\debug\wia\itrod0jqcv
- %WINDIR%\debug\wia\huhtwwh0gt
- %WINDIR%\debug\wia\lt0xarreyw
- %WINDIR%\debug\wia\em2tclxvx4
- %WINDIR%\debug\wia\3nqlcbkkdt
- %WINDIR%\debug\wia\eq2fweebee
- %WINDIR%\debug\wia\uop9sjd9l6
- %WINDIR%\debug\wia\hkjkrlvlxm
- %WINDIR%\debug\wia\qzkmcftcue
- %WINDIR%\debug\wia\jku9iozenw
- %WINDIR%\debug\wia\ugbc4oo7jj
- %ProgramFiles%\pmagic\f4d236fdec2fd03914189c3b26e5cb0dfea9d761
- %WINDIR%\debug\wia\rempjujfib
Удаляет следующие файлы
- %WINDIR%\debug\wia\ugbc4oo7jj
- %WINDIR%\debug\wia\ytiwakyrtw
- %WINDIR%\debug\wia\np9sescojd
- %WINDIR%\debug\wia\vbwa1ihtvs
- %WINDIR%\debug\wia\pmntgummku
- %WINDIR%\debug\wia\mitzssiuip
- %WINDIR%\debug\wia\a4adbi5oy1
- %WINDIR%\debug\wia\mupzdyxrwz
- %WINDIR%\debug\wia\nsyhbnu4ey
- %WINDIR%\debug\wia\rpqw3eu6fb
- %WINDIR%\debug\wia\ig51nnyyga
- %WINDIR%\debug\wia\sltjkczbpx
- %WINDIR%\debug\wia\h9gn8akgoa
- %WINDIR%\debug\wia\jwminllvud
- %WINDIR%\debug\wia\lln5gioiua
- %WINDIR%\debug\wia\sby4qnftev
- %WINDIR%\debug\wia\w530jfh97n
- %WINDIR%\debug\wia\i8djjfvlqz
- %WINDIR%\debug\wia\wcwxsh7s1k
- %WINDIR%\debug\wia\g218qprxvb
- %WINDIR%\debug\wia\mmgcw7cirj
- %WINDIR%\debug\wia\1jhlzttxnu
- %WINDIR%\debug\wia\z7fxrj0d1p
- %WINDIR%\debug\wia\iogcohmfum
- %WINDIR%\debug\wia\i4ea5v1vi7
- %WINDIR%\debug\wia\qzkmcftcue
- %WINDIR%\debug\wia\hkjkrlvlxm
- %WINDIR%\debug\wia\uop9sjd9l6
- %WINDIR%\debug\wia\eq2fweebee
- %WINDIR%\debug\wia\ziryd8bus7
- %WINDIR%\debug\wia\3nqlcbkkdt
- %WINDIR%\debug\wia\lt0xarreyw
- %WINDIR%\debug\wia\huhtwwh0gt
- %WINDIR%\debug\wia\itrod0jqcv
- %WINDIR%\debug\wia\jku9iozenw
- %WINDIR%\debug\wia\u3hk2fr48m
- %WINDIR%\debug\wia\etoul2cmtk
- %WINDIR%\debug\wia\racdbnm6bq
- %WINDIR%\debug\wia\em2tclxvx4
- %WINDIR%\debug\wia\ulbvraox99
- %WINDIR%\debug\wia\dfkyeq42em
- %WINDIR%\debug\wia\6j6im1bus9
- %WINDIR%\debug\wia\erozzgiqvb
- %WINDIR%\debug\wia\8z7bx9cdzv
- %WINDIR%\debug\wia\r51u7ko3jz
- %WINDIR%\debug\wia\r6560jgxzq
- %WINDIR%\debug\wia\lokg2uizul
- %WINDIR%\debug\wia\rempjujfib
Сетевая активность
TCP
Запросы HTTP GET
- http://aj#i.tk/ye8gyxdik1voqyjoypaprhtnfs0gt1l/ekuilnymj2v4jnwplc7s9ad5ioztexzxjbox3dsno2ov94idxoh6vys35hp7x19rbqwu7l60z59tk/10e50fdd1d4bed7a81c569026061a5218e9a5165.php?e1#####################...
- http://aj#i.tk/ye8gyxdik1voqyjoypaprhtnfs0gt1l/ekuilnymj2v4jnwplc7s9ad5ioztexzxjbox3dsno2ov94idxoh6vys35hp7x19rbqwu7l60z59tk/10e50fdd1d4bed7a81c569026061a5218e9a5165.php?be#####################...
- http://aj#i.tk/ye8gyxdik1voqyjoypaprhtnfs0gt1l/ekuilnymj2v4jnwplc7s9ad5ioztexzxjbox3dsno2ov94idxoh6vys35hp7x19rbqwu7l60z59tk/ft94a4rkrd0926y1ubo1zz9o8f/4cfc39b689db3c4be99f0386d56e2e3e.php?8b##...
UDP
- DNS ASK aj#i.tk
- DNS ASK ip##fo.io
Другое
Создает и запускает на исполнение
- '%WINDIR%\debug\wia\lsass.exe'
Запускает на исполнение
- '<SYSTEM32>\schtasks.exe' /create /tn "mdm" /sc ONLOGON /tr "'C:\PerfLogs\Admin\mdm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Far2\Addons\Macros\WmiPrvSE.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "svchost" /sc ONLOGON /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\svchost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "svchost" /sc ONLOGON /tr "'C:\Users\Default\Desktop\svchost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\totalcmd\LANGUAGE\WmiPrvSE.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "explorer" /sc ONLOGON /tr "'<Текущая директория>\explorer.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "svchost" /sc ONLOGON /tr "'%ProgramFiles%\fshelp\svchost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "svchost" /sc ONLOGON /tr "'%ProgramFiles%\PMagic\svchost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsass" /sc ONLOGON /tr "'%WINDIR%\debug\WIA\lsass.exe'" /rl HIGHEST /f
