Trojan.Siggen10.37165

Техническая информация

Для обеспечения автозапуска и распространения

Создает или изменяет следующие файлы

%APPDATA%\microsoft\windows\start menu\programs\videolan\ddvlc.exe

Вредоносные функции

Запускает на исполнение

'%WINDIR%\syswow64\taskkill.exe' /pid 2020

Внедряет код в

следующие пользовательские процессы:

ulfoggzwpk.exe

Ищет ветки реестра, отвечающие за хранение паролей сторонними программами

[<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook]
[<HKCU>\Software\Martin Prikryl\WinSCP 2\Sessions\]
[<HKCU>\Software\Microsoft\Internet Account Manager\Accounts]
[<HKCU>\Identities\{91255D00-95D9-49F5-8E84-7C027F5283B7}\Software\Microsoft\Internet Account Manager\Accounts]
[<HKLM>\Software\Wow6432Node\Microsoft\Internet Account Manager]
[<HKLM>\Software\Microsoft\Internet Account Manager]
[<HKCU>\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts]
[<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings]

Читает файлы, отвечающие за хранение паролей сторонними программами

%LOCALAPPDATA%\google\chrome\user data\default\cookies
%LOCALAPPDATA%\google\chrome\user data\default\login data
%LOCALAPPDATA%\google\chrome\user data\default\web data
%APPDATA%\opera software\opera stable\login data

Изменения в файловой системе

Создает следующие файлы

%TEMP%\limos.exe
%LOCALAPPDATA%low\libesllibes\mapiproxy_inuse.dll
%LOCALAPPDATA%low\libesllibes\mozglue.dll
%LOCALAPPDATA%low\libesllibes\mozmapi32.dll
%LOCALAPPDATA%low\libesllibes\mozmapi32_inuse.dll
%LOCALAPPDATA%low\libesllibes\msvcp140.dll
%LOCALAPPDATA%low\libesllibes\nss3.dll
%LOCALAPPDATA%low\libesllibes\nssckbi.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-timezone-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-namedpipe-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-processthreads-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-processthreads-l1-1-1.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-profile-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-rtlsupport-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-string-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-synch-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-synch-l1-2-0.dll
%LOCALAPPDATA%low\libesllibes\libegl.dll
%LOCALAPPDATA%low\libesllibes\mapiproxy.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-processenvironment-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-sysinfo-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\ldap60.dll
%LOCALAPPDATA%low\flesffxeses\desktop.ini
%LOCALAPPDATA%low\libesllibes\lizilipes.zip
%WINDIR%\temp\y1lkzuzn.exe
%WINDIR%\temp\1nstjtpc.inf
%LOCALAPPDATA%low\libesllibes\nssdbm3.dll
%LOCALAPPDATA%low\libesllibes\prldap60.dll
%LOCALAPPDATA%low\libesllibes\qipcap.dll
%LOCALAPPDATA%low\libesllibes\softokn3.dll
%LOCALAPPDATA%low\libesllibes\ucrtbase.dll
%LOCALAPPDATA%low\libesllibes\vcruntime140.dll
%LOCALAPPDATA%low\libesllibes\accessiblehandler.dll
%LOCALAPPDATA%low\libesllibes\accessiblemarshal.dll
%LOCALAPPDATA%low\libesllibes\breakpadinjector.dll
%LOCALAPPDATA%low\libesllibes\freebl3.dll
%LOCALAPPDATA%low\libesllibes\ia2marshal.dll
%LOCALAPPDATA%low\libesllibes\ldif60.dll
%TEMP%\ds2.exe
%LOCALAPPDATA%low\libesllibes\lgpllibs.dll
%TEMP%\a8c2238f\api-ms-win-crt-math-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-util-l1-1-0.dll
%LOCALAPPDATA%low\fraqbc8ws
%LOCALAPPDATA%low\jwtoiddcb
%LOCALAPPDATA%low\jwtoiddcb-shm
%LOCALAPPDATA%low\firefox_urls.txt
%LOCALAPPDATA%low\jat643jhj
%LOCALAPPDATA%low\jat643jhj-shm
%LOCALAPPDATA%low\opfbboj1n
%LOCALAPPDATA%low\opfbboj1n-shm
%LOCALAPPDATA%low\libesllibes\api-ms-win-crt-conio-l1-1-0.dll
%LOCALAPPDATA%low\machineinfo.txt
%LOCALAPPDATA%low\gtfxhgoswun.zip
%TEMP%\fszjbgduip.exe
%TEMP%\zjhlxjo7ns.exe
%TEMP%\j1knn0oc4o.exe
%TEMP%\ulfoggzwpk.exe
nul
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-memory-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-localization-l1-2-0.dll
%LOCALAPPDATA%low\fraqbc8ws-shm
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-libraryloader-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-interlocked-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-crt-convert-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-crt-filesystem-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-crt-heap-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-crt-locale-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-crt-math-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-crt-multibyte-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-crt-private-l1-1-0.dll
%TEMP%\rc.exe
%LOCALAPPDATA%low\libesllibes\api-ms-win-crt-process-l1-1-0.dll
%TEMP%\ds1.exe
%LOCALAPPDATA%low\libesllibes\api-ms-win-crt-stdio-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-crt-time-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-crt-utility-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-file-l1-2-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-file-l2-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-handle-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-heap-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-crt-runtime-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-crt-environment-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-crt-string-l1-1-0.dll
%TEMP%\ac.exe
%TEMP%\11140036384969481454523.tmp-shm
%TEMP%\11140036384969481454523.tmp
%TEMP%\a8c2238f\api-ms-win-core-errorhandling-l1-1-0.dll
%TEMP%\a8c2238f\api-ms-win-core-file-l1-1-0.dll
%TEMP%\a8c2238f\api-ms-win-core-file-l1-2-0.dll
%TEMP%\a8c2238f\api-ms-win-core-file-l2-1-0.dll
%TEMP%\a8c2238f\api-ms-win-core-handle-l1-1-0.dll
%TEMP%\a8c2238f\api-ms-win-core-heap-l1-1-0.dll
%TEMP%\a8c2238f\api-ms-win-core-interlocked-l1-1-0.dll
%TEMP%\a8c2238f\api-ms-win-core-libraryloader-l1-1-0.dll
%TEMP%\a8c2238f\api-ms-win-core-localization-l1-2-0.dll
%TEMP%\a8c2238f\api-ms-win-core-memory-l1-1-0.dll
%TEMP%\a8c2238f\api-ms-win-core-namedpipe-l1-1-0.dll
%TEMP%\a8c2238f\api-ms-win-core-processenvironment-l1-1-0.dll
%TEMP%\a8c2238f\api-ms-win-core-processthreads-l1-1-0.dll
%TEMP%\a8c2238f\api-ms-win-core-processthreads-l1-1-1.dll
%TEMP%\a8c2238f\api-ms-win-core-profile-l1-1-0.dll
%TEMP%\a8c2238f\api-ms-win-core-console-l1-1-0.dll
%ALLUSERSPROFILE%\668344332285471\screenshot.jpg
%TEMP%\a8c2238f\api-ms-win-core-debug-l1-1-0.dll
%ALLUSERSPROFILE%\668344332285471\_6683443322.zip
%ALLUSERSPROFILE%\668344332285471\system.txt
%ALLUSERSPROFILE%\vcruntime140.dll
%TEMP%\la.exe
%TEMP%\anowoirk.vbs
%ALLUSERSPROFILE%\softokn3.dll
%ALLUSERSPROFILE%\sqlite3.dll
%ALLUSERSPROFILE%\freebl3.dll
%ALLUSERSPROFILE%\mozglue.dll
%ALLUSERSPROFILE%\msvcp140.dll
%TEMP%\a8c2238f\api-ms-win-core-rtlsupport-l1-1-0.dll
%WINDIR%\temp\ebjtv20n.exe
%ALLUSERSPROFILE%\nss3.dll
%ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
%ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
%LOCALAPPDATA%\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
%ALLUSERSPROFILE%\668344332285471\temp
%ALLUSERSPROFILE%\668344332285471\temp-shm
%ALLUSERSPROFILE%\668344332285471\cookies\mozilla firefox_gn7ryp3k.default.txt
%ALLUSERSPROFILE%\668344332285471\autofill\mozilla firefox_gn7ryp3k.default.txt
%TEMP%\ueinyo.vbs
%ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
%LOCALAPPDATA%low\screen.jpeg
%TEMP%\a8c2238f\api-ms-win-core-string-l1-1-0.dll
%TEMP%\a8c2238f\api-ms-win-core-timezone-l1-1-0.dll
%TEMP%\a8c2238f\ucrtbase.dll
%TEMP%\a8c2238f\vcruntime140.dll
%TEMP%\11137846297978985555231.tmp
%TEMP%\11138153681258942691445.tmp
%TEMP%\1113862336310833796968.tmp
%TEMP%\11138784074768987903393.tmp
%TEMP%\a8c2238f\api-ms-win-core-datetime-l1-1-0.dll
%TEMP%\11139253042344350148718.tmp
%TEMP%\11139562705530732174873.tmp
%TEMP%\1113956431622849583900.tmp
%TEMP%\11139712830178910882400.tmp
%TEMP%\11139713185557937945612.tmp
%TEMP%\11139717934552343148672.tmp
%TEMP%\11139874921903880319165.tmp
%TEMP%\11140031908255317509657.tmp
%TEMP%\a8c2238f\nss3.dll
%TEMP%\11139253042344350148718.tmp-shm
%TEMP%\a8c2238f\softokn3.dll
%TEMP%\a8c2238f\nssdbm3.dll
%TEMP%\a8c2238f\msvcp140.dll
%TEMP%\a8c2238f\mozglue.dll
%TEMP%\a8c2238f\api-ms-win-core-util-l1-1-0.dll
%TEMP%\a8c2238f\api-ms-win-crt-conio-l1-1-0.dll
%TEMP%\a8c2238f\api-ms-win-crt-convert-l1-1-0.dll
%TEMP%\a8c2238f\api-ms-win-crt-environment-l1-1-0.dll
%TEMP%\a8c2238f\api-ms-win-crt-filesystem-l1-1-0.dll
%TEMP%\a8c2238f\api-ms-win-crt-heap-l1-1-0.dll
%TEMP%\a8c2238f\api-ms-win-core-synch-l1-1-0.dll
%TEMP%\a8c2238f\api-ms-win-crt-locale-l1-1-0.dll
%TEMP%\a8c2238f\api-ms-win-core-synch-l1-2-0.dll
%TEMP%\a8c2238f\api-ms-win-crt-multibyte-l1-1-0.dll
%TEMP%\a8c2238f\api-ms-win-crt-process-l1-1-0.dll
%TEMP%\a8c2238f\api-ms-win-crt-runtime-l1-1-0.dll
%TEMP%\a8c2238f\api-ms-win-crt-stdio-l1-1-0.dll
%TEMP%\a8c2238f\api-ms-win-crt-string-l1-1-0.dll
%TEMP%\a8c2238f\api-ms-win-crt-time-l1-1-0.dll
%TEMP%\a8c2238f\api-ms-win-crt-utility-l1-1-0.dll
%TEMP%\a8c2238f\api-ms-win-core-sysinfo-l1-1-0.dll
%TEMP%\a8c2238f\freebl3.dll
%TEMP%\a8c2238f\api-ms-win-crt-private-l1-1-0.dll
%WINDIR%\temp\kbj21jtt.inf

Удаляет следующие файлы

%ALLUSERSPROFILE%\668344332285471\temp
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-file-l2-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-handle-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-heap-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-interlocked-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-libraryloader-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-localization-l1-2-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-memory-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-namedpipe-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-processenvironment-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-processthreads-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-processthreads-l1-1-1.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-profile-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-rtlsupport-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-string-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-synch-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-file-l1-2-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-synch-l1-2-0.dll
%LOCALAPPDATA%low\libesllibes\accessiblemarshal.dll
%LOCALAPPDATA%low\flesffxeses\desktop.ini
%TEMP%\a8c2238f\vcruntime140.dll
%TEMP%\la.exe
%LOCALAPPDATA%low\libesllibes\lizilipes.zip
%LOCALAPPDATA%low\fraqbc8ws-shm
%LOCALAPPDATA%low\fraqbc8ws
%LOCALAPPDATA%low\jwtoiddcb-shm
%LOCALAPPDATA%low\jwtoiddcb
%LOCALAPPDATA%low\jat643jhj-shm
%LOCALAPPDATA%low\jat643jhj
%LOCALAPPDATA%low\opfbboj1n-shm
%LOCALAPPDATA%low\opfbboj1n
%LOCALAPPDATA%low\screen.jpeg
%LOCALAPPDATA%low\gtfxhgoswun.zip
%LOCALAPPDATA%low\firefox_urls.txt
%LOCALAPPDATA%low\machineinfo.txt
%LOCALAPPDATA%low\libesllibes\accessiblehandler.dll
%LOCALAPPDATA%low\libesllibes\freebl3.dll
%LOCALAPPDATA%low\libesllibes\ucrtbase.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-util-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\ldif60.dll
%LOCALAPPDATA%low\libesllibes\lgpllibs.dll
%LOCALAPPDATA%low\libesllibes\libegl.dll
%LOCALAPPDATA%low\libesllibes\mapiproxy.dll
%LOCALAPPDATA%low\libesllibes\mapiproxy_inuse.dll
%LOCALAPPDATA%low\libesllibes\mozglue.dll
%LOCALAPPDATA%low\libesllibes\mozmapi32.dll
%LOCALAPPDATA%low\libesllibes\mozmapi32_inuse.dll
%LOCALAPPDATA%low\libesllibes\msvcp140.dll
%LOCALAPPDATA%low\libesllibes\nss3.dll
%LOCALAPPDATA%low\libesllibes\nssckbi.dll
%LOCALAPPDATA%low\libesllibes\nssdbm3.dll
%LOCALAPPDATA%low\libesllibes\prldap60.dll
%LOCALAPPDATA%low\libesllibes\qipcap.dll
%LOCALAPPDATA%low\libesllibes\softokn3.dll
%LOCALAPPDATA%low\libesllibes\ldap60.dll
%TEMP%\a8c2238f\ucrtbase.dll
%LOCALAPPDATA%low\libesllibes\ia2marshal.dll
%LOCALAPPDATA%low\libesllibes\breakpadinjector.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-crt-conio-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-crt-convert-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-crt-environment-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-crt-filesystem-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-crt-heap-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-crt-locale-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-crt-math-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-crt-multibyte-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-crt-private-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-crt-process-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-crt-runtime-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-crt-stdio-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-crt-string-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-crt-time-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-crt-utility-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-sysinfo-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-timezone-l1-1-0.dll
%TEMP%\a8c2238f\softokn3.dll
%TEMP%\a8c2238f\api-ms-win-core-handle-l1-1-0.dll
%TEMP%\11139253042344350148718.tmp
%TEMP%\11139562705530732174873.tmp
%TEMP%\1113956431622849583900.tmp
%TEMP%\11139712830178910882400.tmp
%TEMP%\11139713185557937945612.tmp
%TEMP%\11139717934552343148672.tmp
%TEMP%\11139874921903880319165.tmp
%TEMP%\11140031908255317509657.tmp
%TEMP%\11140036384969481454523.tmp-shm
%TEMP%\11140036384969481454523.tmp
%TEMP%\a8c2238f\api-ms-win-core-console-l1-1-0.dll
%TEMP%\a8c2238f\api-ms-win-core-datetime-l1-1-0.dll
%TEMP%\a8c2238f\api-ms-win-core-debug-l1-1-0.dll
%TEMP%\a8c2238f\api-ms-win-core-errorhandling-l1-1-0.dll
%TEMP%\a8c2238f\api-ms-win-core-file-l1-1-0.dll
%TEMP%\11139253042344350148718.tmp-shm
%TEMP%\a8c2238f\api-ms-win-core-file-l1-2-0.dll
%TEMP%\11138784074768987903393.tmp
%TEMP%\11138153681258942691445.tmp
%ALLUSERSPROFILE%\668344332285471\temp-shm
%ALLUSERSPROFILE%\668344332285471\autofill\mozilla firefox_gn7ryp3k.default.txt
%ALLUSERSPROFILE%\668344332285471\cookies\mozilla firefox_gn7ryp3k.default.txt
%ALLUSERSPROFILE%\668344332285471\screenshot.jpg
%ALLUSERSPROFILE%\668344332285471\system.txt
%ALLUSERSPROFILE%\668344332285471\_6683443322.zip
%ALLUSERSPROFILE%\sqlite3.dll
%ALLUSERSPROFILE%\freebl3.dll
%ALLUSERSPROFILE%\mozglue.dll
%ALLUSERSPROFILE%\msvcp140.dll
%ALLUSERSPROFILE%\nss3.dll
%ALLUSERSPROFILE%\softokn3.dll
%ALLUSERSPROFILE%\vcruntime140.dll
%TEMP%\limos.exe
%TEMP%\11137846297978985555231.tmp
%TEMP%\1113862336310833796968.tmp
%TEMP%\a8c2238f\api-ms-win-crt-conio-l1-1-0.dll
%TEMP%\a8c2238f\nss3.dll
%TEMP%\a8c2238f\api-ms-win-core-heap-l1-1-0.dll
%TEMP%\a8c2238f\api-ms-win-crt-filesystem-l1-1-0.dll
%TEMP%\a8c2238f\api-ms-win-crt-heap-l1-1-0.dll
%TEMP%\a8c2238f\api-ms-win-crt-locale-l1-1-0.dll
%TEMP%\a8c2238f\api-ms-win-crt-math-l1-1-0.dll
%TEMP%\a8c2238f\api-ms-win-crt-multibyte-l1-1-0.dll
%TEMP%\a8c2238f\api-ms-win-crt-private-l1-1-0.dll
%TEMP%\a8c2238f\api-ms-win-crt-process-l1-1-0.dll
%TEMP%\a8c2238f\api-ms-win-crt-runtime-l1-1-0.dll
%TEMP%\a8c2238f\api-ms-win-crt-stdio-l1-1-0.dll
%TEMP%\a8c2238f\api-ms-win-crt-string-l1-1-0.dll
%TEMP%\a8c2238f\api-ms-win-crt-time-l1-1-0.dll
%TEMP%\a8c2238f\api-ms-win-crt-utility-l1-1-0.dll
%TEMP%\a8c2238f\freebl3.dll
%TEMP%\a8c2238f\mozglue.dll
%TEMP%\a8c2238f\msvcp140.dll
%TEMP%\a8c2238f\api-ms-win-crt-environment-l1-1-0.dll
%TEMP%\a8c2238f\nssdbm3.dll
%TEMP%\a8c2238f\api-ms-win-crt-convert-l1-1-0.dll
%TEMP%\a8c2238f\api-ms-win-core-util-l1-1-0.dll
%TEMP%\a8c2238f\api-ms-win-core-interlocked-l1-1-0.dll
%TEMP%\a8c2238f\api-ms-win-core-libraryloader-l1-1-0.dll
%TEMP%\a8c2238f\api-ms-win-core-localization-l1-2-0.dll
%TEMP%\a8c2238f\api-ms-win-core-memory-l1-1-0.dll
%TEMP%\a8c2238f\api-ms-win-core-namedpipe-l1-1-0.dll
%TEMP%\a8c2238f\api-ms-win-core-processenvironment-l1-1-0.dll
%TEMP%\a8c2238f\api-ms-win-core-processthreads-l1-1-0.dll
%TEMP%\a8c2238f\api-ms-win-core-processthreads-l1-1-1.dll
%TEMP%\a8c2238f\api-ms-win-core-profile-l1-1-0.dll
%TEMP%\a8c2238f\api-ms-win-core-rtlsupport-l1-1-0.dll
%TEMP%\a8c2238f\api-ms-win-core-string-l1-1-0.dll
%TEMP%\a8c2238f\api-ms-win-core-synch-l1-1-0.dll
%TEMP%\a8c2238f\api-ms-win-core-synch-l1-2-0.dll
%TEMP%\a8c2238f\api-ms-win-core-sysinfo-l1-1-0.dll
%TEMP%\a8c2238f\api-ms-win-core-timezone-l1-1-0.dll
%TEMP%\a8c2238f\api-ms-win-core-file-l2-1-0.dll
%LOCALAPPDATA%low\libesllibes\vcruntime140.dll

Подменяет следующие файлы

%ALLUSERSPROFILE%\668344332285471\temp
%ALLUSERSPROFILE%\668344332285471\temp-shm

Самоудаляется.

Сетевая активность

TCP

Запросы HTTP GET

http://mo####rgio.ac.ug/ac.exe
http://mo####rgio.ac.ug/rc.exe
http://mo####rgio.ac.ug/ds2.exe
http://mo####rgio.ac.ug/ds1.exe
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
http://21#.#.117.77/ac.exe
http://21#.#.117.77/rc.exe
http://21#.#.117.77/ds1.exe
http://21#.#.117.77/ds2.exe

Запросы HTTP POST

http://mo####rgio.ac.ug/index.php

'te##te.in':443

'tr###sad.site':443

'cd#.##scordapp.com':443

UDP

DNS ASK te##te.in
DNS ASK tr###sad.site
DNS ASK mo###egio.ug
DNS ASK mo####rgio.ac.ug
DNS ASK microsoft.com
DNS ASK ma###p.ac.ug
DNS ASK ma###palgo.ug
DNS ASK di##ord.com
DNS ASK cd#.##scordapp.com

Другое

Ищет следующие окна

ClassName: '' WindowName: ''

Создает и запускает на исполнение

'%WINDIR%\syswow64\wscript.exe' "%TEMP%\Ueinyo.vbs"
'%TEMP%\ulfoggzwpk.exe'
'%TEMP%\j1knn0oc4o.exe'
'%TEMP%\fszjbgduip.exe'
'%TEMP%\ds1.exe'
'%WINDIR%\syswow64\wscript.exe' "%TEMP%\Anowoirk.vbs"
'%TEMP%\zjhlxjo7ns.exe'
'%TEMP%\ds2.exe'
'%TEMP%\la.exe'
'%TEMP%\limos.exe'
'%TEMP%\ac.exe'
'%TEMP%\rc.exe'
'%TEMP%\zjhlxjo7ns.exe' ' (со скрытым окном)
'%TEMP%\j1knn0oc4o.exe' ' (со скрытым окном)
'%WINDIR%\syswow64\cmd.exe' /c taskkill /pid 2020 & erase %TEMP%\Limos.exe & RD /S /Q C:\\ProgramData\\668344332285471\\* & exit' (со скрытым окном)
'%TEMP%\la.exe' ' (со скрытым окном)
'%WINDIR%\syswow64\cmd.exe' /c <SYSTEM32>\timeout.exe 3 & del "La.exe"' (со скрытым окном)
'%TEMP%\fszjbgduip.exe' ' (со скрытым окном)
'%TEMP%\limos.exe' ' (со скрытым окном)
'%TEMP%\ulfoggzwpk.exe' ' (со скрытым окном)

Запускает на исполнение

'%WINDIR%\syswow64\cmd.exe' /c taskkill /pid 2020 & erase %TEMP%\Limos.exe & RD /S /Q C:\\ProgramData\\668344332285471\\* & exit
'%WINDIR%\syswow64\cmd.exe' /c <SYSTEM32>\timeout.exe 3 & del "La.exe"
'%WINDIR%\syswow64\timeout.exe' 3
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath '"%APPDATA%\Microsoft\Windows\Start Menu\Programs\VideoLAN\ddvlc.exe"'
'%WINDIR%\syswow64\cmstp.exe' /au %WINDIR%\temp\1nstjtpc.inf
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Get-MpPreference -verbose
'%WINDIR%\syswow64\cmd.exe' /C timeout /T 10 /NOBREAK > Nul & Del /f /q "<Полный путь к файлу>"
'%WINDIR%\syswow64\timeout.exe' /T 10 /NOBREAK
'%WINDIR%\syswow64\cmstp.exe' /au %WINDIR%\temp\kbj21jtt.inf

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней