Trojan.DownLoader33.63221

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'windows0x64' = '%APPDATA%\Microsoft\windows0x64\svchost.vbs'

Изменения в файловой системе

Создает следующие файлы

%TEMP%\rarsfx0\windows0x64.exe
%TEMP%\_mei21522\api-ms-win-crt-convert-l1-1-0.dll
%TEMP%\_mei21522\api-ms-win-crt-conio-l1-1-0.dll
%TEMP%\_mei21522\api-ms-win-core-util-l1-1-0.dll
%TEMP%\_mei21522\api-ms-win-core-timezone-l1-1-0.dll
%TEMP%\_mei21522\api-ms-win-core-sysinfo-l1-1-0.dll
%TEMP%\_mei21522\api-ms-win-core-synch-l1-2-0.dll
%TEMP%\_mei21522\api-ms-win-core-synch-l1-1-0.dll
%TEMP%\_mei21522\api-ms-win-core-string-l1-1-0.dll
%TEMP%\_mei21522\api-ms-win-core-rtlsupport-l1-1-0.dll
%TEMP%\_mei21522\api-ms-win-core-profile-l1-1-0.dll
%TEMP%\_mei21522\api-ms-win-core-processthreads-l1-1-1.dll
%TEMP%\_mei21522\api-ms-win-core-processthreads-l1-1-0.dll
%TEMP%\_mei21522\api-ms-win-core-processenvironment-l1-1-0.dll
%TEMP%\_mei21522\api-ms-win-core-namedpipe-l1-1-0.dll
%TEMP%\_mei21522\api-ms-win-core-memory-l1-1-0.dll
%TEMP%\_mei21522\api-ms-win-crt-environment-l1-1-0.dll
%TEMP%\_mei21522\api-ms-win-crt-heap-l1-1-0.dll
%TEMP%\_mei21522\base_library.zip
%TEMP%\_mei21522\api-ms-win-crt-locale-l1-1-0.dll
%TEMP%\_mei21522\unicodedata.pyd
%TEMP%\_mei21522\ucrtbase.dll
%TEMP%\_mei21522\select.pyd
%TEMP%\_mei21522\python37.dll
%TEMP%\_mei21522\pyexpat.pyd
%TEMP%\_mei21522\libssl-1_1-x64.dll
%TEMP%\_mei21522\libcrypto-1_1-x64.dll
%TEMP%\_mei21522\hellminer.exe.manifest
%TEMP%\_mei21522\api-ms-win-crt-utility-l1-1-0.dll
%TEMP%\_mei21522\api-ms-win-crt-time-l1-1-0.dll
%TEMP%\_mei21522\api-ms-win-crt-string-l1-1-0.dll
%TEMP%\_mei21522\api-ms-win-crt-stdio-l1-1-0.dll
%TEMP%\_mei21522\api-ms-win-crt-runtime-l1-1-0.dll
%TEMP%\_mei21522\api-ms-win-crt-process-l1-1-0.dll
%TEMP%\_mei21522\api-ms-win-crt-math-l1-1-0.dll
%TEMP%\_mei21522\api-ms-win-core-localization-l1-2-0.dll
%TEMP%\_mei21522\api-ms-win-crt-filesystem-l1-1-0.dll
%TEMP%\_mei21522\api-ms-win-core-libraryloader-l1-1-0.dll
%TEMP%\_mei21522\_contextvars.pyd
%TEMP%\_mei21522\_asyncio.pyd
%TEMP%\_mei21522\vcruntime140.dll
%APPDATA%\microsoft\windows0x64\windows0x64.exe
%APPDATA%\microsoft\windows0x64\windows0x64.bat
%APPDATA%\microsoft\windows0x64\verus-solver.exe
%APPDATA%\microsoft\windows0x64\svchost.vbs
%APPDATA%\microsoft\windows0x64\start.vbs
%APPDATA%\microsoft\windows0x64\setup.bat
%APPDATA%\microsoft\windows0x64\install.vbs
%TEMP%\rarsfx0\windows0x64.bat
%TEMP%\rarsfx0\verus-solver.exe
%TEMP%\rarsfx0\svchost.vbs
%TEMP%\rarsfx0\start.vbs
%TEMP%\rarsfx0\setup.bat
%TEMP%\rarsfx0\install.vbs
%TEMP%\_mei21522\_bz2.pyd
%TEMP%\_mei21522\_ctypes.pyd
%TEMP%\_mei21522\api-ms-win-core-heap-l1-1-0.dll
%TEMP%\_mei21522\_decimal.pyd
%TEMP%\_mei21522\api-ms-win-core-handle-l1-1-0.dll
%TEMP%\_mei21522\api-ms-win-core-file-l2-1-0.dll
%TEMP%\_mei21522\api-ms-win-core-file-l1-2-0.dll
%TEMP%\_mei21522\api-ms-win-core-file-l1-1-0.dll
%TEMP%\_mei21522\api-ms-win-core-errorhandling-l1-1-0.dll
%TEMP%\_mei21522\api-ms-win-core-debug-l1-1-0.dll
%TEMP%\_mei21522\api-ms-win-core-datetime-l1-1-0.dll
%TEMP%\_mei21522\api-ms-win-core-console-l1-1-0.dll
%TEMP%\_mei21522\_ssl.pyd
%TEMP%\_mei21522\_socket.pyd
%TEMP%\_mei21522\_queue.pyd
%TEMP%\_mei21522\_overlapped.pyd
%TEMP%\_mei21522\_multiprocessing.pyd
%TEMP%\_mei21522\_lzma.pyd
%TEMP%\_mei21522\_hashlib.pyd
%TEMP%\_mei21522\api-ms-win-core-interlocked-l1-1-0.dll
%TEMP%\zrrlbc4w

Удаляет следующие файлы

%TEMP%\rarsfx0\install.vbs
%TEMP%\rarsfx0\start.vbs
%TEMP%\rarsfx0\svchost.vbs
%TEMP%\rarsfx0\verus-solver.exe
%TEMP%\rarsfx0\windows0x64.bat
%TEMP%\rarsfx0\windows0x64.exe
%TEMP%\zrrlbc4w

Сетевая активность

TCP

'14#.#6.27.47':3956

Другое

Ищет следующие окна

ClassName: 'EDIT' WindowName: ''

Создает и запускает на исполнение

'%WINDIR%\syswow64\wscript.exe' "%TEMP%\RarSFX0\install.vbs"
'%WINDIR%\syswow64\wscript.exe' "%APPDATA%\Microsoft\windows0x64\svchost.vbs"
'%WINDIR%\syswow64\wscript.exe' "%APPDATA%\Microsoft\windows0x64\start.vbs"
'%APPDATA%\microsoft\windows0x64\windows0x64.exe' -c stratum+tcp://na.luckpool.net:3956#xnsub -u RRdTxn5aKZUt1pEfyHYver7C3WWvhNHpHa.final -p x --cpu 1
'%APPDATA%\microsoft\windows0x64\verus-solver.exe' -verus2 --cpu 0
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\RarSFX0\setup.bat" "' (со скрытым окном)
'%WINDIR%\syswow64\wscript.exe' "%APPDATA%\Microsoft\windows0x64\start.vbs"' (со скрытым окном)
'%WINDIR%\syswow64\cmd.exe' /c ""%APPDATA%\Microsoft\windows0x64\windows0x64.bat" "' (со скрытым окном)
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\RarSFX0\windows0x64.bat" "' (со скрытым окном)

Запускает на исполнение

'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\RarSFX0\setup.bat" "
'%WINDIR%\syswow64\reg.exe' ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "windows0x64" /t REG_SZ /d ""%APPDATA%"\Microsoft\windows0x64\svchost.vbs" /f
'%WINDIR%\syswow64\cmd.exe' /c ""%APPDATA%\Microsoft\windows0x64\windows0x64.bat" "
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\RarSFX0\windows0x64.bat" "